Memory management in local variable objective-c

Question

In one interview i was asked to implement NSArray's exchangeObjectAtIndex:withObjectAtIndex: method. I wrote the following code:

- (void)exchangeObjectAtIndex:(NSUInteger)index1 withObjectAtIndex:(NSUInteger)index2 {
  id tmp = [self objectAtIndex:index1];
  [self replaceObjectAtIndex:index1 withObject:[self objectAtIndex:index2]];
  [self replaceObjectAtIndex:index2 withObject:tmp];
}

Interviewer said here's a memory management problem in first line and I'm going to catch bad_access_exc. He recommended to write as this:

- (void)exchangeObjectAtIndex:(NSUInteger)index1 withObjectAtIndex:(NSUInteger)index2 {
    id tmp = [[[self objectAtIndex:index1] retain] autorelease];
    [self replaceObjectAtIndex:index1  withObject:[self objectAtIndex:index2]];
    [self replaceObjectAtIndex:index2 withObject:tmp];
}

I understand that his code is right, but since tmp is local variable and it's going to be assigned, so there's no releasing and everything is gonna be ok. Is there any error?

Answer 1

If you are using manual memory management, there is an error. Apple has documented the problem under “Avoid Causing Deallocation of Objects You’re Using” in the Advanced Memory Management Programming Guide.

Specifically, objectAtIndex: doesn't retain and autorelease the object that it returns to you. So the NSArray might have the only “owning” reference to the object. Assigning to tmp under manual retain counting (MRC) doesn't retain the object so tmp doesn't own it and the autorelease pool doesn't own it.

This means that when line 2 of your method sends [self replaceObjectAtIndex:index1 withObject:[self objectAtIndex:index2]], the array might release the last reference to the object, deallocating it. At that point, tmp refers to a deallocated object; this is called a “dangling reference”.

Then in line 3, you try to put the dangling reference in the array. The array will send retain to the reference, which is invalid, and you will crash or experience heap corruption.

Under ARC, assigning to tmp does retain the object, so there is no error in that case.

Answer 2

Remember that id tmp is nothing more than a pointer to the object in your array. It doesn't say anything about the memory management of the object it's pointing to.

...it's going to be assigned, so there's no releasing...

This is the sticking point here. You can't guarantee that the object at index1 won't be deallocated when you replace it with the object at index2. In fact, the array will call release on it at this point to balance out the retain it called on the object when it was originally added to the array. Thus, it's possible that when the object at index1 is replaced will the object at index2, the reference count of the object at index1 will go to zero, the object will be deallocated, and your tmp variable will turn into a dangling pointer. The ... retain] autorelease] dance keeps the object around long enough to do the swap without having to worry about it deallocating before the end of the method (likely it will stick around until the top of the next run loop).