[SERVER-71387] Range-based window [+N, unbounded] can tassert Created: 15/Nov/22  Updated: 29/Oct/23  Resolved: 06/Jan/23

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 6.3.0-rc0, 6.0.7, 5.0.19

Type: Bug Priority: Major - P3
Reporter: David Percy Assignee: David Percy
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v6.2, v6.0, v5.0
Participants:
Linked BF Score: 0

 Description   

Background: In setWindowFields, you can use window: {range: [lower, upper]} to define a window in terms of the values in the collection.  We only support numbers and dates.  If setWindowFields finds a value with the wrong type, it uasserts.

However, our fuzzer found a case where it tasserts instead of uasserts.  If the range is [+N, unbounded], and the input has an unexpected type, we can tassert when computing the right endpoint for the 'unbounded' part.



 Comments   
Comment by Githook User [ 17/May/23 ]

Author:

{'name': 'David Percy', 'email': 'david.percy@mongodb.com', 'username': 'dpercy'}

Message: SERVER-71387 Add missing typecheck for range-based window
Branch: v6.0
https://github.com/mongodb/mongo/commit/39ecdcdda1ddeb59a2e96d1997551d669669ac8f

Comment by Githook User [ 17/May/23 ]

Author:

{'name': 'David Percy', 'email': 'david.percy@mongodb.com', 'username': 'dpercy'}

Message: SERVER-71387 Add missing typecheck for range-based window
Branch: v5.0
https://github.com/mongodb/mongo/commit/d34931161eb5ec47029f8c69d731ed9360f51b9a

Comment by Githook User [ 06/Jan/23 ]

Author:

{'name': 'David Percy', 'email': 'david.percy@mongodb.com', 'username': 'dpercy'}

Message: SERVER-71387 Add missing typecheck for range-based window
Branch: master
https://github.com/mongodb/mongo/commit/40baa93ce71492b71fe9ace2ccc3ea6fd441c158

Comment by David Percy [ 15/Nov/22 ]

coll = db.window_function_range_tassert;
coll.drop();
coll.insert([
    {a: 2},
    {a: 'xyz'},
]);
coll.aggregate([
    {$setWindowFields: {
        sortBy: {a: 1},
        output: {
            b: {$max: 5, window: {range: [+3, 'unbounded']}},
        },
    }},
]); 

Generated at Thu Feb 08 06:18:52 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.