-
Type:
Task
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
Query Integration
-
None
-
None
-
None
-
None
-
None
-
None
-
None
{{h2. Overview
Add normalization for regex pattern slash escaping in the aggregation fuzzer result comparison
logic to prevent false-positive failures caused by the SERVER-116052 bug fix.
Background
SERVER-116052 fixes a bug in the MozJS WASM engine's regex serialization. The old code used
RegExp.prototype.toString() to extract a regex pattern before writing it to BSON. Per the
ECMAScript spec, toString() calls EscapeRegExpPattern, which escapes any unescaped /
in the pattern to \/. This means a BSON regex with pattern hello/world would round-trip
as hello\/world — a different byte sequence, even though both patterns are semantically
identical (\/ is an IdentityEscape in ECMAScript regex syntax and matches the same strings
as /).
The fix in SERVER-116052 replaces the toString() call with JS::GetRegExpSource(), a
SpiderMonkey API that returns the raw pattern without any delimiter escaping. After the fix, the
same BSON regex correctly round-trips as hello/world.
This causes 27 agg_fuzzer failures in multiversion testing, where old mongod (with the bug) and
new mongod (with the fix) disagree on the BSON representation of regex fields returned by
$function and $accumulator expressions.
Scope of Work
Changes are in 10gen/jstestfuzz on branch calvin.nguyen/mozjs-regex-fix:
- src/fuzzers/agg/results_comparison_lib.ts — Two additions:
- In normalizeDoc(): strip unnecessary \/ escapes from RegExp.source before result
comparison, so both serializations of the same regex compare equal. - In compareDocsInternal(): add explicit instanceof RegExp handling that compares
source+flags after normalizing \/ → /, ensuring correct behaviour even when
bsonBinaryEqual does not handle native RegExp objects.
- In normalizeDoc(): strip unnecessary \/ escapes from RegExp.source before result
- src/fuzzers/agg/results_comparison_lib.spec.ts — 7 new test cases covering:
escaped-vs-unescaped slash equality, multiple slashes, same-pattern equality, genuinely
different patterns (must still be unequal), different flags (must still be unequal), and
normalization inside nested arrays and subdocuments.
Acceptance Criteria
- The 7 new spec tests pass with no regressions in the existing test suite.
- After this change is merged and the jstestfuzz SHA is bumped in the mongo repo (see linked
SERVER-116052ticket), the 27 agg_fuzzer Evergreen failures on theSERVER-116052branch
are resolved.
Technical Notes
- The \/ → / normalization is semantically safe: in ECMAScript regex patterns
constructed via new RegExp(string), \/ is an IdentityEscape — the backslash has no
effect and the regex matches identically to /. - Follows the same pattern as DEVPROD-31535 (Decimal128 normalization) and
SERVER-123514
(NaN string normalization). - A companion SHA-bump ticket in the SERVER project should link to this ticket.}}
- is related to
-
SERVER-116052 Add support for $function
-
- Closed
-
-
SERVER-123514 Normalize NaN string representations in aggregation multiversion fuzzer result comparison
-
- Closed
-
- related to
-
SERVER-125834 Remove trailing slashes from $function regex handling in query_tester-1
-
- Closed
-