Strange crash when presenting modal UIViewController

Question

I've seen this crash report a few times. It is extremely random and rare, and I can't understand it. All I am doing is presenting a modal view controller using the following code

ComposeController *newcontrol = [[ComposeController alloc]initWithMode:1 withNIB:@"ComposeController"];
newcontrol.delegate = self;

UINavigationController  *holder = [[UINavigationController alloc] initWithRootViewController:newcontrol];
[self presentViewController:holder animated:YES completion:NULL];

Somehow this leads to this completely at random:

OS Version:      iPhone OS 6.1 (10B143)
Report Version:  104

Exception Type:  SIGSEGV
Exception Codes: SEGV_ACCERR at 0x9
Crashed Thread:  0

Thread 0 Crashed:
0   libobjc.A.dylib                     0x3b25c5d0 objc_msgSend + 16
1   CoreFoundation                      0x334ba73f -[__NSPlaceholderArray initWithObjects:count:] + 271
2   CoreFoundation                      0x334bae09 +[NSArray arrayWithObject:] + 45
3   UIKit                               0x353e80ab -[UIWindow _rotationViewControllers] + 51
4   UIKit                               0x353e7fe3 -[UIViewController viewControllerForRotation] + 91
5   UIKit                               0x353e7f39 -[UIViewController _visibleView] + 97
6   UIKit                               0x3546c05b -[UIWindowController transition:fromViewController:toViewController:target:didEndSelector:] + 2483
7   UIKit                               0x3546afab -[UIViewController presentViewController:withTransition:completion:] + 3399
8   MyApp                               0x00046e97 -[Inbox composeHit] (Inbox.m:207)

Answer 1

I have the same problem quite consistently. It seems to be caused by the fact that I am presenting a modal view controller from a popover, which is not well tested and triggers a bug in Apple's code. The bug is that UIKit keeps an unretained reference to my View Controller which has been already dismissed and deallocated, so at a later time that reference is hit. My workaround is either to avoid presenting modal VCs from a popover, or to retain all such VCs myself indefinitely (in a member variable or some such).

Below are the gory details.

Here is the code I used to trigger the problem.

-(void) handlePinchFromCell:(AMPSupportingPhotoCell*) cell
{
    UIViewController * vc = [[UIViewController alloc] init]; // UIViewController #0
    [self presentViewController:vc animated:YES completion:nil];
    [self performSelector:@selector(dismiss:) withObject:vc afterDelay:2];
}

-(void) dismiss:(UIViewController*)vc
{
    [self dismissViewControllerAnimated:YES completion:^(){NSLog(@"-------");}];
}

This code is a part of a UIViewController #1, that is inside a UIPopoverController, that is popped over from another UIViewController #2, which is itself a presented from yet another view UIViewController #3. The crash happens after popover is closed, controller #2 id dismissed.

If I enable Zombies, I get the same stack trace but with a message:

2013-03-13 20:04:24.681 Mercury[16698:19d03] handlePinchFromCell: a225710
2013-03-13 20:04:27.083 Mercury[16698:19d03] -------
2013-03-13 20:04:31.606 Mercury[16698:19d03] *** -[UIViewController retain]: message sent to deallocated instance 0xa225710

So, notice that the VC #0 got allocated, presented, dismissed 2 seconds later, deallocated, and yet there is still a dangling reference to it somewhere in the Apple's code. When popover is closed and VC#2 is dismissed, the whole thing comes crashing down trying to access the deallocated VC. I am fairly certain this is Apple's bug. I also guess it's related to presenting a VC from a popover, so if you stay away from that, or retain the VC yourself you should be fine.

Another stack trace for the same problem is this. It happens if the above code is run twice:

2013-03-13 20:12:53.883 Mercury[16735:19d03] handlePinchFromCell: 16d54da0
2013-03-13 20:12:56.285 Mercury[16735:19d03] -------
2013-03-13 20:13:03.481 Mercury[16735:19d03] handlePinchFromCell: a2565f0
2013-03-13 20:13:03.481 Mercury[16735:19d03] *** -[UIViewController isKindOfClass:]: message sent to deallocated instance 0x16d54da0
(lldb) bt
* thread #1: tid = 0x1f03, 0x017f8a97 CoreFoundation`___forwarding___ + 295, stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
    frame #0: 0x017f8a97 CoreFoundation`___forwarding___ + 295
    frame #1: 0x017f894e CoreFoundation`_CF_forwarding_prep_0 + 14
    frame #2: 0x00c42f90 UIKit`-[UIWindowController transition:fromViewController:toViewController:target:didEndSelector:] + 907
    frame #3: 0x00a40ee3 UIKit`-[UIViewController presentViewController:withTransition:completion:] + 4521
    frame #4: 0x00a41167 UIKit`-[UIViewController presentViewController:animated:completion:] + 112
    frame #5: 0x0006c32d Mercury`-[AMPSupportingPhotosViewController handlePinchFromCell:](self=0x16d55360, _cmd=0x0007a64a, cell=0x0a22a2a0) + 205 at AMPSupportingPhotosViewController.m:184
    frame #6: 0x015336b0 libobjc.A.dylib`-[NSObject performSelector:withObject:] + 70
    frame #7: 0x0006f317 Mercury`-[AMPSupportingPhotoCell handlePinch:](self=0x0a22a2a0, _cmd=0x00efb0db, sender=0x0a2504a0) + 215 at AMPSupportingPhotoCell.m:53
    frame #8: 0x00c2185a UIKit`_UIGestureRecognizerSendActions + 139