unusual behavior of NSArray

Question

I have following code

NSArray *myArray = [[NSArray alloc] initWithObjects:@"1",@"2",nil];
NSMutableDictionary *dic0 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag", @"name", myArray, @"arraye",nil];
NSMutableDictionary *dic1 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag1", @"name", myArray, @"arrayr",nil];
NSMutableDictionary *dic2 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag2", @"name", myArray, @"arrayq",nil];
NSMutableDictionary *dic3 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag2", @"name", myArray, @"arrayqe",nil];
NSArray *array12424 = [[NSArray alloc] initWithObjects:dic0, dic1, dic2, dic3];

NSLog(@"array12424 %d", [array12424 retainCount]);
NSLog(@"array12424 %@", array12424);
int j = [myArray retainCount];
for(int i=0;i<j; ++i)
{
    [myArray release];
        NSLog(@"%d", i);
    NSLog(@"myArray %@", myArray);
}

NSLog(@"array12424 %@", array12424);  

After releasing myArray,i expected crash; why arraye and other array key are pointing to array12424?

//output  

  2012-02-02 12:33:58.454 212121212[6924:a0f] array12424 1
    2012-02-02 12:33:58.459 212121212[6924:a0f] array12424 (
            {
            arraye =         (
                1,
                2
            );
            name = parag;
        },
            {
            arrayr =         (
                1,
                2
            );
            name = parag1;
        },
            {
            arrayq =         (
                1,
                2
            );
            name = parag2;
        },
            {
            arrayqe =         (
                1,
                2
            );
            name = parag2;
        }
    )
    2012-02-02 12:33:58.459 212121212[6924:a0f] 0
    2012-02-02 12:33:58.460 212121212[6924:a0f] myArray (
        1,
        2
    )
    2012-02-02 12:33:58.460 212121212[6924:a0f] 1
    2012-02-02 12:33:58.460 212121212[6924:a0f] myArray (
        1,
        2
    )
    2012-02-02 12:33:58.461 212121212[6924:a0f] 2
    2012-02-02 12:33:58.462 212121212[6924:a0f] myArray (
        1,
        2
    )
    2012-02-02 12:33:58.463 212121212[6924:a0f] 3
    2012-02-02 12:33:58.463 212121212[6924:a0f] myArray (
        1,
        2
    )
    2012-02-02 12:33:58.464 212121212[6924:a0f] 4
    2012-02-02 12:33:58.466 212121212[6924:a0f] myArray myArray 
    2012-02-02 12:33:58.466 212121212[6924:a0f] array12424 (
            {
            arraye = "array12424 ";
            name = parag;
        },
            {
            arrayr = "array12424 ";
            name = parag1;
        },
            {
            arrayq = "array12424 ";
            name = parag2;
        },
            {
            arrayqe = "array12424 ";
            name = parag2;
        }
    )

I am using MAC osx 10.6 base SDK.

Answer 1

0) Do not use retainCount.

1) Cocoa Collections retain their contents, then release them when they are removed, or when the collection is destroyed. Furthermore there's no documentation which explicitly states the APIs you call through will not autorelease their arguments.

2) You don't initialize your array correctly -- it must be nil terminated: NSArray *array12424 = [[NSArray alloc] initWithObjects:dic0, dic1, dic2, dic3];

3) Simply put, it does not matter -- It's Undefined Behavior. The result cannot be predicted (unless it involves raptors). It crashes in other OS versions. It crashes as you'd expect with GuardMalloc enabled. It crashes shortly afterwards (provided you're lucky).

Answer 2

Take 2, let's take you through the code with more detail. First we need to fix the 3 warnings, and beef up the logging:

+ (void) test
{
   NSArray *myArray = [[NSArray alloc] initWithObjects:@"1",@"2",nil];
   NSMutableDictionary *dic0 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag", @"name", myArray, @"arraye",nil];
   NSMutableDictionary *dic1 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag1", @"name", myArray, @"arrayr",nil];
   NSMutableDictionary *dic2 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag2", @"name", myArray, @"arrayq",nil];
   NSMutableDictionary *dic3 = [[NSMutableDictionary alloc] initWithObjectsAndKeys:@"parag2", @"name", myArray, @"arrayqe",nil];
   NSArray *array12424 = [[NSArray alloc] initWithObjects:dic0, dic1, dic2, dic3, nil];

   NSLog(@"array12424 %lu", [array12424 retainCount]);
   NSLog(@"array12424 %p, %@", array12424, array12424);
   NSUInteger j = [myArray retainCount];
   for(NSUInteger i=0;i<j; ++i)
   {
      NSLog(@"%lu, %lx", i, [myArray retainCount]);
      [myArray release];
      NSLog(@"%lu, %lx", i, [myArray retainCount]);
      NSLog(@"myArray %p, %@", myArray, myArray);           // breakpoint here
   }

   NSLog(@"array12424 %p, %@", array12424, array12424);  
}

Put a breakpoint on the indicated line and call that method.

