SERVER-14180 fix double free in access planning for $elemMatch

Author: dstorch

src/mongo/db/query/planner_access.cpp

@@ -737,16 +737,6 @@ namespace mongo {
 
                 scanState->tightness = IndexBoundsBuilder::INEXACT_FETCH;
                 mergeWithLeafNode(emChild, scanState);
-
-                if (scanState->tightness == IndexBoundsBuilder::INEXACT_COVERED
-                         && !indices[scanState->currentIndexNumber].multikey) {
-                    // Add the filter to the current index scan. This is optional because
-                    // the entire filter will get affixed to the parent AND. It is here
-                    // as an optimization---an additional filter during the index scan
-                    // stage will cause fewer documents to bubble up to the parent node
-                    // of the execution tree.
-                    addFilterToSolutionNode(scanState->currentScan.get(), emChild, root->matchType());
-                }
             }
             else {
                 if (NULL != scanState->currentScan.get()) {
@@ -762,16 +752,6 @@ namespace mongo {
                 scanState->currentScan.reset(makeLeafNode(query, indices[scanState->currentIndexNumber],
                                                           scanState->ixtag->pos,
                                                           emChild, &scanState->tightness));
-
-                if (scanState->tightness == IndexBoundsBuilder::INEXACT_COVERED
-                         && !indices[scanState->currentIndexNumber].multikey) {
-                    // Add the filter to the current index scan. This is optional because
-                    // the entire filter will get affixed to the parent AND. It is here
-                    // as an optimization---an additional filter during the index scan
-                    // stage will cause fewer documents to bubble up to the parent node
-                    // of the execution tree.
-                    addFilterToSolutionNode(scanState->currentScan.get(), emChild, root->matchType());
-                }
             }
         }
 

src/mongo/db/query/query_planner_test.cpp

@@ -1612,6 +1612,28 @@ namespace {
                                 "{ixscan: {filter: null, pattern: {'a.b': 1}}}}}");
     }
 
+    // SERVER-14180
+    TEST_F(QueryPlannerTest, ElemMatchEmbeddedRegexAnd) {
+        addIndex(BSON("a.b" << 1));
+        runQuery(fromjson("{a: {$elemMatch: {b: /foo/}}, z: 1}"));
+
+        assertNumSolutions(2U);
+        assertSolutionExists("{cscan: {dir: 1}}");
+        assertSolutionExists("{fetch: {filter: {a:{$elemMatch:{b:/foo/}}, z:1}, node: "
+                                "{ixscan: {filter: null, pattern: {'a.b': 1}}}}}");
+    }
+
+    // SERVER-14180
+    TEST_F(QueryPlannerTest, ElemMatchEmbeddedRegexAnd2) {
+        addIndex(BSON("a.b" << 1));
+        runQuery(fromjson("{a: {$elemMatch: {b: /foo/, b: 3}}, z: 1}"));
+
+        assertNumSolutions(2U);
+        assertSolutionExists("{cscan: {dir: 1}}");
+        assertSolutionExists("{fetch: {filter: {a:{$elemMatch:{b:/foo/,b:3}}, z:1}, node: "
+                                "{ixscan: {filter: null, pattern: {'a.b': 1}}}}}");
+    }
+
     // $not can appear as a value operator inside of an elemMatch (value).  We shouldn't crash if we
     // see it.
     TEST_F(QueryPlannerTest, ElemMatchWithNotInside) {