web interface aql query returns more than 1000 items, arangod gets segment fault (core dump)

[xchmwang]

My Environment

• ArangoDB Version: 3.3.13
• Storage Engine: RocksDB
• Deployment Mode: Single Server
• Deployment Strategy: Manual Start (arangod --server.endpoint http+tcp://0.0.0.0:8529)
• Configuration: single server
• Infrastructure: AWS
• Operating System: Ubuntu 16.04
• Used Package: Ubuntu .deb

Component, Query & Data

Affected feature:
AQL query using web interface

AQL query (if applicable):
for tx in transaction
filter tx.height>380000 and tx.height<380215
return tx

AQL explain (if applicable):
Query string:
for tx in transaction
filter tx.height>380000 and tx.height<380215
return tx

Execution plan:
Id NodeType Est. Comment
1 SingletonNode 1 * ROOT
6 IndexNode 71865 - FOR tx IN transaction /* skiplist index scan */
5 ReturnNode 71865 - RETURN tx

Indexes used:
By Type Collection Unique Sparse Selectivity Fields Ranges
6 skiplist transaction false false n/a [ height ] ((tx.height > 380000) && (tx.height < 380215))

Optimization rules applied:
Id RuleName
1 use-indexes
2 remove-filter-covered-by-index
3 remove-unnecessary-calculations-2

Dataset:

Replication Factor & Number of Shards (Cluster only):

Steps to reproduce

1. execute aql query: for tx in transaction filter tx.height>380000 and tx.height<380215 return tx

Problem:
arangod process stopped (segment fault, core dump)

and I use lldb to debug, it returns:
Process 3083 stopped

• thread Filtern #5: tid = 3100, 0x00007ffff6eefd44 libpthread.so.0__GI___pthread_mutex_lock + 4, name = 'Scheduler', stop reason = signal SIGSEGV: invalid address (fault address: 0x30) frame #0: 0x00007ffff6eefd44 libpthread.so.0__GI___pthread_mutex_lock + 4
  libpthread.so.0`__GI___pthread_mutex_lock:
  -> 0x7ffff6eefd44 <+4>: movl 0x10(%rdi), %edx
  0x7ffff6eefd47 <+7>: movl %edx, %ecx
  0x7ffff6eefd49 <+9>: andl $0x17f, %ecx ; imm = 0x17F
  0x7ffff6eefd4f <+15>: nop

