Realm-Swift crash in `Array::get_context_flag_from_header` after updating to iOS 26.2

[fizzlepuppy]

SDK and version

SDK : Realm Swift
Version: 10.54.6 (also occurs on 10.32.0)

Observations

• How frequent do the crash occur?
  Anytime I try and init a Realm database.

• Does it happen in production or during dev/test?
  Prod

• Can the crash be reproduced by you?
  Yes

• Can you provide instructions for how we can reproduce it?
  It seems like running on iOS 26.2 is when this started to show up.

Crash log / stacktrace

/Users/runner/work/realm-swift/realm-swift/core/src/realm/index_string.hpp:293: [realm-core-14.14.0] Assertion failed: Array::get_context_flag_from_header(alloc.translate(ref)) with (ref, size_t(alloc.translate(ref))) =  [1677384, 4511160392]
0   Realm                               0x00000001053f40ac _ZN5realm4utilL18terminate_internalERNSt3__118basic_stringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEE + 32
1   Realm                               0x00000001053f4024 _ZN5realm4util19terminate_with_infoEPKcS2_lS2_OSt16initializer_listINS0_9PrintableEE + 396
2   Realm                               0x00000001052bbf10 _ZN5realm11GroupWriter29move_free_in_file_to_size_mapERKNSt3__16vectorINS0_14FreeSpaceEntryENS1_9allocatorIS3_EEEERNS1_8multimapImmNS1_4lessImEENS4_INS1_4pairIKmmEEEEEE + 0
3   Realm                               0x00000001052c877c _ZN5realm11StringIndexC1EmPNS_11ArrayParentEmRKNS_13ClusterColumnERNS_9AllocatorE + 356
4   Realm                               0x00000001053b1a60 _ZN5realm5Table23refresh_index_accessorsEv + 508
5   Realm                               0x00000001052b4584 _ZN5realm5Group21create_table_accessorEm + 900
6   Realm                               0x00000001052b41a8 _ZN5realm5Group12do_get_tableEm + 120
7   Realm                               0x00000001053cf270 _ZN5realm11Transaction19upgrade_file_formatEi + 860
8   Realm                               0x0000000105294f68 _ZN5realm2DB19upgrade_file_formatEbiii + 280
9   Realm                               0x00000001052934f4 _ZN5realm2DB4openERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEERKNS_9DBOptionsE + 5200
10  Realm                               0x000000010529a358 _ZN5realm2DB6createENSt3__110unique_ptrINS_11ReplicationENS1_14default_deleteIS3_EEEERKNS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEERKNS_9DBOptionsE + 164
11  Realm                               0x00000001054ea8e4 _ZN5realm5_impl16RealmCoordinator7open_dbEv + 1012
12  Realm                               0x00000001054eb628 _ZN5realm5_impl16RealmCoordinator12do_get_realmEONS_11RealmConfigERNSt3__110shared_ptrINS_5RealmEEENS4_8optionalINS_9VersionIDEEERNS_4util17CheckedUniqueLockEb + 76
13  Realm                               0x00000001054eb544 _ZN5realm5_impl16RealmCoordinator9get_realmENS_11RealmConfigENSt3__18optionalINS_9VersionIDEEE + 484
14  Realm                               0x0000000105535094 _ZN5realm5Realm16get_shared_realmENS_11RealmConfigE + 120
15  Realm                               0x00000001051bb568 +[RLMRealm realmWithConfiguration:confinedTo:error:] + 952
16  Realm                               0x00000001051bb0ac +[RLMRealm realmWithConfiguration:queue:error:] + 156
17  RealmSwift                          0x000000010413fe48 $sSo8RLMRealmC13configuration5queueABSo0A13ConfigurationC_So012OS_dispatch_C0CSgtKcfCTO + 152
18  RealmSwift                          0x00000001041ed3d0 $s10RealmSwift0A0V13configuration5queueA2C13ConfigurationV_So012OS_dispatch_D0CSgtKcfC + 124
19  Crinkles.debug.dylib                0x00000001039ed7b0 $s8Crinkles13RealmProviderC5realm0B5Swift0B0VyF + 152
20  Crinkles.debug.dylib                0x000000010399f240 $s8Crinkles12VersionModelC07versionC033_C3780D180505F4AF68E859422EDF01B8LL3forACSgAC0B4TypeO_tFZ + 92
21  Crinkles.debug.dylib                0x000000010399f160 $s8Crinkles12VersionModelC7version3forSiSgAC0B4TypeO_tFZ + 48
22  Crinkles.debug.dylib                0x0000000103907a50 $s8Crinkles15ModelControllerC12brandVersionSiSgvg + 44
