[
https://issues.apache.org/jira/browse/SOLR-13179?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Marek updated SOLR-13179:
-------------------------
Description:
Requesting the following URL causes Solr to return an HTTP 500 error response:
{noformat}
http://localhost:8983/solr/films/select?facet.query=&q={!frange%20l=10%20u=100}boost({!v=+},3)&~ama&debugQuery=on&facet=true&r
{noformat}
The error response seems to be caused by the following uncaught exception:
{noformat}
ERROR (qtp1067599825-23) [ x:films] o.a.s.s.HttpSolrCall
null:java.lang.NullPointerException
at
org.apache.lucene.queries.function.FunctionScoreQuery.rewrite(FunctionScoreQuery.java:109)
at
org.apache.lucene.search.IndexSearcher.rewrite(IndexSearcher.java:667)
at
org.apache.lucene.queries.function.valuesource.QueryValueSource.createWeight(QueryValueSource.java:75)
at
org.apache.solr.search.function.ValueSourceRangeFilter.createWeight(ValueSourceRangeFilter.java:105)
at
org.apache.solr.search.SolrConstantScoreQuery$ConstantWeight.<init>(SolrConstantScoreQuery.java:94)
at
org.apache.solr.search.SolrConstantScoreQuery.createWeight(SolrConstantScoreQuery.java:119)
at
org.apache.lucene.search.IndexSearcher.createWeight(IndexSearcher.java:717)
at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:443)
at
org.apache.solr.search.SolrIndexSearcher.buildAndRunCollectorChain(SolrIndexSearcher.java:200)
at
org.apache.solr.search.SolrIndexSearcher.getDocListAndSetNC(SolrIndexSearcher.java:1711)
at
org.apache.solr.search.SolrIndexSearcher.getDocListC(SolrIndexSearcher.java:1416)
at
org.apache.solr.search.SolrIndexSearcher.search(SolrIndexSearcher.java:567)
at
org.apache.solr.handler.component.QueryComponent.doProcessUngroupedSearch(QueryComponent.java:1434)
at
org.apache.solr.handler.component.QueryComponent.process(QueryComponent.java:373)
at
org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:306)
at
org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199)
at org.apache.solr.core.SolrCore.execute(SolrCore.java:2559)
at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:711)
at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:516)
at
org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:394)
at
org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:340)
[...]
{noformat}
1. In org/apache/solr/search/ValueSourceParser.java[330] a variable query 'q'
is assigned the value null, which is obtained from
org/apache/solr/search/LuceneQParser.java[39], because a variable 'qstr' is the
empty string.
2. In org/apache/solr/search/ValueSourceParser.java[332] the null value of 'q'
is passed to function 'FunctionScoreQuery.boostByValue', which in turn leads to
initialisation of member 'in' of
org.apache.lucene.queries.function.FunctionScoreQuery to null at
org/apache/lucene/queries/function/FunctionScoreQuery.java[56].
3. Later, during execution of the query, there is dereferenced the member 'in'
(still having the null value) at
org/apache/lucene/queries/function/FunctionScoreQuery.java[109].
----------------------------------------
We found this bug using [Diffblue Microservices
Testing|https://www.diffblue.com/labs/]. Find more information on this [fuzz
testing
campaign|https://www.diffblue.com/blog/2018/12/19/diffblue-microservice-testing-a-sneak-peek-at-our-early-product-and-results].
