Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-61795

Incorrect Usage of Javascript Comparison to Compare Arrays and Objects

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 5.3.0
    • Affects Version/s: 5.1.0-rc3
    • Component/s: None
    • Fully Compatible
    • ALL
    • Hide

      You can run the test like this:

      activate && buildscripts/resmoke.py run --suites=aggregation --installDir=dist-test/bin --continueOnFailure --excludeWithAnyTags=requires_http_client --spawnUsing=python --jobs=4 --shuffle --storageEngineCacheSizeGB=1 jstests/aggregation/expressions/expression_trigonometric.js

      You can change the expected result of any test done with testOpApprox in this file and all tests still pass. For example, you can replace:

      testOpApprox({$acos: NumberDecimal(1)}, NumberDecimal(0));

      with:

      testOpApprox({$acos: NumberDecimal(1)}, NumberDecimal(100));

      and the test-suite passes.

      Show
      You can run the test like this: activate && buildscripts/resmoke.py run --suites=aggregation --installDir=dist-test/bin --continueOnFailure --excludeWithAnyTags=requires_http_client --spawnUsing=python --jobs=4 --shuffle --storageEngineCacheSizeGB=1 jstests/aggregation/expressions/expression_trigonometric.js You can change the expected result of any test done with  testOpApprox in this file and all tests still pass. For example, you can replace: testOpApprox({$acos: NumberDecimal(1)}, NumberDecimal(0)); with: testOpApprox({$acos: NumberDecimal(1)}, NumberDecimal(100)); and the test-suite passes.

      The tests in expression_trigonometric.js use assert.lt (in here) to compare the array of results returned from the aggregation pipeline with an array created in JavaScript. Then, the implementation of assert.lt (in here) uses the < JavaScript operator to perform the less-than comparison. As JavaScript does not provide operator overloading, to perform the comparison between arrays or objects, calls toString on them and compares the results. For objects, toString always returns "[object Object]" for JavaScript-created objects and "[object BSON]" for BSON objects (usually returned from an aggregation pipeline). Then, the comparison here always returns true irrespective of the values, as long as a value exists.

      This is just one instance and we should keep an eye for other tests that might suffer from the same incorrect usage of JavaScript comparison operators.

       

            Assignee:
            justin.seyster@mongodb.com Justin Seyster
            Reporter:
            mohammad.dashti@mongodb.com Mohammad Dashti (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: