EXC_BAD_ACCESS, Using NSZombies to track down

Question

I have got a EXC_BAD_ACCESS error while dismissing a view controller on device. But strangely this does not happen in simulator.

The Question: I am using the Instruments and NSZombies enabled and here is the report at the error. I am not getting heads and tails out of it. I understand that this shows the ref Count +es and -es. But where is my code that generated this error? All I see is that the responsible caller are UIVIews, CATransactions, where is my code?

THE CRASH LOG

Thread 0:
0   libsystem_kernel.dylib          0x00000001923d5cc0 mach_msg_trap + 8
1   CoreFoundation                  0x0000000185992ca8 __CFRunLoopServiceMachPort + 180
2   CoreFoundation                  0x0000000185990e9c __CFRunLoopRun + 932
3   CoreFoundation                  0x00000001858d1b34 CFRunLoopRunSpecific + 448
4   itunesstored                    0x00000001000bfe14 0x1000b0000 + 65044
5   libdyld.dylib                   0x00000001922f3a9c start + 0

Thread 1:
0   libsystem_kernel.dylib          0x00000001923d5ac8 kevent64 + 8
1   libdispatch.dylib               0x00000001922d9d74 _dispatch_mgr_thread + 48

Thread 2 name:  com.apple.NSURLConnectionLoader
Thread 2:
0   libsystem_kernel.dylib          0x00000001923d5cc0 mach_msg_trap + 8
1   CoreFoundation                  0x0000000185992ca8 __CFRunLoopServiceMachPort + 180
2   CoreFoundation                  0x0000000185990e38 __CFRunLoopRun + 832
3   CoreFoundation                  0x00000001858d1b34 CFRunLoopRunSpecific + 448
4   Foundation                      0x00000001864be7f8 +[NSURLConnection(Loader) _resourceLoadLoop:] + 344
5   Foundation                      0x000000018654c76c __NSThread__main__ + 996
6   libsystem_pthread.dylib         0x00000001924701ac _pthread_body + 164
7   libsystem_pthread.dylib         0x0000000192470104 _pthread_start + 136
8   libsystem_pthread.dylib         0x000000019246d7ac thread_start + 0

Thread 3 name:  com.apple.CFSocket.private
Thread 3:
0   libsystem_kernel.dylib          0x00000001923ee76c select$DARWIN_EXTSN + 8
1   libsystem_pthread.dylib         0x00000001924701ac _pthread_body + 164
2   libsystem_pthread.dylib         0x0000000192470104 _pthread_start + 136
3   libsystem_pthread.dylib         0x000000019246d7ac thread_start + 0

