Crash when observing a Realm and deleting objects related to Dictionary

[leemaguire]

SDK and version

SDK : Cocoa
Branch: py/dictionary

Observations

• The crash happens when we query a dictionary property on an object, find all the objects related to that query, and then delete each object. All of the prior is happening while we are observing a Realm instance.

Crash log / stacktrace

Realm notification listener (9)#0	0x0000000114561533 in realm::ClusterNode::get(realm::ObjKey, realm::ClusterNode::State&) const at /Users/lee.maguire/Projects/realm-core/src/realm/cluster.cpp:62
#1	0x00000001145fb83c in realm::ClusterTree::get(realm::ObjKey) const at /Users/lee.maguire/Projects/realm-core/src/realm/cluster_tree.cpp:898
#2	0x00000001144cc61c in realm::TableClusterTree::get(realm::ObjKey) const at /Users/lee.maguire/Projects/realm-core/src/realm/table_cluster_tree.hpp:38
#3	0x0000000114988d57 in realm::Obj::update() const at /Users/lee.maguire/Projects/realm-core/src/realm/obj.cpp:176
#4	0x0000000114989dac in long long realm::Obj::_get<long long>(realm::ColKey::Idx) const at /Users/lee.maguire/Projects/realm-core/src/realm/obj.cpp:260
#5	0x0000000114692d2b in realm::Dictionary::init_from_parent() const at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.cpp:695
#6	0x0000000114693611 in realm::Dictionary::operator=(realm::Dictionary const&) at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.cpp:185
#7	0x00000001146b47a2 in realm::Dictionary::Dictionary(realm::Dictionary const&) at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.hpp:45
#8	0x00000001146a708d in realm::Dictionary::Dictionary(realm::Dictionary const&) at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.hpp:44
#9	0x00000001146a6e22 in realm::DictionaryLinkValues::DictionaryLinkValues(realm::Dictionary const&) at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.cpp:822
#10	0x00000001146a731d in realm::DictionaryLinkValues::DictionaryLinkValues(realm::Dictionary const&) at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.cpp:823
#11	0x00000001146b579f in std::__1::__unique_if<realm::DictionaryLinkValues>::__unique_single std::__1::make_unique<realm::DictionaryLinkValues, realm::Dictionary const&>(realm::Dictionary const&) at /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/c++/v1/memory:2755
#12	0x00000001146aaeac in realm::DictionaryLinkValues::clone_obj_list() const at /Users/lee.maguire/Projects/realm-core/src/realm/dictionary.hpp:263
#13	0x00000001146ab03d in non-virtual thunk to realm::DictionaryLinkValues::clone_obj_list() const ()
#14	0x0000000114a42c6c in realm::Query::Query(realm::Query const&) at /Users/lee.maguire/Projects/realm-core/src/realm/query.cpp:128
#15	0x0000000114a4328d in realm::Query::Query(realm::Query const&) at /Users/lee.maguire/Projects/realm-core/src/realm/query.cpp:119
#16	0x0000000114abddc8 in realm::ConstTableView::ConstTableView(realm::ConstTableRef, realm::Query&, unsigned long, unsigned long, unsigned long) at /Users/lee.maguire/Projects/realm-core/src/realm/table_view.hpp:535
#17	0x0000000114abd981 in realm::TableView::TableView(realm::TableRef, realm::Query&, unsigned long, unsigned long, unsigned long) at /Users/lee.maguire/Projects/realm-core/src/realm/table_view.hpp:720
#18	0x0000000114a89b39 in realm::TableView::TableView(realm::TableRef, realm::Query&, unsigned long, unsigned long, unsigned long) at /Users/lee.maguire/Projects/realm-core/src/realm/table_view.hpp:721
#19	0x0000000114a89711 in realm::Query::find_all(unsigned long, unsigned long, unsigned long) at /Users/lee.maguire/Projects/realm-core/src/realm/query.cpp:1566
#20	0x000000011375fa78 in realm::_impl::ResultsNotifier::run() at /Users/lee.maguire/Projects/realm-core/src/realm/object-store/impl/results_notifier.cpp:175
#21	0x00000001136d936a in realm::_impl::RealmCoordinator::run_async_notifiers() at /Users/lee.maguire/Projects/realm-core/src/realm/object-store/impl/realm_coordinator.cpp:1076
#22	0x00000001136d6035 in realm::_impl::RealmCoordinator::on_change() at /Users/lee.maguire/Projects/realm-core/src/realm/object-store/impl/realm_coordinator.cpp:822
#23	0x0000000113599847 in realm::_impl::ExternalCommitHelper::listen() at /Users/lee.maguire/Projects/realm-core/src/realm/object-store/impl/apple/external_commit_helper.cpp:236
#24	0x00000001135a580b in realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0::operator()() const at /Users/lee.maguire/Projects/realm-core/src/realm/object-store/impl/apple/external_commit_helper.cpp:174
#25	0x00000001135a576d in decltype(std::__1::forward<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0>(fp)()) std::__1::__invoke<realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0>(realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0&&) at /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/c++/v1/type_traits:3747
#26	0x00000001135a56d5 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0>(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0>&, std::__1::__tuple_indices<>) at /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/c++/v1/thread:280
#27	0x00000001135a475f in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, realm::_impl::ExternalCommitHelper::ExternalCommitHelper(realm::_impl::RealmCoordinator&)::$_0> >(void*) at /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/c++/v1/thread:291
#28	0x00007fff2033c950 in _pthread_start ()
#29	0x00007fff2033847b in thread_start ()

Steps & Code to Reproduce

• Clone Cocoa and switch to branch py/dictionary
• Open project via Package.swift for easier core debugging.
• Navigation to NotificationTests.mm
• Go to fixme_testDeleteDictionary and remove the fixme_ prefix.
• Run testDeleteDictionary
• You should get a crash with the exception KeyNotFound

[ironage]

can you try your test against this experimental branch https://github.com/realm/realm-core/tree/js/nullify-dict

[leemaguire]

@ironage That also results in the process terminating, only this time it terminates without throwing an exception

[jedelbo]

@ironage I created #4715 with a more appropriate fix than the one I pushed on your branch. I assigned this issue to you as you are our Mac owner. Please notify me if you think I can help.

[leemaguire]

@jedelbo I have also tried #4715 with no luck. I will try pin down where the failure is happening

[leemaguire]

void ConstTableRef::check() const
{
    if (m_table == nullptr) {
        throw InvalidTableRef("null"); <- exception caught here
    }
    if (m_table->get_instance_version() != m_instance_version) {
        // we cannot distinguish between removal of a table and expiration of the
        // tableref due to other changes. In the latter cases, we'd like to throw
        // a logic error: detached accessor. But in the former case, a user REALLY
        // would expect a NoSuchTable. So we choose that:
        throw InvalidTableRef(m_table->get_state());
    }
}

in table_ref.cpp is where the problem is happening

[jedelbo]

@leemaguire can you try #4715 again?

[jedelbo]

#4715 fixed this