23  Crinkles.debug.dylib                0x0000000103907e68 $s8Crinkles15ModelControllerC10loadBrands33_99B6229989702B30755BD2CDC61F6CD4LL4fromSbSDySSypG_tKF + 368
24  Crinkles.debug.dylib                0x0000000103907bf4 $s8Crinkles15ModelControllerC15loadInitialDatayyFyyXEfU_ + 64
25  Crinkles.debug.dylib                0x0000000103908b1c $sIg_Ieg_TR + 20
26  Crinkles.debug.dylib                0x0000000103908b40 $sIeg_IyB_TR + 24
27  libdispatch.dylib                   0x0000000103571d6c _dispatch_client_callout + 16
28  libdispatch.dylib                   0x0000000103568e0c _dispatch_lane_barrier_sync_invoke_and_complete + 172
29  Crinkles.debug.dylib                0x0000000103907b48 $s8Crinkles15ModelControllerC15loadInitialDatayyF + 228
30  Crinkles.debug.dylib                0x00000001039eadfc $s8Crinkles15RootCoordinatorC9bootstrap16skippingDBUpdateySb_tF + 444
31  Crinkles.debug.dylib                0x0000000103957294 $s8Crinkles13SceneDelegateC5scene_13willConnectTo7optionsySo7UISceneC_So0I7SessionCSo0I17ConnectionOptionsCtF + 612
32  Crinkles.debug.dylib                0x0000000103957698 $s8Crinkles13SceneDelegateC5scene_13willConnectTo7optionsySo7UISceneC_So0I7SessionCSo0I17ConnectionOptionsCtFTo + 116
33  UIKitCore                           0x000000019875b428 15414C36-D442-3F06-96CD-791887BE07FC + 259112
34  UIKitCore                           0x00000001988632a0 15414C36-D442-3F06-96CD-791887BE07FC + 1340064
35  UIKitCore                           0x0000000198858d30 15414C36-D442-3F06-96CD-791887BE07FC + 1297712
36  UIKitCore                           0x0000000198863e58 15414C36-D442-3F06-96CD-791887BE07FC + 1343064
37  FrontBoardServices                  0x00000001b3f42734 5949593B-27F4-3693-9310-5754D69E08AE + 153396
38  FrontBoardServices                  0x00000001b3f3d8ac 5949593B-27F4-3693-9310-5754D69E08AE + 133292
39  FrontBoardServices                  0x00000001b3f424d8 5949593B-27F4-3693-9310-5754D69E08AE + 152792
40  FrontBoardServices                  0x00000001b3f41c0c 5949593B-27F4-3693-9310-5754D69E08AE + 150540
41  FrontBoardServices                  0x00000001b3f415b0 5949593B-27F4-3693-9310-5754D69E08AE + 148912
42  FrontBoardServices                  0x00000001b3f41928 5949593B-27F4-3693-9310-5754D69E08AE + 149800
43  FrontBoardServices                  0x00000001b3f41724 5949593B-27F4-3693-9310-5754D69E08AE + 149284
44  FrontBoardServices                  0x00000001b3f415b0 5949593B-27F4-3693-9310-5754D69E08AE + 148912
45  libdispatch.dylib                   0x0000000103571d6c _dispatch_client_callout + 16
46  libdispatch.dylib                   0x000000010355c4c0 _dispatch_block_invoke_direct + 296
47  BoardServices                       0x00000001ab5a4f84 3D4773ED-61BF-3159-9081-D0564508FE7A + 180100
48  BoardServices                       0x00000001ab5a4e00 3D4773ED-61BF-3159-9081-D0564508FE7A + 179712
49  CoreFoundation                      0x0000000192c4adec B8C4A762-0973-3240-B782-850DB2A1FBB3 + 654828
50  CoreFoundation                      0x0000000192c4ad60 B8C4A762-0973-3240-B782-850DB2A1FBB3 + 654688
51  CoreFoundation                      0x0000000192c100ac B8C4A762-0973-3240-B782-850DB2A1FBB3 + 413868
52  CoreFoundation                      0x0000000192bd9e30 B8C4A762-0973-3240-B782-850DB2A1FBB3 + 192048
53  CoreFoundation                      0x0000000192bd91dc B8C4A762-0973-3240-B782-850DB2A1FBB3 + 188892
54  GraphicsServices                    0x00000002394cb498 GSEventRunModal + 120
55  UIKitCore                           0x000000019883cd18 15414C36-D442-3F06-96CD-791887BE07FC + 1183000
56  UIKitCore                           0x00000001987a8068 UIApplicationMain + 332
57  Crinkles.debug.dylib                0x0000000103a01884 __debug_main_executable_dylib_entry_point + 64
58  dyld                                0x000000018fae4e3c 1D1E19AC-4807-39F1-80FB-D27A4C2C61C0 + 20028
!!! IMPORTANT: Please report this at https://github.com/realm/realm-core/issues/new/choose

Steps & Code to Reproduce

I can attach my database if that would be helpful.

