How to find the cause of a malloc "double free" error?

Question

I'm programming an application in Objective-C and I'm getting this error:

MyApp(2121,0xb0185000) malloc: &ast;** error for object 0x1068310: double free
*** set a breakpoint in malloc_error_break to debug

It is happening when I release an NSAutoreleasePool and I can't figure out what object I'm releasing twice.

How do I set his breakpoint?

Is there a way to know what is this "object 0x1068310"?

you might want to tag this post with iPhone as well to get some more people — Benny Wong, Jun 09 '09 at 18:00
I can't imagine why this iPhone question would be missing the iPhone tag. There must be more people following "iPhone" than some of these other tags like "autorelease." If you want to find "autorelease," you search for it, you don't follow the tag. So I put "iPhone" back in. — Nosredna, Jun 30 '09 at 01:24
The reason I removed the "iphone" tag is because nothing about the question is specific to iPhone. The only link at all is that it occurs in an iPhone app, but the exact same error can occur in any C or Objective-C application. I don't expect that people following iPhone would be casually interested in this — rather, it would be people who search for things like "double free" or "malloc_error_break", and if they toss in "iPhone", it will still come up. Let's not bicker about tags, but consider that perhaps the people who answer may know where the question best belongs. — Quinn Taylor, Jul 03 '09 at 00:59
This question is at least Cocoa-specific. If the iPhone tag offends, how about a cocoa tag? The obvious intent applies to Objective-C on Cocoa in XCode. Not Objective-C on Windows, or Linux, or outside the context of XCode. — runako, Nov 17 '09 at 06:45
As there plenty of reasons for this bug, I'll tell mine: (const float*) memory was modified. — olha, Dec 22 '16 at 18:19
refer to this http://stackoverflow.com/q/14045208/6521116 to debug the error. — LF00, May 10 '17 at 06:45

score 47 · Answer 1 · edited May 23 '17 at 12:17

When an object is "double-freed", the most common cause is that you're (unnecessarily) releasing an autoreleased object, and it is later autoreleased when the containing autorelease pool is emptied.

I've found that the best way to track down the extra release is to use the NSZombieEnabled environment variable for the affected executable in Xcode. For a quick rundown of how to use it, check out this CocoaDev wiki page. (In addition to this page, Apple has documented some incredibly obscure yet useful tips for debugging code in Xcode, some of which have saved my bacon more than a few times. I suggest checking out this Technical Note on developer.apple.com — link jumps to the section on Cocoa's Foundation framework).

Edit: You can often track the offending object down within the Xcode debugger, but it's often much easier if you use Instruments to assist you. From Xcode, choose Run → Start With Performance Tool → Object Allocations and you should be able to trace the offending object back to where it was created. (This will work best if you're enabled zombies as discussed above.) Note: Snow Leopard adds a Zombies tool to Instruments, accessible from the Run menu as well. Might be worth the $29 alone! ;-)

There is also a related SO question here.

Use the Way Back Machine: http://web.archive.org/web/20120325135712/http://www.cocoadev.com/index.pl?NSZombieEnabled — Quinn Taylor, Feb 10 '17 at 22:30

score 39 · Accepted Answer · edited Aug 07 '13 at 13:18

39

You'll find out what the object is when you break in the debugger. Just look up the call stack and you will find where you free it. That will tell you which object it is.

The easiest way to set the breakpoint is to:

Go to Run -> Show -> Breakpoints (ALT-Command-B)

Scroll to the bottom of the list and add the symbol malloc_error_break

edited Aug 07 '13 at 13:18

Hemang

26,840
19
119
186

answered Jun 09 '09 at 18:06

Frank Krueger

69,552
46
163
208

1

I tried that, but I get: unable to dissamble malloc_error_break.... what does it mean? – gonso Jun 10 '09 at 05:49
3

No help for autorelease double free. He needs Zombies – Rog Jun 11 '09 at 06:31
61

@gonso — Just curious, if this didn't work for you, why did you you accept it as the answer? – Quinn Taylor Jun 18 '09 at 04:13
8

In Xcode 4.3.2, the breakpoints can be found in **View → Navigators → Show Breakpoints Navigator** or ⌘6 (Cmd-6) – Andreas Ley May 15 '12 at 09:44

score 13 · Answer 3 · answered Nov 03 '10 at 13:32

I just want to add my experience in addition to the answer of Quinn Taylor.

In one of my apps, I have to parse and save data into core data objects and later on get these objects to display on the views. In fact, the app works just fine and does not crash at all, until I tried to do a stress test of navigating back and forth multiple times, tried to open multiple views as fast as possible. The app crashes with the above message.

I have tried all the methods that Quinn suggested in his answer and still failed to find out where was the exact cause.

I set NSZombieEnabled=YES, and NSStackLogging=YES, ran the command shell malloc_history to find out why, but still no luck. It always points out to where I save the data into core data objects, in fact, I have checked thousand times the over released objects there, nothing odd.

Running in Instruments with various tools(Allocations, Leaks, etc...) still did not help. Enable the Guard Malloc still got nothing.

Final rescue: I tried to come back to the views where the objects were taken from Core Data and sent a retain message to all of these objects, and took note to these changes. It solved the issue!!!

So, I found out that I failed to retain one, that's exactly the cause. Just want to share my experience so you have another rescue for your app.

score 11 · Answer 4 · answered Jun 11 '09 at 03:51

11

Open up the debugger console by pressing Cmd+Shift+R. There, type

break malloc_error_break

to set a breakpoint at the beginning of the malloc_error_break function.