When you hit the breakpoint the first time you'll see the following on the console:

2012-02-03 07:36:34.651 sandpit[32581:903] array12424 1
2012-02-03 07:36:34.659 sandpit[32581:903] array12424 0x100176820, (
        {
        arraye =         (
            1,
            2
        );
        name = parag;
    },
        {
        arrayr =         (
            1,
            2
        );
        name = parag1;
    },
        {
        arrayq =         (
            1,
            2
        );
        name = parag2;
    },
        {
        arrayqe =         (
            1,
            2
        );
        name = parag2;
    }
)
2012-02-03 07:36:34.660 sandpit[32581:903] 0, 5
2012-02-03 07:36:34.661 sandpit[32581:903] 0, 4

Looking at the last put one line first we see the retain count is 5. Now we created and own the array - that's 1 - and we've added it to 4 dictionaries and they retain their arguments - that's the other 4. Could any of that 5 actually be misleading, could there be a pending autorelease or two around which will make it drop? Well in this case we can determine not as we've not autoreleased and collections retain their arguments.

In the debugger variable display look at the entry for myArray

myArray = (NSCFArray *) 0x100513aa0 2 objects

This tells us that the Obj-C object referenced my myArray is indeed an array and its located at memory address 0x100513aa0 and contains two items. You'll see that address in the console as a result of adding '%p' to some of the NSLog's.

Now press continue a few times until the last console output is:

2012-02-03 07:37:33.074 sandpit[32581:903] 4, 1
2012-02-03 07:37:33.074 sandpit[32581:903] 4, fffffffffffffff

Now you can see why I used `%lx' to print out the retain count rather than '%lu' which matches its type (unsigned 64-bit integer). The retain count has apparently gone negative!

What has really happened is the immediately preceding release sent the count to 0 and then the memory became free for re-use - and all those NSLog's are formatting strings and require memory so there is some churn going on.

Now look at the myArray entry in the debugger - does it still say it is an array with 2 objects in it? Probably not. I've run this code in various guises and it has thought it is an empty array, an array with 2 nulls, a string... and what did you see in the question - strings in the NSLog output... It's pointing to freed memory, it could contain anything.

There is NO memory safety in Obj-C, you can read and write all over memory as much as you like. There is no guarantee that doing something like over-releasing memory will result in an immediate crash, or indeed any crash at all, but the application will most likely malfunction in some way.

HTH.

If you want to dig deeper you could write your own code to print the dictionaries displaying the addresses (using '%p') of the contained objects, or just dig into the dictionaries in the debugger, so you can see the sharing.

And the obligatory health warning: retainCount can be helpful while learning but never, ever, use it in real code to determine whether something needs to be released as there may be pending decrements (from autoreleases) you don't know about.

Answer 3

First add nil at this statement

NSArray *array12424 = [[NSArray alloc] initWithObjects:dic0, dic1, dic2, dic3,nil];

now coming to your crash just change this code

for(int i=0;i<j; ++i)
{
    [myArray release];
    NSLog(@"%d", i);
    NSLog(@"let the system remove this array, give him some time dude to remove it, then see what happens");
    NSLog(@"myArray %@", myArray);
}

Answer 4

I am assuming this question is to understand cocoa internal working ...

retain count 0 does not mean object get deleted ... cocoa internally has its own logic to call dealloc on the object after retain count reaches to 0.

you can try calling last statement in different event context ... normally object use to be get deleted after its event context.

Answer 5

My guess is you are trying to understand memory allocation & deallocation and this isn't code you intend to put in a real application.

In that case try exploring by printing object references with the %p format - this will print the address of the object. You will then be able to see what objects are really shared (rather than just have the same contents) and when memory gets reused, etc. Or use the debugger to give you the same thing.

The general advice to avoid retainCount can be waived will while exploring.