Crash under RLMObjectBase::valueForUndefinedKey

[gilroykilroy]

Goals

My test code is crashing in 4.x where it did not in 3.21

Expected Results

No crashes

Actual Results

Crashed with EXC_BAD_ACCESS

Code Sample

The test code looks like:

    expect(ImageObject.unreferencedPredicate().evaluate(with: image)).to(beFalse())

It gets to the RLMCoerceToNil(object_getIvar(self, ivar)) line in valueForUndefinedKey and then crashes before calling RLMCoerceToNil.

(lldb) po self
ImageObject
id: 78BCC9EC-C525-4000-85B2-304438B63993
ckSystemFields: nil
imageDataFileName: nil
privateStuff: LinkingObjects <0x7f95f7844e20> (

)
addressesForMap: LinkingObjects <0x7f95f7845a50> (
[0] AddressObject {
id = 6D667959-D535-4E19-A0E7-B1E37CAF32A8;
ckSystemFields = <(null) — 0 total bytes>;
addressString = (null);
flags = 0;
keywords = (null);
mapImage = ImageObject {
id = 78BCC9EC-C525-4000-85B2-304438B63993;
ckSystemFields = <(null) — 0 total bytes>;
imageDataFileName = (null);
serverModDate = (null);
};
name = Home;
serverModDate = (null);
latitude = 36.988726;
longitude = -121.576159;
placemarkData = <62706c69 73743030 d4010203 0405063a 3b582476 65727369 — 1122 total bytes>;
}
))
privateStuffForMap: LinkingObjects <0x7f95f78475c0> (

)
publicStuffForMap: LinkingObjects <0x7f95f78481f0> (

)
serverModDate: nil

(lldb) po key
addressesForMap

(lldb) po ivar
0x000000012cff6488

The crash stack looks like:

Thread 1 Queue : com.apple.main-thread (serial)
#0 0x000000010d7ca927 in objc_retain ()
#1 0x00000001273069e9 in ::-[RLMObjectBase valueForUndefinedKey:](NSString *) at //Realm/RLMObjectBase.mm:184
#2 0x000000010d08229f in -[NSObject(NSKeyValueCoding) valueForKey:] ()
#3 0x00000001273068c1 in ::-[RLMObjectBase valueForKey:](NSString *) at /[Path]/SourcePackages/checkouts/realm-cocoa/Realm/RLMObjectBase.mm:178
#4 0x000000010d082c4c in -[NSObject(NSKeyValueCoding) valueForKeyPath:] ()
#5 0x000000010d16e28a in -[NSFunctionExpression expressionValueWithObject:context:] ()
#6 0x000000010d16523b in -[NSComparisonPredicate evaluateWithObject:substitutionVariables:] ()
#7 0x000000010d17be31 in -[NSCompoundPredicateOperator evaluatePredicates:withObject:substitutionVariables:] ()
#8 0x000000010d16665b in -[NSCompoundPredicate evaluateWithObject:substitutionVariables:] ()
#9 0x000000012563c914 in implicit closure #2 in AddressObjectTests.testAboutToDeleteCascadeImages() ()
#10 0x000000012563c990 in partial apply for implicit closure #2 in AddressObjectTests.testAboutToDeleteCascadeImages() ()
#11 0x0000000125637fa3 in thunk for @escaping @callee_guaranteed () -> (@unowned Bool?, @error @owned Error) ()
#12 0x000000012563c9e4 in thunk for @escaping @callee_guaranteed () -> (@unowned Bool?, @error @owned Error)partial apply ()
#13 0x000000012a8366ca in closure #1 in memoizedClosure(:) at //Nimble/Expression.swift:9
#14 0x000000012a8370d9 in partial apply for closure #1 in memoizedClosure(:) ()
#15 0x000000012a8101d8 in specialized Expression.evaluate() [inlined] at //Nimble/Expression.swift:90
#16 0x000000012a8101ba in specialized closure #1 in equal(:) at //Nimble/Matchers/Equal.swift:9
#17 0x000000012a8000cc in closure #1 in equal(:)specialized partial apply ()
#18 0x000000012a83a6c3 in specialized closure #1 in static Predicate.define(:matcher:) at /[Path/Nimble/Matchers/Predicate.swift:50
#19 0x000000012a7fff79 in partial apply for specialized ()
#20 0x000000012a7fff30 in partial apply for specialized ()
#21 0x000000012a8002d9 in closure #1 in static Predicate.define(:matcher:)specialized partial apply ()
#22 0x000000012a83b023 in specialized closure #1 in Predicate.after(f:) at //Nimble/Matchers/Predicate.swift:33
#23 0x000000012a83db69 in specialized closure #1 in Predicate.after(f:) ()
#24 0x000000012a7fff79 in partial apply for specialized ()
#25 0x000000012a7fff50 in partial apply for specialized ()
#26 0x000000012a8002e9 in closure #1 in Predicate.after(f:)specialized partial apply ()
#27 0x000000012a80001b in specialized Predicate.satisfies(_:) [inlined] at /[Path/Nimble/Matchers/Predicate.swift:33

Under 3.21 it does go into the RLMCoerceToNil method which returns obj.

Version of Realm and Tooling

Realm framework version: 4.1.1

Realm Object Server version: NA

Xcode version: 11

iOS/OSX version: 13.2

Dependency manager + version: SPM in XCode 11

[bmunkholm]

@gilroykilroy Could you please make a self contained minimal repro project?

[gilroykilroy]

Sure.
RealmBug.zip

[gilroykilroy]

FYI: Still broken in 5.0.0-beta.1

P.S. Choose Nimble 8.0.2 for above project to compile due to https://gitmemory.com/issue/Quick/Nimble/696/533520881

[tgoyne]

I think this may be the same bug as #5598, but a more severe consequence of it.

[gilroykilroy]

My test code above is now crashing with:

-[RealmBugTests.RealmBugTests testAboutToDeleteCascadeImages] : failed: caught "NSUnknownKeyException", "[<__SwiftValue 0x7ff410216200> valueForUndefinedKey:]: this class is not key value coding-compliant for the key @count."

The predicate uses @count. Is this no longer supported?