How can accessing super in an instance method cause EXC_BAD_ACCESS? - objective-c

Question

Inside an instance method I'm calling the same selector on the superclass and getting EXC_BAD_ACCESS. I'm using manual reference counting (not ARC), and this is happening in the main thread. Static analysis reports no issues, not that I take that to mean a clean bill of health. The relevant code is as follows:
CommentListMedia.m (stack frame 1 in the trace below):
- (void)play {
if ((comments.isLoading) && (! comments.isLoaded))
playWhenLoaded = YES;
else [super play]; // <-- EXC_BAD_ACCESS happens here
}
MediaControls.m (stack frame 2 in the trace below):
- (void)play {
[media play]; // <-- this calls the code above
[self notifyWithName:MediaControlsDidPlayNotification];
}
MyApp.m (stack frame 11 in the trace below):
- (void)sendEvent:(UIEvent *)event {
[super sendEvent:event]; // <-- this calls the code above
...
}
The superclass of CommentListMedia is SequentialMedia, which doesn't figure into the stack trace because the exception occurs before it's reached.
Unfortunately I'm only seeing this in crash reports (from Crashlytics), and haven't been able to reproduce it myself. What strikes me as odd about it is that the reference to the class instance must have been good to perform the play selector in the first place, but somehow by the time it gets to the end, the reference to the superclass is bad. At first I thought the instance might be auto-released or something, but I'm under the impression that autoreleasing happens on the main thread at the end of the run loop, not at some random time in the middle of a call. Any input on what might be causing this or how to debug it would be appreciated.
The call stack on the main thread looks like this:
0 libobjc.A.dylib objc_msgSend + 5
1 MyApp -[CommentListMedia play]
2 MyApp -[MediaControls play]
3 UIKit -[UIApplication sendAction:to:from:forEvent:] + 90
4 UIKit -[UIApplication sendAction:toTarget:fromSender:forEvent:] + 30
5 UIKit -[UIControl sendAction:to:forEvent:] + 44
6 UIKit -[UIControl _sendActionsForEvents:withEvent:] + 374
7 UIKit -[UIControl touchesEnded:withEvent:] + 590
8 UIKit -[UIWindow _sendTouchesForEvent:] + 528
9 UIKit -[UIWindow sendEvent:] + 832
10 UIKit -[UIApplication sendEvent:] + 196
11 MyApp -[MyApp sendEvent:]
12 UIKit _UIApplicationHandleEventQueue + 7096
13 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 14
14 CoreFoundation __CFRunLoopDoSources0 + 206
15 CoreFoundation __CFRunLoopRun + 622
16 CoreFoundation CFRunLoopRunSpecific + 522
17 CoreFoundation CFRunLoopRunInMode + 106
18 GraphicsServices GSEventRunModal + 138
19 UIKit UIApplicationMain + 1136
20 MyApp main

Answer 1

0 libobjc.A.dylib objc_msgSend + 5
1 MyApp -[CommentListMedia play]
That may be a crash in -[SequentialMedia play]. Specifically, if that method returns void and makes a call as the last expression in the method, it may be that the [optimizing] compiler generated a tail call. This would effectively cause the method call to disappear from the stack.
Post the contents of the registers from your crash report. $r0 can be quite illuminating (as it is the first arg and should be a viable object).
Also, if there is heavy concurrency in play in your program, then it could be that the object is being released and deallocated by a secondary thread. But, typically, you would see more than one flavor of odd crash (though sometimes not, if your code makes heavy use of synchronization primitives -- it can be remarkable how consistent a concurrent program behaves from run to run).