Why would an app crash with _objc_msgSend_uncached

Question

Is a document or a place to find information information on what would cause _objc_msgSend_uncached in a crash report?

more info on the crash

libobjc.A.dylib 0x37e623cc  _objc_inform
4   libobjc.A.dylib 0x37e616f2  _ZN7cache_t9bad_cacheEP11objc_objectP13objc_selectorP10objc_class
5   libobjc.A.dylib 0x37e61730  _ZN7cache_t4findEm
6   libobjc.A.dylib 0x37e617da  cache_fill
7   libobjc.A.dylib 0x37e65890  lookUpImpOrForward
8   libobjc.A.dylib 0x37e5e02a  _class_lookupMethodAndLoadCache3
9   libobjc.A.dylib 0x37e5ddf8  _objc_msgSend_uncached
10  MyApp   0x00253f5c  -[AEEngine scanKeyframes:currentFrame:] in AEEngine.m on Line 256
11  MyApp   0x00256148  -[AEEngine doFrame] in AEEngine.m on Line 664
12  MyApp   0x00255f28  __31-[AEEngine doFrameInBackground]_block_invoke in AEEngine.m on Line 642

Got another similar crash that looks like this and ends in cache_t::bad_cache

  0   libobjc.A.dylib                   0x37b44368 _objc_trap() + 0
  1   libobjc.A.dylib                   0x37b443c8 _objc_fatal + 68
  2   libobjc.A.dylib                   0x37b436ee cache_t::bad_cache(objc_object*, objc_selector*, objc_class*) + 202
  3   libobjc.A.dylib                   0x37b4372c cache_t::find(unsigned long) + 48
  4   libobjc.A.dylib                   0x37b437d6 cache_fill + 122
  5   libobjc.A.dylib                   0x37b4788c lookUpImpOrForward + 320
  6   libobjc.A.dylib                   0x37b40026 _class_lookupMethodAndLoadCache3 + 30
  7   libobjc.A.dylib                   0x37b3fdf6 _objc_msgSend_uncached + 22
  8   MyApp                         0x0033811c -[MyCellCell configureCell:] (MyCellCell.m:81)

Answer 1

_objc_msgSend_uncached is an internal implementation detail of objc_msgSend. Crashes in objc_msgSend most often indicate that you're sending a message to a deallocated instance. The most common cause of that is incorrect memory management. The most common cause of incorrect memory management is failure to use ARC.

Most likely, -[AEEngine scanKeyframes:currentFrame:] is trying to message something that is deallocated. That doesn't mean the bug is in AEEngine, only that this is the place you tripped over the over-release. I would start by making sure that ARC is turned on, and that you have addressed all static analyzer warnings.

Answer 2

this isn't exactly documentation but found this

http://opensource.apple.com/source/objc4/objc4-551.1/runtime/Messengers.subproj/objc-msg-x86_64.s

/********************************************************************
 *
 * _objc_msgSend_uncached_impcache
 * _objc_msgSend_uncached
 * _objc_msgSend_stret_uncached
 * 
 * Used to erase method cache entries in-place by 
 * bouncing them to the uncached lookup.
 *
 ********************************************************************/

    STATIC_ENTRY __objc_msgSend_uncached_impcache
    // Method cache version

    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band condition register is NE for stret, EQ otherwise.
    // Out-of-band r11 is the searched class

    MESSENGER_START
    nop
    MESSENGER_END_SLOW

    jne __objc_msgSend_stret_uncached
    jmp __objc_msgSend_uncached

    END_ENTRY __objc_msgSend_uncached_impcache


    STATIC_ENTRY __objc_msgSend_uncached
    DW_START __objc_msgSend_uncached

    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band r11 is the searched class

    // r11 is already the class to search
    MethodTableLookup %a1, %a2, __objc_msgSend_uncached // r11 = IMP
    cmp %r11, %r11      // set eq (nonstret) for forwarding
    jmp *%r11           // goto *imp

    DW_END __objc_msgSend_uncached, 1
    END_ENTRY __objc_msgSend_uncached


    STATIC_ENTRY __objc_msgSend_stret_uncached
    DW_START __objc_msgSend_stret_uncached
    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band r11 is the searched class

    // r11 is already the class to search
    MethodTableLookup %a2, %a3, __objc_msgSend_stret_uncached  // r11 = IMP
    test    %r11, %r11      // set ne (stret) for forward; r11!=0
    jmp *%r11           // goto *imp

    DW_END __objc_msgSend_stret_uncached, 1
    END_ENTRY __objc_msgSend_stret_uncached