Break on EXC_BAD_ACCESS in Xcode?

Question

I'm new to iPhone development and Xcode in general and have no idea how to begin troubleshooting an EXC_BAD_ACCESS signal. How can I get Xcode to break at the exact line that is causing the error?

---

I can't seem to get Xcode to stop on the line causing the problem, but I do see the following lines in my debug console:

Sun Oct 25 15:12:14 jasonsmacbook TestProject[1289] : CGContextSetStrokeColorWithColor: invalid context

Sun Oct 25 15:12:14 jasonsmacbook TestProject[1289] : CGContextSetLineWidth: invalid context

Sun Oct 25 15:12:14 jasonsmacbook TestProject[1289] : CGContextAddPath: invalid context

Sun Oct 25 15:12:14 jasonsmacbook TestProject[1289] : CGContextDrawPath: invalid context

2009-10-25 15:12:14.680 LanderTest[1289:207] *** -[CFArray objectAtIndex:]: message sent to deallocated instance 0x3c4e610

Now, I am attempting to draw to the context I retrieve from UIGraphicsGetCurrentContext() and pass to the object that I want to draw with.

---

Further trial and error debugging and I found that an NSMutableArray I have a property for on my class was a zombie. I went into the init function for the class and here's the code I was using:

if ((self = [super init])) {
        NSMutableArray *array = [NSMutableArray array];
        self.terrainBlocks = array;
        [array release];
    }
    return self;    
}

I removed the [array release] line and it no longer gives me the EXC_BAD_ACCESS signal, but I'm now confused about why this works. I thought that when I used the property, it automatically retained it for me, and thus I should release it from within init so that I don't have a leak. I'm thoroughly confused about how this works and all the guides and Stackoverflow questions I've read only confuse me more about how to set properties within my init method. There seems to be no consensus as to which way is the best.

Solution 1

For any EXC_BAD_ACCESS errors, you are usually trying to send a message to a released object. The BEST way to track these down is use NSZombieEnabled.

This works by never actually releasing an object, but by wrapping it up as a "zombie" and setting a flag inside it that says it normally would have been released. This way, if you try to access it again, it still know what it was before you made the error, and with this little bit of information, you can usually backtrack to see what the issue was.

It especially helps in background threads when the Debugger sometimes craps out on any useful information.

VERY IMPORTANT TO NOTE however, is that you need to 100% make sure this is only in your debug code and not your distribution code. Because nothing is ever released, your app will leak and leak and leak. To remind me to do this, I put this log in my appdelegate:

if(getenv("NSZombieEnabled") || getenv("NSAutoreleaseFreedObjectCheckEnabled"))
  NSLog(@"NSZombieEnabled/NSAutoreleaseFreedObjectCheckEnabled enabled!");

If you need help finding the exact line, Do a Build-and-Debug (CMD-Y) instead of a Build-and-Run (CMD-R). When the app crashes, the debugger will show you exactly which line and in combination with NSZombieEnabled, you should be able to find out exactly why.

Solution 2

About your array. The line

NSMutableArray *array = [NSMutableArray array];

does not actually give you a retained object but rather an autorelease object. It probably gets retained in the next line but then you should not release it in the third line. See this

This is the fundamental rule:

You take ownership of an object if you create it using a method whose name begins with “alloc” or “new” or contains “copy” (for example, alloc, newObject, or mutableCopy), or if you send it a retain message. You are responsible for relinquishing ownership of objects you own using release or autorelease. Any other time you receive an object, you must not release it.

Solution 3

In Xcode 4, you can enable Zombies by clicking on the Scheme dropdown (top left, right next to the stop button) -> Edit Scheme -> Diagnostics Tab -> Enable Zombie Objects

Solution 4

Xcode/gdb always breaks on EXC_BAD_ACCESS, you just need to work your way up the call stack to find the code that triggered it.

Note that these kinds of errors often occur with autoreleased objects, meaning that the ultimate cause of the problem won't be in the call stack that triggered EXC_BAD_ACCESS. That's when NSZombieEnabled and NSAutoreleaseFreedObjectCheckEnabled become helpful.

Solution 5

A new answer to an old thread... in XCode 4 the most effective way to diagnose EXC_BAD_ACCESS exceptions is to use Instruments to profile your app (from XCode click Product/Profile and choose Zombies). This will help you identify messages sent to deallocated objects.

View more solutions

Comments

[Sixten Otto]

For what it's worth, a search on that error here on SO (or on Google) doesn't exactly turn up empty... stackoverflow.com/search?q=exc_bad_access

[jasonh]

FWIW, I did that search and didn't come up with anything that helped me get XCode to stop on the line that is causing the EXC_BAD_ACCESS. Even after turning on NSZombieEnabled and Build and Debug, XCode isn't showing the line that's giving the error.

[cregox]

slightly related: stackoverflow.com/questions/1027658/… basically same error, but thanks to NSTimer.

[Pål Brattberg]

Is that property retained? If it is, you should release, if it isn't, you shouldn`t.

[Ahti]

Pål, he shoudl not, because either way, [NSMutableArray array]returns an autoreleased instance of NSMutableArray, so you need not worry about its memory management.

[jasonh]

XCode still isn't stopping on the line that is causing the error, but I have updated the question with the information I see in the debug console.

[jasonh]

Thanks. For some reason I thought [NSMutableArray array] was like alloc and init, not a convenience method. I'll get the hang of it sooner or later I'm sure.

[Sixten Otto]

@jasonh, it's both. Class methods like that are, by convention, essentially concatenations of alloc and init. But the object returned is autoreleased, and so you need to retain the result (essentially, to claim ownership of it from the class where it was allocated).

[KeremV]

Yes, but he throwing an out of bounds exception right before he segfaults, which is definitely an error and may well cascade into the crash.

[paiego]

This is helpful, yet can be misleading because getenv("NSZombieEnabled") will be true (non-zero) regardless of the env variable's actual value. Try this: char* szZombie = getenv("NSZombieEnabled"); if (szZombie && 0 == strcasecmp(szZombie, "YES")) { NSLog(@"NSZombieEnabled enabled!"); }

[coneybeare]

It all depends on how you set the variable. I completely remove it when not using zombie.

[Henrik Erlandsson]

So, basically [[NSMutableArray array] retain] is a convenience method to not have to type [[NSMutable alloc] init]? ;)

[user2387149]

unless you are sure the warnings you have are harmless.

[Pang]

@coneybeare Link to NSZombieEnabled is dead (404 Not Found).

[Hua-Ying]

Thanks for your answer, I found Instruments is really helpful. For others with this problem I highly recommend it. It also shows lines of code where the ref count changes along with the stack track. It would have been really hard to find the problem without it! I consider this answer better than the accepted answer, just NSZombieEnabled alone only shows you when the invalid access happens but it doesn't help you find out why.