Swift malloc_error_break crashes with double free

Question

I'm working on an app that fetches data from a web API. Most of the time, it runs perfectly; however, sometimes I'll received the error:

malloc: *** error for object 0x7fc2b061de30: double free

*** set a breakpoint in malloc_error_break to debug

I've set a malloc_error_break breakpoint, and this shows up when the app crashes, with the first line highlighted:

0x112375760 <+0>:  pushq  %rbp
0x112375761 <+1>:  movq   %rsp, %rbp
0x112375764 <+4>:  nop    
0x112375765 <+5>:  nopl   (%rax)
0x112375769 <+9>:  popq   %rbp
0x11237576a <+10>: retq

I have no clue what any of this means. I've searched stack exchange for hours, but I can't get any help. Once, the error showed up as:

pointer being freed was not allocated

Please don't judge me, but I don't know what a pointer is, what it means to free something, or allocate an object. If anyone wants to give me a quick crash course and/or enlighten me as what my error could be, that would be wonderful.

EDIT: I believe the error may be coming from an UIImageView extension to download an image:

extension UIImageView {
func downloadedFrom(targetURL: NSURL, onCompletion: (UIImage?, NSError?) -> Void) {
    print("downloading image")
    SpotifyAPIManager.sharedInstance.auth.client.get(targetURL.absoluteString, success: { (data, response) in
        print("successfully downloaded image")
        guard (response as NSHTTPURLResponse).statusCode == 200 else  {
            print("error in http response. status code: \((response as NSHTTPURLResponse).statusCode)")
            return
        }

        let image = UIImage(data: data)
        onCompletion(image, nil)
        }, failure: { error in
            print("error while downloading image: \(error)")
    })
}

}

(the auth.client.get is a method from the OAuthSwift framework)

I printed out the backtrace after a crash:

