-[CFRunLoopTimer release]: message sent to deallocated instance 0x62398f80

Question

I have googled for several hours and read quite lots of message sent to deallocated instance posts, and tried methods suggested in those posts, but I still can't spot the bug that causes the crash.

I have tried enabling NSZombieEnabled, MallocStackLogging, MallocStackLoggingNoCompact and got this line:

*** -[CFRunLoopTimer release]: message sent to deallocated instance 0x62398f80

But in my code, I didn't use a CFRunLoopTimer or NSTimer.

and with info malloc, I got the following output:

[Switching to process 97238 thread 0x11903]
sharedlibrary apply-load-rules all 
mygame(97238,0xb01cd000) malloc: recording malloc stacks to disk using standard recorder
(gdb) info malloc 0x62398f80
Alloc: Block address: 0x62398f80 length: 128 
Stack - pthread: 0xac0422c0 number of frames: 41
    0: 0xe9d22 in GMmalloc_zone_malloc_internal
    1: 0xe9ebb in GMmalloc_zone_malloc
    2: 0x142ba88 in __CFAllocatorSystemAllocate
    3: 0x142ba63 in CFAllocatorAllocate
    4: 0x142b8de in _CFRuntimeCreateInstance
    5: 0x147c1c5 in CFRunLoopTimerCreate
    6: 0x32bb831 in _ZN7WebCore22setSharedTimerFireTimeEd
    7: 0x338dd4b in _ZN7WebCore21MainThreadSharedTimer11setFireTimeEd
    8: 0x338daf3 in _ZN7WebCore12ThreadTimers17updateSharedTimerEv
    9: 0x3397781 in _ZN7WebCore9TimerBase15setNextFireTimeEd
   10: 0x339786a in _ZN7WebCore9TimerBase5startEdd
   11: 0x2be78be in _ZN7WebCore5Frame9keepAliveEv
   12: 0x2e86312 in _ZN7WebCore15JSDOMWindowBase10globalExecEv
   13: 0x2ea699a in _ZN7WebCore15JSEventListener11handleEventEPNS_22ScriptExecutionContextEPNS_5EventE
   14: 0x2bc4e02 in _ZN7WebCore11EventTarget18fireEventListenersEPNS_5EventEPNS_15EventTargetDataERN3WTF6VectorINS_23RegisteredEventListenerELm1EEE
   15: 0x2bc4f1c in _ZN7WebCore11EventTarget18fireEventListenersEPNS_5EventE
   16: 0x2bc46ee in _ZN7WebCore11EventTarget13dispatchEventEN3WTF10PassRefPtrINS_5EventEEE
   17: 0x33eb040 in _ZN7WebCore9WebSocket10didConnectEv
   18: 0x33eafa4 in _ZThn20_N7WebCore9WebSocket10didConnectEv
   19: 0x33ed470 in _ZN7WebCore16WebSocketChannel13processBufferEv
   20: 0x33edd18 in _ZN7WebCore16WebSocketChannel14didReceiveDataEPNS_18SocketStreamHandleEPKci
   21: 0x32c681b in _ZN7WebCore18SocketStreamHandle18readStreamCallbackEm
   22: 0x32c68f8 in _ZN7WebCore18SocketStreamHandle18readStreamCallbackEP14__CFReadStreammPv
   23: 0x14c803d in _signalEventSync
   24: 0x14c879a in _cfstream_solo_signalEventSync
   25: 0x14c7e41 in _CFStreamSignalEvent
   26: 0x14c86f7 in CFReadStreamSignalEvent
   27: 0x1ca371 in _ZN12SocketStream40dispatchSignalFromSocketCallbackUnlockedEP24SocketStreamSignalHolder
   28: 0x126011 in _ZN12SocketStream14socketCallbackEP10__CFSocketmPK8__CFDataPKv
   29: 0x125f21 in _ZN12SocketStream22_SocketCallBack_streamEP10__CFSocketmPK8__CFDataPKvPv
   30: 0x1495e14 in __CFSocketPerformV0
   31: 0x14fb94f in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
   32: 0x145eb43 in __CFRunLoopDoSources0
   33: 0x145e424 in __CFRunLoopRun
   34: 0x145dd84 in CFRunLoopRunSpecific
   35: 0x145dc9b in CFRunLoopRunInMode
   36: 0x1d5c7d8 in GSEventRunModal
   37: 0x1d5c88a in GSEventRun
   38: 0x39c626 in UIApplicationMain
   39: 0x3095 in main at /Users/neevek/workspace/xcode_projects/mygame/mygame/main.m:16
   40: 0x2925 in start

EDIT

I am almost desperate, I have spent 2 days on this problem. the only thing I can spot is the CFRunLoopTimer zombie object. I use CocoaHttpServer and NSURLConnection in my code. From somewhere I learnt that NSURLConnection depends on NSRunLoop, so I wonder if it is the NSRunLoop that causes the crash. in my app, both CocoaHTTPServer and NSURLConnection depend on NSRunLoop, of cause they run on different threads.

Please help!

I use Instruments to find the zombie object, and took 2 screenshots of the crash report:

And the [HttpServer bonjourThread] method:

Answer 1

I've fixed this, just call a dummy stringByEvaluatingJavaScriptFromString on the UIWebView before invoking a method on the context. I believe the reason this works is the call into javascript is done on the Web Thread and it uses a timer to receive the reply back to the main thread, when calling invoke this timer wasn't created so when the reply comes back from the Web Thread it crashes trying to release a timer that was never created in the first place. By using the proper API stringByEvaluatingJavaScriptFromString in insures the timer is created and then the invokeMethod can make use of the same timer.

JSContext* context = [webView valueForKeyPath:@"documentView.webView.mainFrame.javaScriptContext"];
JSValue* value = context[@"Colors"];

// timer CFRelease crash fix
[webView stringByEvaluatingJavaScriptFromString:nil]; 

[value invokeMethod:@"update" withArguments:@[objectID,modifier]];

Answer 2

The only solution according to me is to search your code for NSTimer- Any 3rd part libraries can use it.Once the NSTimer is found just add a retain statement at the end of the NSTimer initialization, Like this:

idleTimer = [[NSTimer scheduledTimerWithTimeInterval:maxIdleTime
                                                    target:self
                                                    selector:@selector(idleTimerExceeded)
                                                    userInfo:nil
                                                    repeats:NO]retain];