Fix rare VectorRecord crash opening rev-tree doc [CBL-7682] (#2398)

When copying the body of a revision from a RevTree-based doc,
VectorRecord creates `Doc`s on the `body` and `extra` so that all
Fleece operations will work.
Unfortunately there are some rare cases where the body of a `Rev`
isn't in `body` or `extra` but was copied out; this only happens
as a workaround for an old (2.0) bug where the Fleece data might be
at an odd address.
In those situations, the attempt to create a mutable copy of the
Dict failed because it can't be retained and its SharedKeys can't be
located.
Worked around this by detecting the situation, and when it occurs,
creating a Doc for the data.

Author: snej

LiteCore/RevTrees/VectorRecord.cc

@@ -216,9 +216,16 @@ namespace litecore {
             if ( rev == curRev ) {
                 nuRev = currentRevision();
             } else {
-                if ( rev->body() ) {
-                    auto props       = fleece::ValueFromData(rev->body(), kFLTrusted).asDict();
-                    nuProps          = props.mutableCopy(kFLDeepCopyImmutables);
+                if ( slice revBody = rev->body() ) {
+                    if ( extra.containsAddressRange(revBody) || body.containsAddressRange(revBody) ) {
+                        auto props = fleece::ValueFromData(revBody, kFLTrusted).asDict();
+                        nuProps    = props.mutableCopy(kFLDeepCopyImmutables);
+                    } else {
+                        // In rare cases `body` is not inside `extra`, thus not covered by `_extraDoc`,
+                        // so copy it into an alloc_slice and create a Doc on it: [CBL-7681]
+                        Doc revDoc(alloc_slice(revBody), kFLTrusted, sharedKeys());
+                        nuProps = revDoc.asDict().mutableCopy(kFLDeepCopyImmutables);
+                    }
                     nuRev.properties = nuProps;
                 }
                 nuRev.revID = rev->revID;