title: How to debug EXC_BAD_ACCESS that occurs only on release target for an iPhone app?
body: <p>I'm developing an iPhone application. I have an <code>EXC_BAD_ACCESS</code> that occurs only in the release target; when I build the debug target the exception does not occur. However, when I set the <code>NSZombieEnabled</code> environment variable to <code>YES</code>, I still get the <code>EXC_BAD_ACCESS</code> with no further information. Is it even possible for <code>NSZombieEnabled</code> to work when executing the release target? I don't see why not, since gdb is running in both cases...</p>
  
  <p><strong>Update</strong>: here is a printout of the top of the stack:</p>
  
  <pre><code>#0  0x33369ebc in objc_msgSend ()
  #1  0x3144f968 in -[EAInputStream _streamEventTrigger] ()
  #2  0x3144fe78 in __streamEventTrigger ()
  #3  0x338ae3a6 in CFRunLoopRunSpecific ()
  #4  0x338adc1e in CFRunLoopRunInMode ()
  #5  0x32ed6966 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] ()
  #6  0x00005b06 in -[IOStreamDelegate removeMsg:] (self=0x142cc0, _cmd=&lt;value temporarily unavailable, due to optimizations&gt;, message=0x2fffe544) at /Users/robertmoretti/Documents/XXXXXXX/IOStreamDelegate.m:191
  </code></pre>
  
  <p>Here is a gdb session from inside the objc_msgSend call at the top:</p>
  
  <pre><code>(gdb) p/x $r0
  $6 = 0x3100000
  (gdb) x/s $r1
  0x32d7cff8:  "release"
  (gdb) disassemble $pc
  Dump of assembler code for function objc_msgSend:
  0x33369ea8 &lt;objc_msgSend+0&gt;:    teq r0, #0  ; 0x0
  0x33369eac &lt;objc_msgSend+4&gt;:    moveq   r1, #0  ; 0x0
  0x33369eb0 &lt;objc_msgSend+8&gt;:    bxeq    lr
  0x33369eb4 &lt;objc_msgSend+12&gt;:   push    {r3, r4, r5, r6}
  0x33369eb8 &lt;objc_msgSend+16&gt;:   ldr r4, [r0]
  0x33369ebc &lt;objc_msgSend+20&gt;:   ldr r5, [r4, #8]
  0x33369ec0 &lt;objc_msgSend+24&gt;:   ldr r6, [r5]
  0x33369ec4 &lt;objc_msgSend+28&gt;:   add r3, r5, #8  ; 0x8
  0x33369ec8 &lt;objc_msgSend+32&gt;:   and r5, r6, r1, lsr #2
  0x33369ecc &lt;objc_msgSend+36&gt;:   ldr r4, [r3, r5, lsl #2]
  0x33369ed0 &lt;objc_msgSend+40&gt;:   teq r4, #0  ; 0x0
  0x33369ed4 &lt;objc_msgSend+44&gt;:   add r5, r5, #1  ; 0x1
  0x33369ed8 &lt;objc_msgSend+48&gt;:   beq 0x33369efc &lt;objc_msgSend+84&gt;
  0x33369edc &lt;objc_msgSend+52&gt;:   ldr r12, [r4]
  0x33369ee0 &lt;objc_msgSend+56&gt;:   teq r1, r12
  0x33369ee4 &lt;objc_msgSend+60&gt;:   and r5, r5, r6
  0x33369ee8 &lt;objc_msgSend+64&gt;:   bne 0x33369ecc &lt;objc_msgSend+36&gt;
  0x33369eec &lt;objc_msgSend+68&gt;:   ldr r12, [r4, #8]
  0x33369ef0 &lt;objc_msgSend+72&gt;:   teq r4, r4
  0x33369ef4 &lt;objc_msgSend+76&gt;:   pop {r3, r4, r5, r6}
  0x33369ef8 &lt;objc_msgSend+80&gt;:   bx  r12
  0x33369efc &lt;objc_msgSend+84&gt;:   pop {r3, r4, r5, r6}
  0x33369f00 &lt;objc_msgSend+88&gt;:   b   0x33369f04 &lt;objc_msgSend_uncached&gt;
  End of assembler dump.
  (gdb) p/x *$r0
  $9 = 0x0
  </code></pre>
  
  <p>The exception occurs on the line <code>0x33369ebc &lt;objc_msgSend+20&gt;: ldr r5, [r4, #8]</code>. <code>r4</code> has just been given the value pointed to by <code>r0</code>, which happens to be 0. I am wondering what is supposed to be in the memory region of <code>0x3100000</code>. Here's a memory dump of that area:</p>
  
