isSargableLeaf() in cardinality_estimator.cpp incorrectly includes INTERNAL_BUCKET_GEO_WITHIN in its list of sargable expression types. This causes estimateConjWithHistogram() to be called with a $_internalBucketGeoWithin expression, which then calls IndexBoundsBuilder::translateAndIntersect() against a fake INDEX_BTREE index entry. translateAndIntersect is not designed to handle geo expressions against a BTREE index and hits MONGO_UNREACHABLE_TASSERT(5837103) in expression_geo_index_mapping.cpp.

Trigger conditions:

The tassert is hit when all of the following are true:

1. CBR is enabled in kAutomaticCE or kHistogramCE mode
2. A query on a timeseries collection combines a $geoWithin predicate with a second predicate that has an applicable BTREE index (e.g. a metaField equality)
3. The planner generates ≥2 candidate plans — causing CBR to run (the single-plan short-circuit at cbr_plan_ranking.cpp:101 does not apply)

Under these conditions, the BTREE-indexed plan's FetchNode filter is the standalone $_internalBucketGeoWithin expression (the geo predicate left over after the BTREE index covers the other predicate). CBR attempts histogram estimation on it and crashes.

Root cause:

$_internalBucketGeoWithin is a timeseries-internal bucket-level expression. It is not a comparison expression and cannot be translated to index bounds against a BTREE index. It should not appear in isSargableLeaf.

This bug can be reproduced by the js test attached to the ticket