Use right allocator when performing queries over links

CHANGELOG.md

@@ -6,6 +6,7 @@
 ### Fixed
 * <How to hit and notice issue? what was the impact?> ([#????](https://github.com/realm/realm-core/issues/????), since v?.?.?)
 * Fixed property aliases not working in the parsed queries which use the `@links.Class.property` syntax. ([#4398](https://github.com/realm/realm-core/issues/4398), this never previously worked)
+* Fix "Invalid ref translation entry" assertion failure which could occur when querying over a link after creating objects in the destination table.
 
 ### Breaking changes
 * None.

src/realm/alloc.hpp

@@ -1,4 +1,4 @@
-/*************************************************************************
+/*************************************************************************
  *
  * Copyright 2016 Realm Inc.
  *
@@ -346,7 +346,7 @@ class WrappedAllocator : public Allocator {
         m_alloc = &underlying_allocator;
         m_baseline.store(m_alloc->m_baseline, std::memory_order_relaxed);
         m_debug_watch = 0;
-        m_ref_translation_ptr.store(m_alloc->m_ref_translation_ptr);
+        refresh_ref_translation();
     }
 
     void update_from_underlying_allocator(bool writable)
@@ -355,6 +355,11 @@ class WrappedAllocator : public Allocator {
         set_read_only(!writable);
     }
 
+    void refresh_ref_translation()
+    {
+        m_ref_translation_ptr.store(m_alloc->m_ref_translation_ptr);
+    }
+
 protected:
     void get_or_add_xover_mapping(RefTranslation& txl, size_t index, size_t offset, size_t size) override
     {

src/realm/query_expression.cpp

@@ -383,7 +383,7 @@ class DictionarySize : public Columns<Dictionary> {
     }
     void evaluate(size_t index, ValueBase& destination) override
     {
-        Allocator& alloc = this->get_base_table()->get_alloc();
+        Allocator& alloc = this->m_link_map.get_target_table()->get_alloc();
         Value<int64_t> list_refs;
         this->get_lists(index, list_refs, 1);
         destination.init(list_refs.m_from_link_list, list_refs.size());

src/realm/query_expression.hpp

@@ -2897,6 +2897,11 @@ class ColumnsCollection : public Subexpr2<T>, public ColumnListBase {
         return m_link_map.get_base_table();
     }
 
+    Allocator& get_alloc() const
+    {
+        return m_link_map.get_target_table()->get_alloc();
+    }
+
     void set_base_table(ConstTableRef table) final
     {
         m_link_map.set_base_table(table);
@@ -3022,7 +3027,7 @@ class ColumnsCollection : public Subexpr2<T>, public ColumnListBase {
     template <typename StorageType>
     void evaluate(size_t index, ValueBase& destination)
     {
-        Allocator& alloc = get_base_table()->get_alloc();
+        Allocator& alloc = get_alloc();
         Value<int64_t> list_refs;
         get_lists(index, list_refs, 1);
         const bool is_from_list = true;
@@ -3281,7 +3286,7 @@ class ColumnListSize : public ColumnsCollection<T> {
     template <typename StorageType>
     void evaluate(size_t index, ValueBase& destination)
     {
-        Allocator& alloc = this->get_base_table()->get_alloc();
+        Allocator& alloc = ColumnsCollection<T>::get_alloc();
         Value<int64_t> list_refs;
         this->get_lists(index, list_refs, 1);
         destination.init(list_refs.m_from_link_list, list_refs.size());
@@ -3314,7 +3319,7 @@ class ColumnListElementLength : public Subexpr2<Int> {
     }
     void evaluate(size_t index, ValueBase& destination) override
     {
-        Allocator& alloc = m_list.get_base_table()->get_alloc();
+        Allocator& alloc = m_list.get_alloc();
         Value<int64_t> list_refs;
         m_list.get_lists(index, list_refs, 1);
         std::vector<Int> sizes;
@@ -3435,7 +3440,7 @@ class ListColumnAggregate : public Subexpr2<decltype(Operation().result())> {
 
     void evaluate(size_t index, ValueBase& destination) override
     {
-        Allocator& alloc = get_base_table()->get_alloc();
+        Allocator& alloc = m_list.get_alloc();
         Value<int64_t> list_refs;
         m_list.get_lists(index, list_refs, 1);
         size_t sz = list_refs.size();

src/realm/table.hpp

@@ -643,6 +643,10 @@ class Table {
     {
         m_alloc.update_from_underlying_allocator(writable);
     }
+    void refresh_allocator_wrapper() const noexcept
+    {
+        m_alloc.refresh_ref_translation();
+    }
     Spec m_spec;                                    // 1st slot in m_top
     TableClusterTree m_clusters;                    // 3rd slot in m_top
     std::unique_ptr<TableClusterTree> m_tombstones; // 13th slot in m_top

test/test_query.cpp

@@ -5523,7 +5523,7 @@ TEST(Query_Performance)
     */
 }
 
-TEST(Query_AllocatorBug)
+TEST(Query_AllocatorBug_DestOlderThanSource)
 {
     // At some point this test failed when cluster node size was 4.
     Group g;
@@ -5562,6 +5562,50 @@ TEST(Query_AllocatorBug)
     CHECK_EQUAL(cnt, 421);
 }
 
+TEST(Query_AllocatorBug_SourceOlderThanDest)
+{
+    Group g;
+    auto foo = g.add_table("Foo");
+    auto bar = g.add_table("Bar");
+
+    auto col_double = foo->add_column_list(type_Double, "doubles");
+    auto col_link = bar->add_column(*foo, "links");
+    auto col_linklist = bar->add_column_list(*foo, "linklists");
+
+    for (int i = 0; i < 10000; i++)
+        foo->create_object();
+
+    // foo's WrappedAllocator now points to a translation table with 2 elements
+
+    auto it = foo->begin();
+    for (int i = 0; i < 1000; i++) {
+        auto obj = bar->create_object();
+        obj.set(col_link, it->get_key());
+        auto ll = obj.get_linklist(col_linklist);
+        for (size_t j = 0; j < 10; j++) {
+            ll.add(it->get_key());
+            ++it;
+        }
+    }
+
+    // bar's WrappedAllocator now points to a translation table with 3 elements
+
+    int i = 0;
+    for (auto& obj : *foo) {
+        obj.get_list<double>(col_double).add(double(i % 19));
+        ++i;
+    }
+
+    // foo's WrappedAllocator now points to a translation table with 6 elements
+
+    // If this query uses bar's allocator to access foo it'll perform an out-of-bounds read
+    // for any of the values in slabs 3-5
+    auto cnt = (bar->link(col_link).column<Lst<double>>(col_double) > 10).count();
+    CHECK_EQUAL(cnt, 421);
+    cnt = (bar->link(col_link).column<Lst<double>>(col_double).size() == 1).count();
+    cnt = (bar->link(col_link).column<Lst<double>>(col_double).min() == 1).count();
+}
+
 TEST(Query_StringNodeEqualBaseBug)
 {
     Group g;