[fizzlepuppy]

Here's a less nasty version of the stack:

#0	0x0000000243e760dc in __pthread_kill ()
#1	0x00000001f2c0a7dc in pthread_kill ()
#2	0x000000019e82ed78 in abort ()
#3	0x000000010795fe84 in please_report_this_issue_in_github_realm_realm_core_v_14_14_0 ()
#4	0x0000000107960238 in realm::util::terminate_internal ()
#5	0x0000000107960024 in realm::util::terminate_with_info ()
#6	0x0000000107827f10 in realm::util::terminate_with_info<unsigned long&, unsigned long> ()
#7	0x000000010783477c in realm::StringIndex::StringIndex ()
#8	0x000000010791da60 in realm::Table::refresh_index_accessors ()
#9	0x0000000107820584 in realm::Group::create_table_accessor ()
#10	0x00000001078201a8 in realm::Group::do_get_table ()
#11	0x000000010793b270 in realm::Transaction::upgrade_file_format ()
#12	0x0000000107800f68 in realm::DB::upgrade_file_format ()
#13	0x00000001077ff4f4 in realm::DB::open ()
#14	0x0000000107806358 in realm::DB::create ()
#15	0x0000000107a568e4 in realm::_impl::RealmCoordinator::open_db ()
#16	0x0000000107a57628 in realm::_impl::RealmCoordinator::do_get_realm ()
#17	0x0000000107a57544 in realm::_impl::RealmCoordinator::get_realm ()
#18	0x0000000107aa1094 in realm::Realm::get_shared_realm ()
#19	0x0000000107727568 in +[RLMRealm realmWithConfiguration:confinedTo:error:] at /Users/chance/Projects/padtrack/Pods/Realm/Realm/RLMRealm.mm:430
#20	0x00000001077270ac in +[RLMRealm realmWithConfiguration:queue:error:] at /Users/chance/Projects/padtrack/Pods/Realm/Realm/RLMRealm.mm:395
#21	0x00000001066abe48 in @nonobjc RLMRealm.__allocating_init(configuration:queue:) ()
#22	0x00000001067593d0 in Realm.init(configuration:queue:) at /Users/chance/Projects/padtrack/Pods/RealmSwift/RealmSwift/Realm.swift:95
#23	0x0000000105f597b0 in RealmProvider.realm() at /Users/chance/Projects/padtrack/Crinkles/Model/RealmProvider.swift:20
#24	0x0000000105f0b240 in static VersionModel.versionModel(for:) at /Users/chance/Projects/padtrack/Crinkles/Model/Realm/Version.swift:24
#25	0x0000000105f0b160 in static VersionModel.version(for:) at /Users/chance/Projects/padtrack/Crinkles/Model/Realm/Version.swift:20
#26	0x0000000105e73a50 in ModelController.brandVersion.getter at /Users/chance/Projects/padtrack/Crinkles/Model/ModelController.swift:49
#27	0x0000000105e73e68 in ModelController.loadBrands(from:) at /Users/chance/Projects/padtrack/Crinkles/Model/ModelController.swift:170
#28	0x0000000105e73bf4 in closure #1 in ModelController.loadInitialData() at /Users/chance/Projects/padtrack/Crinkles/Model/ModelController.swift:54
#29	0x0000000105e74b1c in thunk for @callee_guaranteed () -> () ()
#30	0x0000000105e74b40 in thunk for @escaping @callee_guaranteed () -> () ()
#31	0x0000000105b35d6c in _dispatch_client_callout ()
#32	0x0000000105b2ce0c in _dispatch_lane_barrier_sync_invoke_and_complete ()
#33	0x0000000105e73b48 in ModelController.loadInitialData() at /Users/chance/Projects/padtrack/Crinkles/Model/ModelController.swift:53
#34	0x0000000105f56dfc in RootCoordinator.bootstrap(skippingDBUpdate:) at /Users/chance/Projects/padtrack/Crinkles/RootView/RootCoordinator.swift:22
#35	0x0000000105ec3294 in SceneDelegate.scene(_:willConnectTo:options:) at /Users/chance/Projects/padtrack/Crinkles/SceneDelegate.swift:19
#36	0x0000000105ec3698 in @objc SceneDelegate.scene(_:willConnectTo:options:) ()
...

[fizzlepuppy]

RLMRealmConfiguration {
	fileURL = file:///var/mobile/Containers/Data/Application/BA2B0D7F-716B-4794-BBB4-9B942C7CE7E6/Documents/modelv2-1.padb;
	inMemoryIdentifier = (null);
	encryptionKey = (null);
	readOnly = 0;
	schemaVersion = 49;
	migrationBlock = <__NSMallocBlock__: 0x10c4b7e40>;
	deleteRealmIfMigrationNeeded = 0;
	shouldCompactOnLaunch = (null);
	dynamic = 0;
	customSchema = (null);
}

[fizzlepuppy]

modelv2-1.padb.zip

It looks like it's just this database file that can reproduce the crash on any device I use it on.