was:
Execution of the URL query:
*http://localhost:8983/solr/films/select?q=\{!frange%20l=10%20u=100}boost(\{!v=+},3)*
leads to a NullPointerException:
2019-01-29 13:42:04.662 ERROR (qtp689401025-21) [ x:films] o.a.s.s.HttpSolrCall
null:java.lang.NullPointerException
at
org.apache.lucene.queries.function.FunctionScoreQuery.rewrite(FunctionScoreQuery.java:109)
at org.apache.lucene.search.IndexSearcher.rewrite(IndexSearcher.java:667)
at
org.apache.lucene.queries.function.valuesource.QueryValueSource.createWeight(QueryValueSource.java:75)
at
org.apache.solr.search.function.ValueSourceRangeFilter.createWeight(ValueSourceRangeFilter.java:105)
at
org.apache.solr.search.SolrConstantScoreQuery$ConstantWeight.<init>(SolrConstantScoreQuery.java:94)
at
org.apache.solr.search.SolrConstantScoreQuery.createWeight(SolrConstantScoreQuery.java:119)
at org.apache.lucene.search.IndexSearcher.createWeight(IndexSearcher.java:717)
at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:443)
at
org.apache.solr.search.SolrIndexSearcher.buildAndRunCollectorChain(SolrIndexSearcher.java:200)
at
org.apache.solr.search.SolrIndexSearcher.getDocListNC(SolrIndexSearcher.java:1604)
at
org.apache.solr.search.SolrIndexSearcher.getDocListC(SolrIndexSearcher.java:1420)
at org.apache.solr.search.SolrIndexSearcher.search(SolrIndexSearcher.java:567)
at
org.apache.solr.handler.component.QueryComponent.doProcessUngroupedSearch(QueryComponent.java:1434)
at
org.apache.solr.handler.component.QueryComponent.process(QueryComponent.java:373)
at
org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:298)
at
org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199)
at org.apache.solr.core.SolrCore.execute(SolrCore.java:2559)
[...]
More details:
1. In org/apache/solr/search/ValueSourceParser.java[330] a variable query 'q'
is assigned the value null, which is obtained from
org/apache/solr/search/LuceneQParser.java[39], because a variable 'qstr' is the
empty string.
2. In org/apache/solr/search/ValueSourceParser.java[332] the null value of 'q'
is passed to function 'FunctionScoreQuery.boostByValue', which in turn leads to
initialisation of member 'in' of
org.apache.lucene.queries.function.FunctionScoreQuery to null at
org/apache/lucene/queries/function/FunctionScoreQuery.java[56].
3. Later, during execution of the query, there is dereferenced the member 'in'
(still having the null value) at
org/apache/lucene/queries/function/FunctionScoreQuery.java[109].
See section 'Environment' to see how Solr and data (films collection) were
installed and configured.
---------------------------------
This bug was found using [Diffblue Microservices
Testing|http://www.diffblue.com/labs]. Find more information on this [test
campaign|https://www.diffblue.com/blog/2018/12/19/diffblue-microservice-testing-a-sneak-peek-at-our-early-product-and-results].
> NullPointerException in
> org/apache/lucene/queries/function/FunctionScoreQuery.java [109]
> ----------------------------------------------------------------------------------------
>
> Key: SOLR-13179
> URL: https://issues.apache.org/jira/browse/SOLR-13179
> Project: Solr
> Issue Type: Bug
> Security Level: Public(Default Security Level. Issues are Public)
> Affects Versions: master (9.0)
> Environment: h1. Steps to reproduce
> * Use a Linux machine.
> * Build commit {{ea2c8ba}} of Solr as described in the section below.
> * Build the films collection as described below.
> * Start the server using the command {{./bin/solr start -f -p 8983 -s
> /tmp/home}}
> * Request the URL given in the bug description.
