Major - P3 The following test results in UB:
(function() {
pipeline = [{$project: {x: { $subtract: [new Date('2019-04-23T00:05:48.829Z'), Infinity] }}}];
db.adminCommand( { setParameter: 1, traceExceptions: true } )
try {
const res = db.c.aggregate(pipeline).toArray();
print("Result was " + tojson(res));
} catch(e) {
print("Error was " + tojson(e));
}
})();
The $subtract is performed with [<some date>, Infinity]. This causes this conversion to long long. This cast is UB when the truncated double is a value that can't fit in a long long (such as Infinity).
We may want to change the implementation of Value::coerceToLong() and audit existing calls to it in case there are similar bugs.