Found in QA-322, update_geo_dedup.js

The behavior exists in 2.4.6 as follows:

• Assertion in mongod
  Thu Dec 12 11:43:48.215 [conn1] Assertion: 10334:BSONObj size: -286331154 (0xEEEEEEEE) is invalid. Size must be between 0 and 16793600(16MB) First element: _id: ObjectId('52a9e7a29013d3eba0228d38')
  0x10044ac7b 0x1004246ce 0x10042478d 0x10007e6d7 0x1003b6a2c 0x100246982 0x10024861f 0x1001eaf9b 0x1001ee3e1 0x10000b9a2 0x100440669 0x10047d815 0x7fff9435e772 0x7fff9434b1a1
  0 mongod 0x000000010044ac7b _ZN5mongo15printStackTraceERSo + 43
  1 mongod 0x00000001004246ce _ZN5mongo11msgassertedEiPKc + 174
  2 mongod 0x000000010042478d _ZN5mongo11msgassertedEiRKSs + 29
  3 mongod 0x000000010007e6d7 _ZNK5mongo7BSONObj14_assertInvalidEv + 1255
  4 mongod 0x00000001003b6a2c _ZN5mongo7BSONObjC1EPKc + 44
  5 mongod 0x0000000100246982 _ZN5mongo14_updateObjectsEbPKcRKNS_7BSONObjES4_bbbRNS_7OpDebugEPNS_11RemoveSaverEbRKNS_24QueryPlanSelectionPolicyEb + 6626
  6 mongod 0x000000010024861f _ZN5mongo13updateObjectsEPKcRKNS_7BSONObjES4_bbbRNS_7OpDebugEbRKNS_24QueryPlanSelectionPolicyE + 127
  7 mongod 0x00000001001eaf9b _ZN5mongo14receivedUpdateERNS_7MessageERNS_5CurOpE + 1643
  8 mongod 0x00000001001ee3e1 _ZN5mongo16assembleResponseERNS_7MessageERNS_10DbResponseERKNS_11HostAndPortE + 6193
  9 mongod 0x000000010000b9a2 _ZN5mongo16MyMessageHandler7processERNS_7MessageEPNS_21AbstractMessagingPortEPNS_9LastErrorE + 198
  10 mongod 0x0000000100440669 _ZN5mongo17PortMessageServer17handleIncomingMsgEPv + 1657
  11 mongod 0x000000010047d815 thread_proxy + 229
  12 libsystem_c.dylib 0x00007fff9435e772 _pthread_start + 327
  13 libsystem_c.dylib 0x00007fff9434b1a1 thread_start + 13
  Thu Dec 12 11:43:48.245 [conn1] update test.jstests_geo_deduplication query:
  Unknown macro: { locs}

  update:

  Unknown macro: { $inc}

  nscanned:2 nmoved:1 keyUpdates:0 exception: BSONObj size: -286331154 (0xEEEEEEEE) is invalid. Size must be between 0 and 16793600(16MB) First element: _id: ObjectId('52a9e7a29013d3eba0228d38') code:10334 locks(micros) w:36357 36ms

Mongo shell (client) sees the following:
> t.update({locs: {$near: [50.0, 50.0]}}, {$inc: {touchCount: 1}}, false, true);
> db.getLastErrorObj()

{ "n" : 0, "connectionId" : 1, "err" : null, "ok" : 1 }

> t.find()

{ "_id" : ObjectId("52a9e7a29013d3eba0228d38"), "locs" : [ [ 49.999, 49.999 ], [ 50, 50 ], [ 50.001, 50.001 ] ], "touchCount" : 1 }

In 2.5.4 the behavior is similar but the error is propagated back to the user:

> t.update({locs: {$near: [50.0, 50.0]}}, {$inc: {touchCount: 1}}, false, true);
Update WriteResult(

{ "errmsg" : "exception: BSONObj size: -286331154 (0xEEEEEEEE) is invalid. Size must be between 0 and 16793600(16MB) First element: locs: [ [ 49.999, 49.999 ], [ 50.0, 50.0 ], [ 50.001, 50.001 ] ]", "code" : 10334, "ok" : 0 }) > db.getLastErrorObj() { "err" : "BSONObj size: -286331154 (0xEEEEEEEE) is invalid. Size must be between 0 and 16793600(16MB) First element: locs: [ [ 49.999, 49.999 ], [ 50.0, 50.0 ], [ 50.001, 50.001 ] ]", "code" : 10334, "n" : 0, "connectionId" : 10, "ok" : 1 } > t.find() { "_id" : ObjectId("52a9e69d7710093746faf850"), "locs" : [ [ 49.999, 49.999 ], [ 50, 50 ], [ 50.001, 50.001 ] ], "touchCount" : 1 }