-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Query Optimization
-
Fully Compatible
-
ALL
-
None
-
None
-
None
-
None
-
None
-
None
-
None
_dsToStageId intentionally retains entries after invalidate().
If stage A is assigned id=1, then the graph is rebuilt so that stage B takes id=1, the old entry _dsToStageId[A] = 1 is never removed. If stage A has since moved to a later position in the container (e.g. via a swap), truncateIfValid can find stage A there, read the stale id=1, and truncate the graph to 2 stages when it should have grown to 7.
The branch in truncateIfValid, we do not detect if the stage was swapped - instead was assume the stale id was correct and incorrectly truncate.
The fix is to guard the check in truncateIfValid with _stages[id].documentSource == lastStageIt. If the graph's record for that id points to a different stage, the entry is stale and truncateIfValid falls through to grow().
Caught by the jstests/core/query/collation_correctness_pbt.js PBT test when{internalQueryPermitTransformHoist is enabled.
This raises tassert 11937307 - Unknown DocumentSource.
- blocks
-
SERVER-105449 Pushdown of $match past a computed field
-
- In Code Review
-