> h1. Compiling the server
> {noformat}
> git clone https://github.com/apache/lucene-solr
> cd lucene-solr
> git checkout ea2c8ba
> ant compile
> cd solr
> ant server
> {noformat}
> h1. Building the collection
> We followed [Exercise
> 2|http://lucene.apache.org/solr/guide/7_5/solr-tutorial.html#exercise-2] from
> the [Solr
> Tutorial|http://lucene.apache.org/solr/guide/7_5/solr-tutorial.html]. The
> attached file ({{home.zip}}) gives the contents of folder {{/tmp/home}} that
> you will obtain by following the steps below:
> {noformat}
> mkdir -p /tmp/home
> echo '<?xml version="1.0" encoding="UTF-8" ?><solr></solr>' >
> /tmp/home/solr.xml
> {noformat}
> In one terminal start a Solr instance in foreground:
> {noformat}
> ./bin/solr start -f -p 8983 -s /tmp/home
> {noformat}
> In another terminal, create a collection of movies, with no shards and no
> replication, and initialize it:
> {noformat}
> bin/solr create -c films
> curl -X POST -H 'Content-type:application/json' --data-binary '{"add-field":
> {"name":"name", "type":"text_general", "multiValued":false, "stored":true}}'
> http://localhost:8983/solr/films/schema
> curl -X POST -H 'Content-type:application/json' --data-binary
> '{"add-copy-field" : {"source":"*","dest":"_text_"}}'
> http://localhost:8983/solr/films/schema
> ./bin/post -c films example/films/films.json
> {noformat}
> Reporter: Marek
> Priority: Minor
> Attachments: home.zip
>
>
> Requesting the following URL causes Solr to return an HTTP 500 error response:
> {noformat}
> http://localhost:8983/solr/films/select?facet.query=&q={!frange%20l=10%20u=100}boost({!v=+},3)&~ama&debugQuery=on&facet=true&r
> {noformat}
> The error response seems to be caused by the following uncaught exception:
> {noformat}
> ERROR (qtp1067599825-23) [ x:films] o.a.s.s.HttpSolrCall
> null:java.lang.NullPointerException
> at
> org.apache.lucene.queries.function.FunctionScoreQuery.rewrite(FunctionScoreQuery.java:109)
> at
> org.apache.lucene.search.IndexSearcher.rewrite(IndexSearcher.java:667)
> at
> org.apache.lucene.queries.function.valuesource.QueryValueSource.createWeight(QueryValueSource.java:75)
> at
> org.apache.solr.search.function.ValueSourceRangeFilter.createWeight(ValueSourceRangeFilter.java:105)
> at
> org.apache.solr.search.SolrConstantScoreQuery$ConstantWeight.<init>(SolrConstantScoreQuery.java:94)
> at
> org.apache.solr.search.SolrConstantScoreQuery.createWeight(SolrConstantScoreQuery.java:119)
> at
> org.apache.lucene.search.IndexSearcher.createWeight(IndexSearcher.java:717)
> at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:443)
> at
> org.apache.solr.search.SolrIndexSearcher.buildAndRunCollectorChain(SolrIndexSearcher.java:200)
> at
> org.apache.solr.search.SolrIndexSearcher.getDocListAndSetNC(SolrIndexSearcher.java:1711)
> at
> org.apache.solr.search.SolrIndexSearcher.getDocListC(SolrIndexSearcher.java:1416)
> at
> org.apache.solr.search.SolrIndexSearcher.search(SolrIndexSearcher.java:567)
> at
> org.apache.solr.handler.component.QueryComponent.doProcessUngroupedSearch(QueryComponent.java:1434)
> at
> org.apache.solr.handler.component.QueryComponent.process(QueryComponent.java:373)
> at
> org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:306)
> at
> org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199)
> at org.apache.solr.core.SolrCore.execute(SolrCore.java:2559)
> at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:711)
> at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:516)
> at
> org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:394)
> at
> org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:340)
> [...]
> {noformat}
> 1. In org/apache/solr/search/ValueSourceParser.java[330] a variable query 'q'
> is assigned the value null, which is obtained from
> org/apache/solr/search/LuceneQParser.java[39], because a variable 'qstr' is
> the empty string.
> 2. In org/apache/solr/search/ValueSourceParser.java[332] the null value of
> 'q' is passed to function 'FunctionScoreQuery.boostByValue', which in turn
> leads to initialisation of member 'in' of
> org.apache.lucene.queries.function.FunctionScoreQuery to null at
> org/apache/lucene/queries/function/FunctionScoreQuery.java[56].
> 3. Later, during execution of the query, there is dereferenced the member
> 'in' (still having the null value) at
> org/apache/lucene/queries/function/FunctionScoreQuery.java[109].
> ----------------------------------------
> We found this bug using [Diffblue Microservices
> Testing|https://www.diffblue.com/labs/]. Find more information on this [fuzz
> testing
> campaign|https://www.diffblue.com/blog/2018/12/19/diffblue-microservice-testing-a-sneak-peek-at-our-early-product-and-results].
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@lucene.apache.org
For additional commands, e-mail: dev-h...@lucene.apache.org
