Strange crashes with message "Attempted to dereference garbage pointer"

Question

My app is ARC abide app but still I see multiple crashes with message "Attempted to de-reference garbage pointer" in the crash report. They are hard to diagnose.

My question is why application is crashing because of memory issues even after we are on ARC and we are not able to reproduce it with same steps. How to tackle such crashes?

One such crash report is as below:

CrashReporterKey: 896d0c8676c0e02eb292865a654825359de4d427 HardwareModel: iPod4,1 Version: 5510 (3.0.0) OSVersion: iPhone OS 6.1.3 (10B329) Date/Time: 2013-08-15 09:50:51.000 -0700 FirmwareVersion: 2.27.0 Report Version: 104

Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x31fd4078 Crashed Thread: 0

Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 libobjc.A.dylib 0x3b1ac5b0 objc_msgSend + 16 1 UIKit 0x3533c350 0x35338000 + 17232 2 UIKit 0x3533b6c8 0x35338000 + 14024 3
UIKit 0x3533b118 0x35338000 + 12568 4
GraphicsServices 0x3702d5a0 0x37027000 + 26016 5
GraphicsServices 0x3702d1d0 0x37027000 + 25040 6
CoreFoundation 0x33508170 0x33471000 + 618864 7
CoreFoundation 0x33508110 0x33471000 + 618768 8
CoreFoundation 0x33506f98 0x33471000 + 614296 9
CoreFoundation 0x33479eb8 CFRunLoopRunSpecific + 352 10 CoreFoundation 0x33479d48 CFRunLoopRunInMode + 104 11 GraphicsServices 0x3702c2e8 GSEventRunModal + 72 12 UIKit 0x3538f300 UIApplicationMain + 1120 13 MyApp 0x000a8e58 main + 20

Thread 1 name: Dispatch queue: com.apple.libdispatch-manager Thread 1: 0 libsystem_kernel.dylib 0x3b69f648 kevent64 + 24 1
libdispatch.dylib 0x3b5cadf8 0x3b5c7000 + 15864

Thread 2 name: WebThread Thread 2: 0 WebCore
0x39503560 0x3945d000 + 681312 1 WebCore
0x394e7f90 0x3945d000 + 569232 2 WebCore
0x394e2788 0x3945d000 + 546696 3 WebCore
0x396ca8a8 _ZN7WebCore11FrameLoader16detachFromParentEv + 64 4
WebKit 0x39e12618 0x39d8d000 + 546328 5
WebCore 0x394699c8 0x3945d000 + 51656 6
WebKit 0x39e12490 0x39d8d000 + 545936 7
WebKit 0x39e18570 0x39d8d000 + 570736 8
WebKit 0x39e184a8 0x39d8d000 + 570536 9
WebCore 0x394fb850 0x3945d000 + 649296 10 CoreFoundation 0x33508680 0x33471000 + 620160 11 CoreFoundation 0x33507ee8 0x33471000 + 618216 12 CoreFoundation 0x33506cb0 0x33471000 + 613552 13 CoreFoundation 0x33479eb8 CFRunLoopRunSpecific + 352 14 CoreFoundation 0x33479d48 CFRunLoopRunInMode + 104 15 WebCore 0x39467500 0x3945d000 + 42240 16 libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 3 name: CommRunLoop Thread Thread 3: 0
libsystem_kernel.dylib 0x3b6af6a4 __semwait_signal + 24 1
Foundation 0x33decc60 0x33d99000 + 343136 2
MyApp 0x002be680 -[CommRunLoop runLoopThread:] + 504 3 Foundation 0x33e49e80 0x33d99000 + 724608 4 libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 4 name: com.apple.CFSocket.private Thread 4: 0
libsystem_kernel.dylib 0x3b6af594 select$DARWIN_EXTSN + 20 1 libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 5: 0 libsystem_kernel.dylib 0x3b6af6a4 __semwait_signal + 24 1 Foundation 0x33decc60 0x33d99000 + 343136 2 MyApp 0x00333580 -[KSCrashDeadlockMonitor runMonitor] + 244 3 Foundation 0x33e49e80 0x33d99000 + 724608 4 libsystem_c.dylib
0x3b608310 0x3b5f7000 + 70416

Thread 6 name: KSCrash Exception Handler (Secondary) Thread 6: 0
libsystem_kernel.dylib 0x3b69eeb4 mach_msg_trap + 20 1
MyApp 0x0032f710 ksmachexc_i_handleExceptions + 124 2 libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 7 name: KSCrash Exception Handler (Primary) Thread 7:

Thread 8 name: com.apple.NSURLConnectionLoader Thread 8: 0
libsystem_kernel.dylib 0x3b69eeb4 mach_msg_trap + 20 1
CoreFoundation 0x33508040 0x33471000 + 618560 2
CoreFoundation 0x33506da0 0x33471000 + 613792 3
CoreFoundation 0x33479eb8 CFRunLoopRunSpecific + 352 4 CoreFoundation 0x33479d48 CFRunLoopRunInMode + 104 5 Foundation 0x33dc63d0 0x33d99000 + 185296 6 Foundation 0x33e49e80 0x33d99000 + 724608 7
libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 9 name: JavaScriptCore::BlockFree Thread 9: 0
libsystem_kernel.dylib 0x3b6af08c __psynch_cvwait + 24 1
libsystem_c.dylib 0x3b600aa0 pthread_cond_timedwait + 40 2 JavaScriptCore 0x37422c70 _ZN3WTF15ThreadCondition9timedWaitERNS_5MutexEd + 104 3 JavaScriptCore 0x37534550 0x373c7000 + 1496400 4
JavaScriptCore 0x37546fa8 0x373c7000 + 1572776 5
libsystem_c.dylib 0x3b608310 0x3b5f7000 + 70416

