See BF-30665 for full reproducible bug. Consider this parsed query:

{ $or: [ { a: { $not: { $exists: true } } }, { a: { $not: { $_internalSchemaType: [ 4 ] } } }, { a: { $_internalSchemaAllElemMatchFromIndex: [ 0, { $or: [ { i: { $regex: "a+b" } }, { i: { $not: { $_internalSchemaType: [ 2 ] } } } ] } ] } } ] } 

The call to QueryPlannerIXSelect::rateIndices does not set any "RelevantTag"s on any parts of the query other than "{ a: { $not: { $exists: true }} }". When _rateIndices reaches the node that represents the sub-query 

 { a: { $_internalSchemaAllElemMatchFromIndex: [ 0, { $or: [ { i: { $regex: "a+b" } }, { i: { $not: { $_internalSchemaType: [ 2 ] } } } ] } ] } } 

it does not recurse any farther since the call to "Indexability::isBoundsGenerating" returns false and the node is not a logical node.

However, once we reach "stripInvalidAssignmentsTo2dsphereIndices", it does recurse into the above sub-query. When it reaches the leaf node for

{ i: { $regex: "a+b" } 

it tries to strip the RelevantTag, but that tag was never set.  That causes a server crash here.