If you want to find out what object is located at address 0x1068310, you can type the following into the debugger console:

print-object 0x1068310

Of course, you have to do this while the object is still alive -- if the object has already been freed by the time you do this, then this will not work.

answered Jun 11 '09 at 03:51

Adam Rosenfield

390,455
97
512
589

This is autorelease, he needs Zombies. – Rog Jun 11 '09 at 06:32
1

Finally what I did was invoking the "suspicious" method outside of AutoreleasePoll. Funny thought I still got the warning, but no break point was hit. I just commented out blocks until I found the line. I was autoreleasing a string that was created with stringWithFormat (no alloc or copy). Thank you all for your tips! Gonso – gonso Jun 12 '09 at 00:38
For this particular type of bug, breaking on malloc_error_break has never helped find the problem — it has always required enabling zombies. – Quinn Taylor Jul 03 '09 at 15:23
See here for instructions on setting a breakpoint for malloc_error_break in XCode 4: http://stackoverflow.com/questions/6969407/set-malloc-error-break-in-xcode-4 – benvolioT Sep 30 '11 at 02:35
I'm getting "error: 'print-object' is not a valid command. error: Unrecognized command 'print-object'." when I use the command. – Daniel Ryan Aug 24 '15 at 00:24
1

@Zammbi: Try using the `po` alias, or equivalently `expr -o`. In the years since this answer was originally written, the debugging engine used by Xcode has been changed from GDB to LLDB, and LLDB has a different set of commands. – Adam Rosenfield Sep 29 '15 at 02:57

Ramkrishna Sharma · Answer 5 · 2017-05-25T13:52:56.773

8

Please find the below steps for how to find the object which is free and crash the application.

1) Click on the "Breakpoint navigator".
2) Then click on the "+" button which is below.
3) Add the "Symbolic Breakpoint..." from the list.
4) Add the "malloc_error_break" keyword on the "Symbol" option.

Or you can also refer the below GIF presentation.

edited May 25 '17 at 13:52

answered May 25 '17 at 13:31

Ramkrishna Sharma

6,961
3
42
51

score 4 · Answer 6 · answered Jul 09 '11 at 17:59

For me the issue was solved by

(gdb) call (void)_CFAutoreleasePoolPrintPools()

right after the crash. The address at the top of the stack was the address of the culprit. Threw in a retain and voila.

The address given in the log message did not get me anywhere. It never showed up in any of the various Instrumets. Apparently a pointer to some internal data which had already been freed.

score 4 · Answer 7 · answered Dec 17 '11 at 19:54

Adding a symbolic breakpoint in Xcode 4

Just an update to make this relevant to Xcode 4...

From the Xcode 4 User Guide:

To add a symbolic breakpoint . . .

In the bottom-left corner of the breakpoint navigator, click the Add button.

Choose Add Symbolic Breakpoint.

Enter the symbol name in the Symbol field.

Click Done.

score 3 · Answer 8 · answered Aug 05 '09 at 10:51

3

This is what the malloc_error_break breakpoint looks like in the Breakpoints window in Xcode. Need to check the boxes to make it work.

alt text http://www.martijnthe.nl/wp-content/uploads/2009/08/Afbeelding-1.png

answered Aug 05 '09 at 10:51

Martijn Thé

4,674
3
29
42

score 2 · Answer 9 · edited Aug 07 '13 at 13:18

2

Check your classes and look under the dealloc method. Make sure you care calling [super dealloc].

I had this exact same problem and found out I was calling [self dealloc] instead. Just not paying attention.

edited Aug 07 '13 at 13:18

Hemang

26,840
19
119
186

answered Nov 11 '10 at 17:27

Wes Duff

373
2
10

Jared Oberhaus · Answer 10 · 2009-06-30T01:07:19.360

0

To find these kinds of memory and pointer problems in general, you want to run your code against a runtime memory error checker like Valgrind. This should be able to point out lots of things your code is doing wrong, beyond those that cause it to crash.

Valgrind can work on OSX (though it says it's "unsupported and incomplete and buggy"), and with a little hacking someone got it to work on iPhone SDK executables.

Even better you can try Instruments, which is part of XCode. There's a tutorial for running it here.

edited Jun 30 '09 at 01:07

answered Jun 29 '09 at 18:29

Jared Oberhaus

14,547
4
56
55

1

instruments is the way to go; use the object alloc instrument and turn on zombies. (or just use the Zombies template). Valgrind is solution of last resort. It is terribly slow and often simply won't work. – bbum Jun 30 '09 at 02:19

score 0 · Answer 11 · edited May 23 '17 at 11:47

0

This is usually caused by some inspector, such as safari or safari preview. Refer to post or post and question.

Remove the select of AutoMatically Show Web ...., will remove this issue.

Note, just close safari or safari preview will not remove this issue. And you have to deselect both of safari and safari preview.

If this will not do, refer to this answer or post to debug it.

edited May 23 '17 at 11:47

Community

1
1

answered May 10 '17 at 07:12

LF00

27,015
29
156
295

score 0 · Answer 12 · edited Aug 07 '13 at 13:19

0

If malloc_error_break is not helping...

The best way to solve this error is to run instruments with the NSZombies turned on. Instruments will flag you when the Zombie is messaged and you can trace directly back to the line of code.

Snow Leopard required, what a lifesaver though!

edited Aug 07 '13 at 13:19

Hemang

26,840
19
119
186

answered May 18 '11 at 19:07

iOSDevSF

1,169
1
13
24

score 0 · Answer 13 · answered Jun 09 '09 at 18:00

In Xcode, click left of the line number to set a breakpoint. Then you can launch it by doing a "Build and Debug".

It is recommended to not have object that you create be autorelease since memory is a commodity on the iPhone. Apple recommends explicitly calling release.

How to find the cause of a malloc "double free" error?

13 Answers13

Adding a symbolic breakpoint in Xcode 4

Linked

Related