[SOLR-13182] NullPointerException due to an invariant violation in org/apache/lucene/search/BooleanClause.java[60]

• Type: Bug
• Status: Patch Available
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 9.0
• Labels: diffblue newdev

Environment

Steps to reproduce

• Use a Linux machine.
• Build commit ea2c8ba of Solr as described in the section below.
• Build the films collection as described below.
• Start the server using the command ./bin/solr start -f -p 8983 -s /tmp/home
• Request the URL given in the bug description.

Compiling the server

git clone https://github.com/apache/lucene-solr
cd lucene-solr
git checkout ea2c8ba
ant compile
cd solr
ant server

Building the collection

We followed Exercise 2 from the Solr Tutorial. The attached file (home.zip) gives the contents of folder /tmp/home that you will obtain by following the steps below:

mkdir -p /tmp/home
echo '<?xml version="1.0" encoding="UTF-8" ?><solr></solr>' > /tmp/home/solr.xml

In one terminal start a Solr instance in foreground:

./bin/solr start -f -p 8983 -s /tmp/home

In another terminal, create a collection of movies, with no shards and no replication, and initialize it:

bin/solr create -c films
curl -X POST -H 'Content-type:application/json' --data-binary '{"add-field": {"name":"name", "type":"text_general", "multiValued":false, "stored":true}}' http://localhost:8983/solr/films/schema
curl -X POST -H 'Content-type:application/json' --data-binary '{"add-copy-field" : {"source":"*","dest":"_text_"}}' http://localhost:8983/solr/films/schema
./bin/post -c films example/films/films.json

• Assignee: Unassigned
• Reporter: Marek
• Created: 29/Jan/19 16:13
• Updated: 01/Apr/23 00:10

Description

Requesting the following URL causes Solr to return an HTTP 500 error response:

http://localhost:8983/solr/films/select?q={!child%20q={}

The error response seems to be caused by the following uncaught exception:

ERROR (qtp689401025-14) [ x:films] o.a.s.h.RequestHandlerBase java.lang.NullPointerException: Query must not be null
 at java.util.Objects.requireNonNull(Objects.java:228)
 at org.apache.lucene.search.BooleanClause.<init>(BooleanClause.java:60)
 at org.apache.lucene.search.BooleanQuery$Builder.add(BooleanQuery.java:127)
 at org.apache.solr.search.join.BlockJoinChildQParser.noClausesQuery(BlockJoinChildQParser.java:50)
 at org.apache.solr.search.join.FiltersQParser.parse(FiltersQParser.java:60)
 at org.apache.solr.search.QParser.getQuery(QParser.java:173)
 at org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:158)
 at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:272)
 at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199)
 at org.apache.solr.core.SolrCore.execute(SolrCore.java:2559)
 at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:711)
 at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:516)
 at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:394)
 at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:340)

[...]

In org/apache/solr/search/join/BlockJoinChildQParser.java[47] there is
computed query variable 'parents', which receives value null from call to
'parseParentFilter()'. The null value is then passed to
'org.apache.lucene.search.BooleanQuery.Builder.add' method at line 50. That
method calls the constructor where 'Objects.requireNonNull' failes
(the exception is thrown).

The call to 'parseParentFilter()' evaluates to null, because:

1. In org/apache/solr/search/join/BlockJoinParentQParser.java[59] null is
      set to string 'filter' (becase "which" is not in 'localParams' map).
2. The parser 'parentParser' obtained in the next line has member 'qstr' set
      to null, because the 'filter' passed to 'subQuery' is passed as the first
      argument to 'org.apache.solr.search.QParserPlugin.createParser'.
3. Subsequnt call to 'org.apache.solr.search.QParser.getQuery' on the
      'parentParser' at org/apache/solr/search/join/BlockJoinParentQParser.java[61]
      leads to retuning null in 'org.apache.solr.search.LuceneQParser.parse',
      because the queried string 'qstr' is the empty string.

--------------------------------------
We found this bug using Diffblue Microservices Testing. Find more information on this fuzz testing campaign.

Issue Links

• links to: GitHub Pull Request #338