Thread 10 name: Dispatch queue: com.apple.root.background-priority Thread 10: 0 MyApp 0x00320a18 +[KSCrashReportFilterAppleFmt filterWithReportStyle:] + 0 1 libdispatch.dylib 0x3b5c9118 0x3b5c7000 + 8472 2
libdispatch.dylib 0x3b5d7258 0x3b5c7000 + 66136 3
libdispatch.dylib 0x3b5d73b8 0x3b5c7000 + 66488 4
libsystem_c.dylib 0x3b5fda10 0x3b5f7000 + 27152

Thread 11: 0 libsystem_kernel.dylib 0x3b6afd98 __workq_kernreturn + 8 1 libsystem_c.dylib 0x3b5fda10 0x3b5f7000 + 27152

Thread 12: 0 libsystem_kernel.dylib 0x3b6afd98 __workq_kernreturn + 8 1 libsystem_c.dylib 0x3b5fda10 0x3b5f7000 + 27152

Thread 13: 0 libsystem_kernel.dylib 0x3b6afd98 __workq_kernreturn + 8 1 libsystem_c.dylib 0x3b5fda10 0x3b5f7000 + 27152

Thread 0 crashed with ARM Thread State: r0: 0x1fd2a130 r1: 0x357e82c0 r2: 0x1fd3a6d0 r3: 0x20a8a4a0 r4: 0x31fd4070 r5: 0x20a8a4a0 r6: 0x2fd59a10 r7: 0x2fd599f8 r8: 0x20a8af20 r9: 0x0d5fa0b0 r10: 0xbecb6c00 r11: 0x1fd3a6d0 ip: 0x3bb2bd64 sp: 0x2fd599c8 lr: 0x355abb97 pc: 0x3b1ac5b0 cpsr: 0x20000030

Extra Information:

Stack Dump (0x2fd599a0-0x2fd59a18):

A8B4BC3B209FF240B499D52FADD81A3BA8B4BC3BC099D52F45D91A3BD0A6D31FC899D52FF1D01B3BA0A4A820D0A6D31F000000000020B23F00000000806DD9BF00000000E073ECBF0000000000000000009F63BF209FF240789AD52F51C3333500000000806DD9BF00000000E073ECBFDA1B7C21209FF240

Notable Addresses: { "r1": { "address": 897483456, "type": "string", "value": "accelerometer:didAccelerate:" }, "r11": { "address": 533964496, "class": "UIAccelerometer", "ivars": { "_delegate": { "address": 533897520, "type": "unknown" }, "_updateInterval": 0.1 }, "type": "objc_object" }, "r2": { "address": 533964496, "class": "UIAccelerometer", "ivars": { "_delegate": { "address": 533897520, "type": "unknown" }, "_updateInterval": 0.1 }, "type": "objc_object" }, "r3": { "address": 547923104, "class": "UIAcceleration", "ivars": { "timestamp": 76274, "x": 0.0708008, "y": -0.397308, "z": -0.889145 }, "type": "objc_object" }, "r5": { "address": 547923104, "class": "UIAcceleration", "ivars": { "timestamp": 76274, "x": 0.0708008, "y": -0.397308, "z": -0.889145 }, "type": "objc_object" }, "r8": { "address": 547925792, "class": "__NSCFType", "ivars": {}, "type": "objc_object" }, "stack@0x2fd599a0": { "address": 1002222760, "class": "UIAcceleration", "type": "objc_class" }, "stack@0x2fd599b0": { "address": 1002222760, "class": "UIAcceleration", "type": "objc_class" }, "stack@0x2fd599bc": { "address": 533964496, "class": "UIAccelerometer", "ivars": { "_delegate": { "address": 533897520, "type": "unknown" }, "_updateInterval": 0.1 }, "type": "objc_object" }, "stack@0x2fd599c8": { "address": 547923104, "class": "UIAcceleration", "ivars": { "timestamp": 76274, "x": 0.0708008, "y": -0.397308, "z": -0.889145 }, "type": "objc_object" }, "stack@0x2fd599cc": { "address": 533964496, "class": "UIAccelerometer", "ivars": { "_delegate": { "address": 533897520, "type": "unknown" }, "_updateInterval": 0.1 }, "type": "objc_object" } }

CrashDoctor Diagnosis: Attempted to dereference garbage pointer 0x31fd4078.

Answer 1

It's still possible to write buggy code, even when you're using ARC--it's not magic, and there are still rules. In this instance, try running a debug build of your app in Xcode with "NSZombies" turned on. What this does, is every time your app attempts to deallocate an object, Objective-C instead replaces it with an NSZombie object that will provide a much more helpful error message when you attempt to use it (attempting to dereference a garbage pointer, as your silly CrashDoctor thing is telling you).