* thread #1: tid = 0x2cbf0, 0x00000001089aa760 libsystem_malloc.dylib`malloc_error_break, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
* frame #0: 0x00000001089aa760 libsystem_malloc.dylib`malloc_error_break
frame #1: 0x00000001089a3270 libsystem_malloc.dylib`szone_error + 406
frame #2: 0x00000001089a4f07 libsystem_malloc.dylib`tiny_malloc_from_free_list + 881
frame #3: 0x00000001089a3685 libsystem_malloc.dylib`szone_malloc_should_clear + 294
frame #4: 0x00000001089ab6e6 libsystem_malloc.dylib`malloc_zone_calloc + 78
frame #5: 0x00000001089abe4f libsystem_malloc.dylib`calloc + 49
frame #6: 0x0000000109bb5ee0 ImageIO`initImageAppleJPEG + 971
frame #7: 0x0000000109bbbc9e ImageIO`_CGImagePluginInitAppleJPEG + 76
frame #8: 0x0000000109af7dff ImageIO`makeImagePlus + 1377
frame #9: 0x0000000109af7282 ImageIO`CGImageSourceCreateImageAtIndex + 184
frame #10: 0x0000000106915ef0 UIKit`_UIImageRefFromData + 423
frame #11: 0x00000001066f5086 UIKit`-[UIImage(UIImagePrivate) _initWithData:preserveScale:cache:] + 124
frame #12: 0x00000001042c7874 Spotify`@nonobjc UIImage.init(data : NSData) -> UIImage? + 36 at SongTableViewCell.swift:0
frame #13: 0x00000001042c73dc Spotify`UIImage.__allocating_init(data : NSData) -> UIImage? + 76 at SongTableViewCell.swift:0
frame #14: 0x00000001042c718b Spotify`UIImageView.(data=142201 bytes, response=0x00007fd62a64bd90, onCompletion=0x00000001042c6ab0 Spotify`partial apply forwarder for reabstraction thunk helper from @callee_unowned @convention(block) (@unowned Swift.Optional<__ObjC.UIImage>, @unowned Swift.Optional<__ObjC.NSError>) -> (@unowned ()) to @callee_owned (@owned Swift.Optional<__ObjC.UIImage>, @owned Swift.Optional<__ObjC.NSError>) -> (@unowned ()) at SongTableViewCell.swift) -> ()) -> ()).(closure #1) + 315 at SongTableViewCell.swift:65
frame #15: 0x00000001042bec63 Spotify`thunk + 35 at SpotifyAPIManager.swift:0
frame #16: 0x00000001042c6891 Spotify`partial apply for thunk + 81 at SongTableViewCell.swift:0
frame #17: 0x0000000108087f86 OAuthSwift`OAuthSwiftHTTPRequest.(data=142201 bytes, response=0x00007fd62a64bd90, error=nil, self=0x00007fd62a636411) -> ()).(closure #1).(closure #1) + 5206 at OAuthSwiftHTTPRequest.swift:149
frame #18: 0x0000000108088ae7 OAuthSwift`thunk + 103 at OAuthSwiftHTTPRequest.swift:0
frame #19: 0x0000000104bebb49 CFNetwork`__75-[__NSURLSessionLocal taskForClass:request:uploadFile:bodyData:completion:]_block_invoke + 19
frame #20: 0x0000000104bfe0f2 CFNetwork`__49-[__NSCFLocalSessionTask _task_onqueue_didFinish]_block_invoke + 302
frame #21: 0x000000010602b630 Foundation`__NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__ + 7
frame #22: 0x0000000105f66805 Foundation`-[NSBlockOperation main] + 101
frame #23: 0x0000000105f49725 Foundation`-[__NSOperationInternal _start:] + 646
frame #24: 0x0000000105f49336 Foundation`__NSOQSchedule_f + 194
frame #25: 0x00000001087b13eb libdispatch.dylib`_dispatch_client_callout + 8
frame #26: 0x00000001087991ef libdispatch.dylib`_dispatch_main_queue_callback_4CF + 1738
frame #27: 0x00000001054430f9 CoreFoundation`__CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9
frame #28: 0x0000000105404b99 CoreFoundation`__CFRunLoopRun + 2073
frame #29: 0x00000001054040f8 CoreFoundation`CFRunLoopRunSpecific + 488
frame #30: 0x0000000109fdead2 GraphicsServices`GSEventRunModal + 161
frame #31: 0x0000000106693f09 UIKit`UIApplicationMain + 171
frame #32: 0x00000001042cbe72 Spotify`main + 114 at AppDelegate.swift:14
frame #33: 0x00000001087e592d libdyld.dylib`start + 1

Once again I have no clue what this means but it could help debug.

Run your app under the Zombies instrument in the Instruments profiler. If that doesn't turn up any problems, run your app with the memory sanitizer enabled. Also, edit your question to include the full backtrace when the breakpoint is hit. You can type bt at the (lldb) prompt to print the backtrace. — rob mayoff
Updated link for the Zombies profiler instructions: help.apple.com/instruments/mac/current/#/dev612e6956 — ConfusionTowers

pbush25 pbush25 · Accepted Answer · 2016-05-05T15:47:35

Without any code to back up your problem it's hard to say exactly what's causing this. As a note of education: Pointers are references to memory allocated on the heap, and many different objects can point to the same memory location. Although Swift doesn't really use pointers, the underlying runtime does, and here, you've tried to access some memory location that the runtime thinks should no longer be allocated within your program's memory. As for the assembly code, that's showing you what's happening in the hardware at the time this is occurring. A brief rundown shows that the hardware is trying to move objects around in memory between the registers, and when it goes to pop to access one of the memory locations dereferenced by what's stored in the register, this is where it crashes. If you can post some code from where you think this might be happening, or from a certain part of the app where it does this frequently, maybe we can be of more help!

Edit: Also as for the actual error message itself: This means that that specific memory location has already been freed (which in this case would mean that the runtime doesn't think you have any more references to any objects that point there, and then it tries to free it again, resulting in the double-free error.

Disclaimer: I know this isn't really an answer, and would be better suited as a comment but it was too long! I wanted to educate OP!

Swift malloc_error_break crashes with double free

1 Answers