SERVER-31894 Update system should not use mutablebson::Element operator[](StringData name) for arrays

3 files changed, 26 insertions, 2 deletions

diff --git a/src/mongo/bson/mutable/document.cpp b/src/mongo/bson/mutable/document.cpp
index d939bc90b9b..a0946b84f2e 100644
--- a/src/mongo/bson/mutable/document.cpp
+++ b/src/mongo/bson/mutable/document.cpp
@@ -1381,6 +1381,7 @@ Element Element::findNthChild(size_t n) const {
 Element Element::findFirstChildNamed(StringData name) const {
     invariant(ok());
     Document::Impl& impl = _doc->getImpl();
+    invariant(getType() != BSONType::Array);
     Element::RepIdx current = _repIdx;
     current = impl.resolveLeftChild(current);
     // TODO: Could DRY this loop with the identical logic in findElementNamed.
diff --git a/src/mongo/bson/mutable/element.h b/src/mongo/bson/mutable/element.h
index 270d990e1ac..de1d18f5169 100644
--- a/src/mongo/bson/mutable/element.h
+++ b/src/mongo/bson/mutable/element.h
@@ -210,8 +210,9 @@ public:
     inline Element operator[](size_t n) const;
 
     /** Returns the first child, if any, of this Element named 'name'. If no such Element
-     *  exists, a non-ok Element is returned. This is not a constant time operation. This
-     *  method is also available as operator[] taking a StringData for convenience.
+     *  exists, a non-ok Element is returned. This is not a constant time operation. It is illegal
+     *  to call this on an Array. This method is also available as operator[] taking a StringData
+     *  for convenience.
      */
     Element findFirstChildNamed(StringData name) const;
     inline Element operator[](StringData name) const;
diff --git a/src/mongo/bson/mutable/mutable_bson_test.cpp b/src/mongo/bson/mutable/mutable_bson_test.cpp
index c1369d31b38..8b832f13f6c 100644
--- a/src/mongo/bson/mutable/mutable_bson_test.cpp
+++ b/src/mongo/bson/mutable/mutable_bson_test.cpp
@@ -37,10 +37,12 @@
 #include "mongo/db/json.h"
 #include "mongo/db/query/collation/collator_interface_mock.h"
 #include "mongo/platform/decimal128.h"
+#include "mongo/unittest/death_test.h"
 #include "mongo/unittest/unittest.h"
 
 namespace {
 
+using namespace mongo;
 namespace mmb = mongo::mutablebson;
 
 TEST(TopologyBuilding, TopDownFromScratch) {
@@ -541,6 +543,26 @@ TEST(ArrayAPI, SimpleNumericArray) {
     ASSERT_FALSE(e1[1].ok());
 }
 
+DEATH_TEST(ArrayAPI,
+           FindFirstChildNamedOnDeserializedArray,
+           "Invariant failure getType() != BSONType::Array") {
+    mmb::Document doc;
+    auto array = doc.makeElementArray("a");
+    auto elem0 = doc.makeElementInt("", 0);
+    ASSERT_OK(array.pushBack(elem0));
+    array.findFirstChildNamed("0");
+}
+
+DEATH_TEST(ArrayAPI,
+           FindFirstChildNamedOnSerializedArray,
+           "Invariant failure getType() != BSONType::Array") {
+    auto obj = fromjson("{a: [0, 1]}");
+    mmb::Document doc(obj);
+    auto rootElem = doc.root();
+    auto array = rootElem.leftChild();
+    array.findFirstChildNamed("0");
+}
+
 TEST(Element, setters) {
     mmb::Document doc;