and I use backtrace the error, I get

• thread Multibyte of UNICODE encoding is not correct. #42: tid = 13373, 0x00007ffff6eefd44 libpthread.so.0`__GI___pthread_mutex_lock + 4, name = 'Scheduler', stop reason = signal SIGSEGV: invalid address (fault address: 0x30)
  • frame #0: 0x00007ffff6eefd44 libpthread.so.0__GI___pthread_mutex_lock + 4 frame #1: 0x0000000001244ba9 arangodarangodb::Mutex::lock() + 25
    frame Segmentation Fault auf dem Mac #2: 0x0000000000cea3f9 arangodarangodb::AgencyCommManager::acquire(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) + 41 frame #3: 0x0000000000cecf64 arangodarangodb::AgencyComm::sendWithFailover(arangodb::rest::RequestType, double, std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, arangodb::velocypack::Slice) + 116
    frame JSON.stringify #4: 0x0000000000cef12c arangodarangodb::AgencyComm::getValues(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) + 332 frame #5: 0x000000000095940b arangodarangodb::ClusterInfo::loadCurrentMappings() + 107
    frame Added actions to admin #6: 0x0000000000959ce0 arangodarangodb::ClusterInfo::getCoordinatorByShortID[abi:cxx11](unsigned int) + 64 frame #7: 0x0000000000ec74a5 arangodarangodb::rest::RestHandler::forwardRequest() + 101
    frame Struktur der Dokumentation #8: 0x0000000001188915 arangodarangodb::rest::GeneralCommTask::executeRequest(std::unique_ptr<arangodb::GeneralRequest, std::default_delete<arangodb::GeneralRequest> >&&, std::unique_ptr<arangodb::GeneralResponse, std::default_delete<arangodb::GeneralResponse> >&&) + 341 frame #9: 0x0000000001112b6d arangodarangodb::rest::HttpCommTask::processRequest(std::unique_ptr<arangodb::HttpRequest, std::default_deletearangodb::HttpRequest >) + 189
    frame Actions #10: 0x0000000001117e82 arangodarangodb::rest::HttpCommTask::processRead(double) + 3778 frame #11: 0x000000000116dac2 arangodarangodb::rest::SocketTask::processAll() + 194
    frame Documentation hasNext #12: 0x000000000116e9ff arangod??? + 175 frame #13: 0x0000000001161ea9 arangodvoid boost::asio::detail::strand_service::dispatch<boost::asio::detail::binder2<std::function<void (boost::system::error_code const&, unsigned long)>, boost::system::error_code, unsigned long> >(boost::asio::detail::strand_service::strand_im
    pl*&, boost::asio::detail::binder2<std::function<void (boost::system::error_code const&, unsigned long)>, boost::system::error_code, unsigned long>&) + 105
    frame Reading CSV files #14: 0x0000000001162160 arangodvoid boost::asio::detail::wrapped_handler<boost::asio::io_service::strand, std::function<void (boost::system::error_code const&, unsigned long)>, boost::asio::detail::is_continuation_if_running>::operator()<boost::system::error_code, unsigne d long>(boost::system::error_code const&, unsigned long const&) + 224 frame #15: 0x00000000011629c9 arangodboost::asio::detail::completion_handler<boost::asio::detail::rewrapped_handler<boost::asio::detail::binder2<boost::asio::detail::wrapped_handler<boost::asio::io_service::strand, std::function<void (boost::system::error_code const&, unsigned
    long)>, boost::asio::detail::is_continuation_if_running>, boost::system::error_code, unsigned long>, std::function<void (boost::system::error_code const&, unsigned long)> > >::do_complete(boost::asio::detail::task_io_service*, boost::asio::detail::task_io_service_operation*, boost::
    system::error_code const&, unsigned long) + 313
    frame Property access for edges and vertices #16: 0x00000000011637af arangodvoid boost::asio::detail::strand_service::dispatch<boost::asio::detail::rewrapped_handler<boost::asio::detail::binder2<boost::asio::detail::wrapped_handler<boost::asio::io_service::strand, std::function<void (boost::system::error_code const& , unsigned long)>, boost::asio::detail::is_continuation_if_running>, boost::system::error_code, unsigned long>, std::function<void (boost::system::error_code const&, unsigned long)> > >(boost::asio::detail::strand_service::strand_impl*&, boost::asio::detail::rewrapped_handler<boost: :asio::detail::binder2<boost::asio::detail::wrapped_handler<boost::asio::io_service::strand, std::function<void (boost::system::error_code const&, unsigned long)>, boost::asio::detail::is_continuation_if_running>, boost::system::error_code, unsigned long>, std::function<void (boost: :system::error_code const&, unsigned long)> >&) + 511 frame #17: 0x0000000001163a55 arangodboost::asio::detail::reactive_socket_recv_op<boost::asio::mutable_buffers_1, boost::asio::detail::wrapped_handler<boost::asio::io_service::strand, std::function<void (boost::system::error_code const&, unsigned long)>, boost::asio::detail::is
    _continuation_if_running> >::do_complete(boost::asio::detail::task_io_service*, boost::asio::detail::task_io_service_operation*, boost::system::error_code const&, unsigned long) + 549
    frame addOutEdge and addInEdge #18: 0x0000000000adab3e arangodboost::asio::detail::epoll_reactor::descriptor_state::do_complete(boost::asio::detail::task_io_service*, boost::asio::detail::task_io_service_operation*, boost::system::error_code const&, unsigned long) + 318 frame #19: 0x0000000000acf806 arangod??? + 2182
    frame Added information about the homebrew package to the README #20: 0x0000000001261b19 arangodarangodb::Thread::startThread(void*) + 89 frame #21: 0x0000000001314e7a arangod??? + 74
    frame Typo .... #22: 0x00007ffff6eed6ba libpthread.so.0start_thread + 202 frame #23: 0x00007ffff691a41d libc.so.6clone + 109

Expected result:
return correct query results

[jsteemann]

This is very likely a duplicate of #6076 and #6131.
The issue is fixed in release 3.3.14, which is currently in the QA stage.

[xchmwang]

thanks, and where can I download release 3.3.14 package, or should I build from source code?

[jsteemann]

The release packages for 3.3.14 are not yet published, because they are currently in the QA stage. I cannot give an exact ETA for the release, because it always depends on the result of the QA process. It may be today, or it may be later...

If you like, you can meanwhile build from source using the tag v3.3.14.

[xchmwang]

ok, thanks, I will try.

[xchmwang]

It seems ok when I build from source (branch devel), only get warnning:

2018-08-16T13:58:16Z [45396] WARNING catch error in historian: TypeError: db.__save is not a function\n at Object.exports.historian (/usr/share/arangodb3/js/server/modules/@arangodb/statistics.js:469:8)\n at eval (eval at (unknown source), :3:54)\n at eval (eval at (unknown source), :3:70)

[jsteemann]

The warning occurs because you are using devel (as opposed to 3.3.x) with the JavaScript sources installed by 3.3.x. In order to have a working devel installation, you should use the JavaScript code as shipped with the devel branch too, and delete the previously installed 3.3.x JavaScript code.

Because devel is still under development and not recommended for any live usage, it would be better to use v3.3.14 for now. The JavaScript code in this branch/tag is also compatible with the JavaScript code you already had installed before with the other 3.3.x version.