Thread 4:
0   libsystem_kernel.dylib          0x00000001923ee394 __psynch_cvwait + 8
1   MobileSystemServices            0x000000018bc8d53c MOXPCTransportReceiveMessage + 268 2   MobileInstallation                0x000000018bc48900 perform_command + 280
3   MobileInstallation              0x000000018bc491e8 MobileInstallationLookup + 388
4   itunesstored                    0x00000001000e985c 0x1000b0000 + 235612
5   libdispatch.dylib               0x00000001922d841c _dispatch_call_block_and_release + 20
6   libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
7   libdispatch.dylib               0x00000001922df3f8 _dispatch_root_queue_drain + 396
8   libdispatch.dylib               0x00000001922df634 _dispatch_worker_thread2 + 72
9   libsystem_pthread.dylib         0x000000019246d914 _pthread_wqthread + 352
10  libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 5:
0   libsystem_kernel.dylib          0x00000001923eee74 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 6:
0   libsystem_kernel.dylib          0x00000001923d5cc0 mach_msg_trap + 8
1   CoreFoundation                  0x0000000185992ca8 __CFRunLoopServiceMachPort + 180
2   CoreFoundation                  0x0000000185990e38 __CFRunLoopRun + 832
3   CoreFoundation                  0x00000001858d1b34 CFRunLoopRunSpecific + 448
4   iTunesStore                     0x00000001903c2a58 -[ISOperation runRunLoopUntilStopped] + 200
5   iTunesStore                     0x00000001903c9f84 -[ISURLOperation _runRequestWithURL:] + 1256
6   iTunesStore                     0x00000001903c9a30 -[ISURLOperation _run] + 428
7   iTunesStore                     0x00000001903c5588 -[ISURLOperation run] + 328
8   iTunesStore                     0x00000001903d2324 -[ISStoreURLOperation _runURLOperation] + 696
9   iTunesStore                     0x00000001903d0b68 -[ISStoreURLOperation run] + 568
10  iTunesStore                     0x00000001903c4214 -[ISOperation _main:] + 304
11  iTunesStore                     0x00000001903c35cc -[ISOperation main] + 548
12  iTunesStore                     0x00000001903c2b94 -[ISOperation runSubOperation:returningError:] + 220
13  iTunesStore                     0x00000001903ce928 -[ISLoadURLBagOperation run] + 884
14  iTunesStore                     0x00000001903c4214 -[ISOperation _main:] + 304
15  iTunesStore                     0x00000001903c35cc -[ISOperation main] + 548
16  iTunesStore                     0x00000001903c2b94 -[ISOperation runSubOperation:returningError:] + 220
17  iTunesStore                     0x00000001903d1f74 -[ISStoreURLOperation _resolvedURLInBagContext:URLBag:] + 104
18  iTunesStore                     0x00000001903d20e4 -[ISStoreURLOperation _runURLOperation] + 120
19  iTunesStore                     0x00000001903d0b68 -[ISStoreURLOperation run] + 568
20  iTunesStore                     0x00000001903c4214 -[ISOperation _main:] + 304
21  iTunesStore                     0x00000001903c35cc -[ISOperation main] + 548
22  Foundation                      0x0000000186474d34 -[__NSOperationInternal _start:] + 640
23  Foundation                      0x0000000186536d78 __NSOQSchedule_f + 72
24  libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
25  libdispatch.dylib               0x00000001922dd92c _dispatch_async_redirect_invoke + 148
26  libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
27  libdispatch.dylib               0x00000001922df3f8 _dispatch_root_queue_drain + 396
28  libdispatch.dylib               0x00000001922df634 _dispatch_worker_thread2 + 72
29  libsystem_pthread.dylib         0x000000019246d914 _pthread_wqthread + 352
30  libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 7 name:  Data corruption: Malformed Mach message or kernel bug.
Thread 7 Crashed:
0   libxpc.dylib                    0x0000000192488f9c _xpc_connection_mach_event + 1992
1   libdispatch.dylib               0x00000001922d84b0 _dispatch_client_callout4 + 12
2   libdispatch.dylib               0x00000001922dabdc _dispatch_mach_msg_invoke + 148
3   libdispatch.dylib               0x00000001922de698 _dispatch_queue_drain + 456
4   libdispatch.dylib               0x00000001922da620 _dispatch_mach_invoke + 104
5   libdispatch.dylib               0x00000001922dd8d0 _dispatch_async_redirect_invoke + 56
6   libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
7   libdispatch.dylib               0x00000001922df3f8 _dispatch_root_queue_drain + 396
8   libdispatch.dylib               0x00000001922df634 _dispatch_worker_thread2 + 72
9   libsystem_pthread.dylib         0x000000019246d914 _pthread_wqthread + 352
10  libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 8:
0   libsystem_kernel.dylib          0x00000001923ee3dc __psynch_mutexwait + 8
1   Foundation                      0x000000018645b958 -[NSLock lock] + 152
2   iTunesStore                     0x00000001903e7760 ISUniqueOperationLock + 228
3   iTunesStore                     0x00000001903c3408 -[ISOperation main] + 96
4   iTunesStore                     0x00000001903c2b94 -[ISOperation runSubOperation:returningError:] + 220
5   iTunesStore                     0x00000001903cf438 -[ISOperation(ISLoadURLBagAdditions) loadURLBagWithContext:returningError:] + 112
6   itunesstored                    0x00000001001046e0 0x1000b0000 + 345824
7   iTunesStore                     0x00000001903c4214 -[ISOperation _main:] + 304
8   iTunesStore                     0x00000001903c35cc -[ISOperation main] + 548
9   Foundation                      0x0000000186474d34 -[__NSOperationInternal _start:] + 640
10  Foundation                      0x0000000186536d78 __NSOQSchedule_f + 72
11  libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
12  libdispatch.dylib               0x00000001922dd92c _dispatch_async_redirect_invoke + 148
13  libdispatch.dylib               0x00000001922d83dc _dispatch_client_callout + 12
14  libdispatch.dylib               0x00000001922df3f8 _dispatch_root_queue_drain + 396
15  libdispatch.dylib               0x00000001922df634 _dispatch_worker_thread2 + 72
16  libsystem_pthread.dylib         0x000000019246d914 _pthread_wqthread + 352
17  libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 9:
0   libsystem_kernel.dylib          0x00000001923eee74 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 10:
0   libsystem_kernel.dylib          0x00000001923eee74 __workq_kernreturn + 8
1   libsystem_pthread.dylib         0x000000019246d7a4 start_wqthread + 0

Thread 7 crashed with ARM Thread State (64-bit):
    x0: 0x0000000000000036   x1: 0x0000000000000037   x2: 0x00000001924a516e   x3: 0x0000000000000037
    x4: 0x0000000102263bc8   x5: 0x0000000000000036   x6: 0x0000000000000000   x7: 0x0000000000000110
    x8: 0x7300ae44061c0155   x9: 0x7300ae44061c0155  x10: 0x0000000102263bc8  x11: 0x0000000000000000
   x12: 0x000000000000006f  x13: 0x000000019239e3d1  x14: 0x000000000000005f  x15: 0x000000019239be4b 
   x16: 0x0000000192468e90  x17: 0x0021c35bf1cc0111  x18: 0x0000000000000000  x19: 0x0000000147db6140
   x20: 0x0000000147e999f0  x21: 0x0000000147e34d80  x22: 0x000000001000000c  x23: 0x0000000147d8aa00
   x24: 0x00000001022640e0  x25: 0x0000000147d436d0  x26: 0x0000000000020001  x27: 0x000000000000000a
   x28: 0x00000001022640e0   fp: 0x0000000102263d50   lr: 0x0000000192488f9c   sp: 0x0000000102263c80
    pc: 0x0000000192488f9c cpsr: 0x60000000

Answer 1

Your application is crashing with the message “Data corruption: Malformed Mach message or kernel bug”. Either that means what it says (in which case the bug is most likely not yours), or (more likely IMO) you’re tramping on memory you don’t own. Finding memory overwrites is hard, but Apple provides tools to help you — see TN2124.

I’d try enabling MallocGuardEdges et al in the simulator and see if you crash (you can do this from Xcode in the Scheme configuration.) Alternatively, you could try enabling Guard Malloc and that might also help.