Critical - P2 This affects both 3.4 and 3.6
Doing a query on arrays containing certain NumberDecimals can cause the following invariant failure.
2017-11-20T17:43:06.785-0500 F - [conn1] Invariant failure originalType == TypeBits::kDecimal && version != KeyString::Version::V0 src/mongo/db/storage/key_string.cpp 1383 frame #4: 0x00000001016ec11c mongod`mongo::invariantFailed(char const*, char const*, unsigned int) + 508 frame #5: 0x00000001012358ad mongod`mongo::(anonymous namespace)::adjustDecimalExponent(mongo::KeyString::TypeBits::Reader*, mongo::Decimal128) + 365 frame #6: 0x00000001012339de mongod`mongo::(anonymous namespace)::toBsonValue(unsigned char, mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilderValueStream*) + 3918 frame #7: 0x000000010123555d mongod`mongo::(anonymous namespace)::toBson(mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilder*) + 269 frame #8: 0x000000010123339b mongod`mongo::(anonymous namespace)::toBsonValue(unsigned char, mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilderValueStream*) + 2315 frame #9: 0x0000000101233224 mongod`mongo::(anonymous namespace)::toBsonValue(unsigned char, mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilderValueStream*) + 1940 frame #10: 0x000000010123555d mongod`mongo::(anonymous namespace)::toBson(mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilder*) + 269 frame #11: 0x000000010123339b mongod`mongo::(anonymous namespace)::toBsonValue(unsigned char, mongo::BufReader*, mongo::KeyString::TypeBits::Reader*, bool, mongo::KeyString::Version, mongo::BSONObjBuilderValueStream*) + 2315 frame #12: 0x0000000101232a12 mongod`mongo::KeyString::toBson(char const*, unsigned long, mongo::Ordering, mongo::KeyString::TypeBits const&) + 306 frame #13: 0x00000001010ea7fd mongod`mongo::(anonymous namespace)::WiredTigerIndexCursorBase::seek(mongo::BSONObj const&, bool, mongo::SortedDataInterface::Cursor::RequestedInfo) + 205 frame #14: 0x000000010065ce0e mongod`mongo::IndexScan::initIndexScan() + 446 frame #15: 0x000000010065cf91 mongod`mongo::IndexScan::doWork(unsigned long*) + 97 frame #16: 0x000000010066a95a mongod`mongo::PlanStage::work(unsigned long*) + 90 frame #17: 0x0000000100651574 mongod`mongo::FetchStage::doWork(unsigned long*) + 404 frame #18: 0x000000010066a95a mongod`mongo::PlanStage::work(unsigned long*) + 90 frame #19: 0x00000001004cb97b mongod`mongo::PlanExecutor::getNextImpl(mongo::Snapshotted<mongo::BSONObj>*, mongo::RecordId*) + 1147 frame #20: 0x00000001004cb457 mongod`mongo::PlanExecutor::getNext(mongo::BSONObj*, mongo::RecordId*) + 71 frame #21: 0x00000001001fce25 mongod`mongo::(anonymous namespace)::FindCmd::run(mongo::OperationContext*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, mongo::BSONObj const&, mongo::BSONObjBuilder&) + 2165 frame #22: 0x000000010126ba07 mongod`mongo::BasicCommand::enhancedRun(mongo::OperationContext*, mongo::OpMsgRequest const&, mongo::BSONObjBuilder&) + 119 frame #23: 0x0000000101269f00 mongod`mongo::Command::publicRun(mongo::OperationContext*, mongo::OpMsgRequest const&, mongo::BSONObjBuilder&) + 32 frame #24: 0x00000001001c28c9 mongod`mongo::(anonymous namespace)::execCommandDatabase(mongo::OperationContext*, mongo::Command*, mongo::OpMsgRequest const&, mongo::rpc::ReplyBuilderInterface*) + 5577 frame #25: 0x00000001001bbb64 mongod`mongo::ServiceEntryPointMongod::handleRequest(mongo::OperationContext*, mongo::Message const&) + 2324 frame #26: 0x00000001001cab69 mongod`mongo::ServiceStateMachine::_processMessage(mongo::ServiceStateMachine::ThreadGuard) + 377 frame #27: 0x00000001001ca480 mongod`mongo::ServiceStateMachine::_runNextInGuard(mongo::ServiceStateMachine::ThreadGuard) + 160 frame #28: 0x00000001001cc30c mongod`std::__1::__function::__func<mongo::ServiceStateMachine::_scheduleNextWithGuard(mongo::ServiceStateMachine::ThreadGuard, mongo::transport::ServiceExecutor::ScheduleFlags, mongo::ServiceStateMachine::Ownership)::$_3, std::__1::allocator<mongo::ServiceStateMachine::_scheduleNextWithGuard(mongo::ServiceStateMachine::ThreadGuard, mongo::transport::ServiceExecutor::ScheduleFlags, mongo::ServiceStateMachine::Ownership)::$_3>, void ()>::operator()() + 92 frame #29: 0x00000001012661a0 mongod`mongo::transport::ServiceExecutorSynchronous::schedule(std::__1::function<void ()>, mongo::transport::ServiceExecutor::ScheduleFlags) + 656 frame #30: 0x00000001001ca141 mongod`mongo::ServiceStateMachine::_scheduleNextWithGuard(mongo::ServiceStateMachine::ThreadGuard, mongo::transport::ServiceExecutor::ScheduleFlags, mongo::ServiceStateMachine::Ownership) + 177 frame #31: 0x00000001001c9830 mongod`mongo::ServiceStateMachine::_sourceCallback(mongo::Status) + 496 frame #32: 0x00000001001c92e5 mongod`mongo::ServiceStateMachine::_sourceMessage(mongo::ServiceStateMachine::ThreadGuard) + 197 frame #33: 0x00000001001ca44b mongod`mongo::ServiceStateMachine::_runNextInGuard(mongo::ServiceStateMachine::ThreadGuard) + 107 frame #34: 0x00000001001cc30c mongod`std::__1::__function::__func<mongo::ServiceStateMachine::_scheduleNextWithGuard(mongo::ServiceStateMachine::ThreadGuard, mongo::transport::ServiceExecutor::ScheduleFlags, mongo::ServiceStateMachine::Ownership)::$_3, std::__1::allocator<mongo::ServiceStateMachine::_scheduleNextWithGuard(mongo::ServiceStateMachine::ThreadGuard, mongo::transport::ServiceExecutor::ScheduleFlags, mongo::ServiceStateMachine::Ownership)::$_3>, void ()>::operator()() + 92 frame #35: 0x0000000101266d7f mongod`std::__1::__function::__func<mongo::transport::ServiceExecutorSynchronous::schedule(std::__1::function<void ()>, mongo::transport::ServiceExecutor::ScheduleFlags)::$_0, std::__1::allocator<mongo::transport::ServiceExecutorSynchronous::schedule(std::__1::function<void ()>, mongo::transport::ServiceExecutor::ScheduleFlags)::$_0>, void ()>::operator()() + 671
Note that it doesn't always hit the same invariant every time. A number of Decimal128 related invariants in key_string.cpp have been hit, which seems to indicate that the key string being converted is not actually a Decimal128.