Open Radar

 
19-Dec-2012 11:04 AM Aidan Steele:
Summary:
The following code crashes on the property setter line only under the following circumstances: ARC is enabled and the code is running on an iOS device. It does not crash on the simulator with ARC (en|dis)abled nor does it crash on the device with ARC disabled. The crash within the setter is sending a -retain message to an already-deallocated object -- as determined by debugging with NSZombieEnabled=YES.

Steps to Reproduce:
@interface Crasher ()
@property (nonatomic, strong) NSArray *array;
@end

@implementation Crasher

- (void)crash;
{
  NSMutableArray *mutable = [NSMutableArray array];
  NSArray *items = @[@0, @1, @2, @3];

  if ([@YES boolValue])
  {
    [items enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
      [mutable addObject:obj];
    }];
  }
  else
  {
    [items enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
      [mutable addObject:obj];
    }];
  }

  [self setArray:mutable];
}

@end

Expected Results:
Code to not crash.

Actual Results:
Code does crash.

Regression:
This happens in at least Xcode 4.5.0 and 4.5.2. It does not happen in Xcode 4.6 DP3. 

Notes:
I have posted a sample project to demonstrate this crash at https://github.com/aidansteele/arc-crash. It is reproducible every time.