Fix use of wrong allocator when running query over links

CHANGELOG.md

@@ -5,7 +5,7 @@
 
 ### Fixed
 * <How to hit and notice issue? what was the impact?> ([#????](https://github.com/realm/realm-core/issues/????), since v?.?.?)
-* None.
+* When querying a table where links are part of the condition, the application may crash if objects has recently been added to the target table. ([#7118](https://github.com/realm/realm-java/issues/7118), since v6.0.0)
 
 ### Breaking changes
 * None.

src/realm/query_expression.hpp

@@ -1844,7 +1844,7 @@ class LinkMap {
 
     void set_cluster(const Cluster* cluster)
     {
-        Allocator& alloc = m_tables.back()->get_alloc();
+        Allocator& alloc = get_base_table()->get_alloc();
         m_array_ptr = nullptr;
         switch (m_link_types[0]) {
             case col_type_Link:

test/test_query.cpp

@@ -5188,4 +5188,43 @@ TEST(Query_Sort_And_Requery_Untyped_Monkey2)
     }
 }
 
+TEST(Query_AllocatorBug)
+{
+    // At some point this test failed when cluster node size was 4.
+    Group g;
+    auto foo = g.add_table("Foo");
+    auto bar = g.add_table("Bar");
+
+    auto col_double = foo->add_column(type_Double, "doubles");
+    auto col_int = foo->add_column(type_Int, "ints");
+    auto col_link = bar->add_column_link(type_Link, "links", *foo);
+    auto col_linklist = bar->add_column_link(type_LinkList, "linklists", *foo);
+
+    for (int i = 0; i < 10000; i++) {
+        auto obj = foo->create_object();
+        obj.set(col_double, double(i % 19));
+        obj.set(col_int, 30 - (i % 19));
+    }
+
+    // At this point the WrappedAllocator in "foo" points to a translation table with 6 elements
+
+    auto it = foo->begin();
+    for (int i = 0; i < 1000; i++) {
+        // During this a new slab is needed, so the translation table in "bar" contains 7 elements.
+        // Some clusters if "bar" will use this last element for translation
+        auto obj = bar->create_object();
+        obj.set(col_link, it->get_key());
+        auto ll = obj.get_linklist(col_linklist);
+        for (size_t j = 0; j < 10; j++) {
+            ll.add(it->get_key());
+            ++it;
+        }
+    }
+
+    // When traversion clusters in "bar" wee should use the "bar" wrapped allocator and not the
+    // one in "foo" (that was the error)
+    auto cnt = (bar->link(col_link).column<double>(col_double) > 10).count();
+    CHECK_EQUAL(cnt, 421);
+}
+
 #endif // TEST_QUERY