SERVER-2810 check for dropped explain cursor before accessing so

2 files changed, 18 insertions, 1 deletions

diff --git a/db/query.cpp b/db/query.cpp
index eaf508bf508..7f23ac8aee3 100644
--- a/db/query.cpp
+++ b/db/query.cpp
@@ -858,6 +858,7 @@ namespace mongo {
 
         // this plan won, so set data for response broadly
         void finish( bool stop ) {
+            massert( 13638, "client cursor dropped during explain query yield", !_pq.isExplain() || _c.get() );
 
             if ( _pq.isExplain() ) {
                 _n = _inMemSort ? _so->size() : _n;
@@ -879,7 +880,6 @@ namespace mongo {
             }
 
             if ( _pq.isExplain() ) {
-                massert( 13638, "client cursor dropped during explain query yield", _c.get() );
                 _eb.noteScan( _c.get(), _nscanned, _nscannedObjects, _n, scanAndOrderRequired(),
                               _curop.elapsedMillis(), useHints && !_pq.getHint().eoo(), _nYields ,
                               _nChunkSkips, _keyFieldsOnly.get() > 0 );
diff --git a/jstests/slowNightly/explain3.js b/jstests/slowNightly/explain3.js
new file mode 100644
index 00000000000..af6fde7b81b
--- /dev/null
+++ b/jstests/slowNightly/explain3.js
@@ -0,0 +1,17 @@
+// SERVER-2810 - similar to explain1 test, but with a scan and order find
+
+t = db.jstests_slowNightly_explain3;
+t.drop();
+
+// Periodically drops the collection, invalidating client cursors for s2's operations.
+s1 = startParallelShell( "t = db.jstests_slowNightly_explain1; for( var i = 0; i < 80; ++i ) { t.drop(); t.ensureIndex({x:1}); for( var j = 0; j < 1000; ++j ) { t.save( {x:j,y:1} ) }; sleep( 100 ); }" );
+
+// Query repeatedly.
+s2 = startParallelShell( "t = db.jstests_slowNightly_explain1; for( var i = 0; i < 500; ++i ) { try { z = t.find( {x:{$gt:0},y:1} ).sort({x:1}).explain(); } catch( e ) {} }" );
+
+// Put pressure on s2 to yield more often.
+s3 = startParallelShell( "t = db.jstests_slowNightly_explain1; for( var i = 0; i < 200; ++i ) { t.validate({scandata:true}); }" );
+
+s1();
+s2();
+s3();