Pushing an object into a nested array makes mongoose crash

[mpsijm]

Do you want to request a feature or report a bug? Bug 🐛

What is the current behavior?
If the current behavior is a bug, please provide the steps to reproduce.
Pushing an object into a nested array (as introduced in #1361) makes mongoose crash. Standalone example:

var mongoose = require("mongoose");

var model = mongoose.model("TestModel", new mongoose.Schema({
	name: String,
	array: [[{key: String, value: Number}]]
}));

mongoose.connect("mongodb://localhost/test");

mongoose.connection.on("connected", async () => {
	await new model({name: "small", array: [[
		{key: "answer", value: 42}
	]]}).save();
	var doc = await model.findOne().exec();
	doc.array[0].push({key: "lucky", value: 7});
	process.exit(0);
});

This throws a TypeError:

(node:14137) UnhandledPromiseRejectionWarning: TypeError: Right-hand side of 'instanceof' is not callable
    at Array._cast (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/types/documentarray.js:101:15)
    at Array._mapCast (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/types/array.js:300:17)
    at Arguments.map (<anonymous>)
    at Array.push (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/types/array.js:314:25)
    at NativeConnection.mongoose.connection.on (/home/mpsijm/tmp/mongoose-test/index.js:17:15)
    at <anonymous>
    at process._tickCallback (internal/process/next_tick.js:182:7)

What is the expected behavior?
The document should be updated without throwing a TypeError.

Please mention your node.js, mongoose and MongoDB version.

$ grep mongoose package.json
    "mongoose": "^5.0.16"
$ node --version
v9.11.1
$ mongo --version
MongoDB shell version v3.6.4
git version: d0181a711f7e7f39e60b5aeb1dc7097bf6ae5856
OpenSSL version: OpenSSL 1.0.2g  1 Mar 2016
allocator: tcmalloc
modules: none
build environment:
    distmod: ubuntu1604
    distarch: x86_64
    target_arch: x86_64

[mpsijm]

Another way of updating the array does not work as expected either:

var mongoose = require("mongoose");

var model = mongoose.model("TestModel", new mongoose.Schema({
	name: String,
	array: [[{key: String, value: Number}]]
}));

mongoose.connect("mongodb://localhost/test");

mongoose.connection.on("connected", async () => {
	console.log("Mongoose connected");
	await new model({name: "small", array: [[
		{key: "answer", value: 42}
	]]}).save();
	var doc = await model.findOne().exec();
	doc.array = [[
		{key: "answer", value: 42},
		{key: "lucky", value: 7}
	]];
	await doc.save();
	process.exit(0);
});

This throws a ValidationError instead:

(node:16469) UnhandledPromiseRejectionWarning: ValidationError: TestModel validation failed: array: Cast to Array failed for value "[ [ { key: 'answer', value: 42 }, { key: 'lucky', value: 7 } ] ]" at path "array"
    at new ValidationError (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/error/validation.js:27:11)
    at model.Document.invalidate (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/document.js:1758:32)
    at model.$set (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/document.js:817:10)
    at model.set [as array] (/home/mpsijm/tmp/mongoose-test/node_modules/mongoose/lib/services/document/compile.js:129:26)
    at NativeConnection.mongoose.connection.on (/home/mpsijm/tmp/mongoose-test/index.js:19:12)
    at <anonymous>
    at process._tickCallback (internal/process/next_tick.js:182:7)

[vkarpov15]

Thanks for reporting, will investigate ASAP 👍