This issue affects the following usages of the mapReduce command:

• {out: {replace: <collectionName>}}
• {out: {reduce: <collectionName>}} when <collectionName> doesn't exist or is empty
• {out: {merge: <collectionName>}} when <collectionName> doesn't exist or is empty

The map/reduce code checks that the value emit()-ted is less than BSONObjMaxUserSize / 2 here and here. The code doesn't check that the value returned by the reduce() and finalize() functions won't lead to inserting a document larger than BSONObjMaxUserSize into the temporary collection, except incidentally when Helpers::upsert() is used.

Original description

The code obliquely checks BSONObjMaxUserSize in a few places, but it's unclear whether it could eventually end up calling insertDocument() after reduce, with a document that's too big.