In types.js there are a multiple helper functions added to Array that do not properly check that the array argument being passed to them is actually an array. This can lead to a stall in the shell if an object with property length set to a large number (or Infinity) is passed as an argument to one of these functions.
Affected functions:
- Array.contains
- Array.unique
- Array.shuffle
- Array.tojson
- Array.fetchRefs
- Array.sum
- Array.stdDev
This is causing issues in jstestfuzz.
- is related to
-
SERVER-31038 DBCollection.prototype.createIndexes can stall when given object with large "length" property
- Closed