-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Minor - P4
-
None
-
Affects Version/s: None
-
Component/s: None
-
ALL
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
In src/mongo/db/update/modifier_node.h, the nested struct ModifierNode::ModifyResult has a default constructor ModifyResult() {} that does not initialize the member type (of type ModifyResult::Type, an enum class). The member has no default member initializer, unlike the adjacent member description, which is initialized to EmptyDescription{}{}. The parameterized constructor ModifyResult(Type type) initializes type correctly.
A default-constructed ModifyResult therefore holds an indeterminate value in type; reading it (e.g. comparing result.type == ...) before assignment is undefined behavior.
In the current tree the reachable code paths assign a real value before reading type: in ModifierNode::apply() (modifier_node.cpp) updateResult is overwritten by updateExistingElement() in both branches before use, and in PushNode::insertElementsWithPosition() (push_node.cpp) the if/else chain assigns result on every path. So the defect is currently latent rather than active. The fix is nonetheless straightforward and makes the type consistent with description.
Found by static analysis (Svace, UNINIT.CTOR): "Constructor may not initialize class members of 'mongo::ModifierNode::ModifyResult'. Following members aren't initialized: type."
Suggested fix: give type a default member initializer (e.g. Type type = Type::kNoOp;).