From 2dd5f90b5d2ae403abbf895316f08262600df380 Mon Sep 17 00:00:00 2001
From: Eliot Horowitz <eliot@10gen.com>
Date: Mon, 1 Nov 2010 23:38:17 -0400
Subject: [PATCH] fix $inc overflow on int SERVER-2005

---
 db/update.cpp           | 17 +++++++++++++++--
 dbtests/updatetests.cpp |  2 +-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/db/update.cpp b/db/update.cpp
index 3cb0a368094df..70c85b6a47440 100644
--- a/db/update.cpp
+++ b/db/update.cpp
@@ -67,8 +67,16 @@ namespace mongo {
             ms.inclong = elt.numberLong() + in.numberLong();
         }
         else {
-            ms.incType = NumberInt;
-            ms.incint = elt.numberInt() + in.numberInt();
+            int x = elt.numberInt() + in.numberInt();
+            if ( x < 0 && elt.numberInt() > 0 && in.numberInt() > 0 ){
+                // overflow
+                ms.incType = NumberLong;
+                ms.inclong = elt.numberLong() + in.numberLong();
+            }
+            else {
+                ms.incType = NumberInt;
+                ms.incint = elt.numberInt() + in.numberInt();
+            }
         }
         
         ms.appendIncValue( bb , false );
@@ -398,6 +406,11 @@ namespace mongo {
                         // if i'm incrememnting with a double, then the storage has to be a double
                         mss->amIInPlacePossible( m.elt.type() != NumberDouble ); 
                     }
+                    
+                    // check for overflow
+                    if ( e.type() == NumberInt && e.numberLong() + m.elt.numberLong() > numeric_limits<int>::max() ){
+                        mss->amIInPlacePossible( false );
+                    }
                 }
                 break;
 
diff --git a/dbtests/updatetests.cpp b/dbtests/updatetests.cpp
index 9b59799a473cd..665bdc481ee5b 100644
--- a/dbtests/updatetests.cpp
+++ b/dbtests/updatetests.cpp
@@ -759,7 +759,7 @@ namespace UpdateTests {
                 while ( start < max ){
                     update( BSON( "$inc" << BSON( "x" << 500000 ) ) );
                     start += 500000;
-                    //ASSERT_EQUALS( start , findOne()["x"].numberLong() ); // SERVER-2005
+                    ASSERT_EQUALS( start , findOne()["x"].numberLong() ); // SERVER-2005
                 }
 
             }