How to find the cause of a malloc "double free" error?

When an object is "double-freed", the most common cause is that you're (unnecessarily) releasing an autoreleased object, and it is later autoreleased when the containing autorelease pool is emptied.

I've found that the best way to track down the extra release is to use the NSZombieEnabled environment variable for the affected executable in Xcode. For a quick rundown of how to use it, check out this CocoaDev wiki page. (In addition to this page, Apple has documented some incredibly obscure yet useful tips for debugging code in Xcode, some of which have saved my bacon more than a few times. I suggest checking out this Technical Note on developer.apple.com — link jumps to the section on Cocoa's Foundation framework).

Edit: You can often track the offending object down within the Xcode debugger, but it's often much easier if you use Instruments to assist you. From Xcode, choose Run → Start With Performance Tool → Object Allocations and you should be able to trace the offending object back to where it was created. (This will work best if you're enabled zombies as discussed above.) Note: Snow Leopard adds a Zombies tool to Instruments, accessible from the Run menu as well. Might be worth the $29 alone! ;-)

There is also a related SO question here.

You'll find out what the object is when you break in the debugger. Just look up the call stack and you will find where you free it. That will tell you which object it is.

The easiest way to set the breakpoint is to:

1. Go to Run -> Show -> Breakpoints (ALT-Command-B)
2. Scroll to the bottom of the list and add the symbol malloc_error_break

Open up the debugger console by pressing Cmd+Shift+R. There, type

break malloc_error_break

to set a breakpoint at the beginning of the malloc_error_break function.

If you want to find out what object is located at address 0x1068310, you can type the following into the debugger console:

print-object 0x1068310

Of course, you have to do this while the object is still alive -- if the object has already been freed by the time you do this, then this will not work.

This is what the malloc_error_break breakpoint looks like in the Breakpoints window in Xcode. Need to check the boxes to make it work.

alt text http://www.martijnthe.nl/wp-content/uploads/2009/08/Afbeelding-1.png

In Xcode, click left of the line number to set a breakpoint. Then you can launch it by doing a "Build and Debug".

It is recommended to not have object that you create be autorelease since memory is a commodity on the iPhone. Apple recommends explicitly calling release.

To find these kinds of memory and pointer problems in general, you want to run your code against a runtime memory error checker like Valgrind. This should be able to point out lots of things your code is doing wrong, beyond those that cause it to crash.

Valgrind can work on OSX (though it says it's "unsupported and incomplete and buggy"), and with a little hacking someone got it to work on iPhone SDK executables.

Even better you can try Instruments, which is part of XCode. There's a tutorial for running it here.