I am using box2d and have bodies that I am destroying out of the world time step (having marked them flagged them for removal) and yet the contact listener is still crashing due to getting contacts that are referencing these bodies.
This is what is done in the presolve and begin contact methods of the contact listener:
const b2Body* bodyA = contact->GetFixtureA()->GetBody();
const b2Body* bodyB = contact->GetFixtureB()->GetBody();
Object * objectA = (Object*)bodyA->GetUserData();
Object * objectB = (Object*)bodyB->GetUserData();
Either objectA or objectB are actually pointers to nonsense because the object has been removed (outside of the world time step). Appears that bad contacts are being created or contacts that should no longer exist still do.
Update
I have changed the code out of the world step to ensure and validate the correct bodies are being destroyed (as well their container's body) and find that the contact listener is still attempting to processing contacts that should not exist. I happen to be on iOS/Xcode and enable NSZombie and do indeed find the contact body userdata are deallocated objects (message sent to deallocated instance). Checking the Box2d source I find the contacts are indeed destroyed when the body is destroyed. I'll have to go through more Box2D code or just change my code to somehow work around these mysterious contacts the listener receives.
When I test setting the userdata for the body to null (again, outside the world step) the contacts that I receive in the contact listener for this body (when I check it in the contact listener) do not have null userdata.