  <pre><code>(gdb) x/256w 0x3100000
  0x3100000:  0x00000000  0x0000a293  0xaa650505  0x00000000
  0x3100010:  0x0000a294  0xaa670505  0x00000000  0x0000a295
  0x3100020:  0xaa690505  0x00000000  0x0000a296  0xaa6b0505
  0x3100030:  0x00000000  0x0000a297  0xaa6d0505  0x00000000
  0x3100040:  0x0000a298  0xaa6f0505  0x00000000  0x0000a299
  0x3100050:  0xaa710505  0x00000000  0x0000a29a  0xaa730505
  0x3100060:  0x00000000  0x0000a29b  0xaa750505  0x00000000
  0x3100070:  0x0000a29c  0xaa770505  0x00000000  0x0000a29d
  0x3100080:  0xaa790505  0x00000000  0x0000a29e  0xaa7b0505
  0x3100090:  0x00000000  0x0000a29f  0xaa7d0505  0x00000000
  0x31000a0:  0x0000a2a0  0xaa7f0505  0x00000000  0x0000a2a1
  0x31000b0:  0xaa810505  0x00000000  0x0000a2a2  0xaa830505
  0x31000c0:  0x00000000  0x0000a2a3  0xaa850505  0x00000000
  0x31000d0:  0x0000a2a4  0xaa870505  0x00000000  0x0000a2a5
  0x31000e0:  0xaa890505  0x00000000  0x0000a2a6  0xaa8b0505
  0x31000f0:  0x00000000  0x0000a2a7  0xaa8d0505  0x00000000
  0x3100100:  0x0000a2a8  0xaa8f0505  0x00000000  0x0000a2a9
  0x3100110:  0xaa910505  0x00000000  0x0000a2aa  0xaa930505
  0x3100120:  0x00000000  0x0000a2ab  0xaa950505  0x00000000
  0x3100130:  0x0000a2ac  0xaa970505  0x00000000  0x0000a2ad
  0x3100140:  0xaa990505  0x00000000  0x0000a2ae  0xaa9b0505
  0x3100150:  0x00000000  0x0000a2af  0xaa9d0505  0x00000000
  0x3100160:  0x0000a2b0  0xaa9f0505  0x00000000  0x0000a2b1
  0x3100170:  0xaaa10505  0x00000000  0x0000a2b2  0xaaa30505
  0x3100180:  0x00000000  0x0000a2b3  0xaaa50505  0x00000000
  0x3100190:  0x0000a2b4  0xaaa70505  0x00000000  0x0000a2b5
  0x31001a0:  0xaaa90505  0x00000000  0x0000a2b6  0xaaab0505
  0x31001b0:  0x00000000  0x0000a2b7  0xaaad0505  0x00000000
  0x31001c0:  0x0000a2b8  0xaaaf0505  0x00000000  0x0000a2b9
  0x31001d0:  0xaab10505  0x00000000  0x0000a2ba  0xaab30505
  0x31001e0:  0x00000000  0x0000a2bb  0xaab50505  0x00000000
  0x31001f0:  0x0000a2bc  0xaab70505  0x00000000  0x0000a2bd
  0x3100200:  0xaab90505  0x00000000  0x0000a2be  0xaabb0505
  0x3100210:  0x00000000  0x0000a2bf  0xaabd0505  0x00000000
  0x3100220:  0x0000a2c0  0xaabf0505  0x00000000  0x0000a2c1
  0x3100230:  0xaac10505  0x00000000  0x0000a2c2  0xaac30505
  0x3100240:  0x00000000  0x0000a2c3  0xaac50505  0x00000000
  0x3100250:  0x0000a2c4  0xaac70505  0x00000000  0x0000a2c5
  0x3100260:  0xaac90505  0x00000000  0x0000a2c6  0xaacb0505
  0x3100270:  0x00000000  0x0000a2c7  0xaacd0505  0x00000000
  0x3100280:  0x0000a2c8  0xaacf0505  0x00000000  0x0000a2c9
  0x3100290:  0xaad10505  0x00000000  0x0000a2ca  0xaad30505
  0x31002a0:  0x00000000  0x0000a2cb  0xaad50505  0x00000000
  0x31002b0:  0x0000a2cc  0xaad70505  0x00000000  0x0000a2cd
  0x31002c0:  0xaad90505  0x00000000  0x0000a2ce  0xaadb0505
  0x31002d0:  0x00000000  0x0000a2cf  0xaadd0505  0x00000000
  0x31002e0:  0x0000a2d0  0xaadf0505  0x00000000  0x0000a2d1
  0x31002f0:  0xaae10505  0x00000000  0x0000a2d2  0xaae30505
  0x3100300:  0x00000000  0x0000a2d3  0xaae50505  0x00000000
  0x3100310:  0x0000a2d4  0xaae70505  0x00000000  0x0000a2d5
  0x3100320:  0xaae90505  0x00000000  0x0000a2d6  0xaaeb0505
  0x3100330:  0x00000000  0x0000a2d7  0xaaed0505  0x00000000
  0x3100340:  0x0000a2d8  0xaaef0505  0x00000000  0x0000a2d9
  0x3100350:  0xaaf10505  0x00000000  0x0000a2da  0xaaf30505
  0x3100360:  0x00000000  0x0000a2db  0xaaf50505  0x00000000
  0x3100370:  0x0000a2dc  0xaaf70505  0x00000000  0x0000a2dd
  0x3100380:  0xaaf90505  0x00000000  0x0000a2de  0xaafb0505
  0x3100390:  0x00000000  0x0000a2df  0xaafd0505  0x00000000
  0x31003a0:  0x0000a2e0  0xab050505  0x00000000  0x0000a2e1
  0x31003b0:  0xab070505  0x00000000  0x0000a2e2  0xab090505
  0x31003c0:  0x00000000  0x0000a2e3  0xab0b0505  0x00000000
  0x31003d0:  0x0000a2e4  0xab0d0505  0x00000000  0x0000a2e5
  0x31003e0:  0xab0f0505  0x00000000  0x0000a2e6  0xab110505
  0x31003f0:  0x00000000  0x0000a2e7  0xab130505  0x00000000
  </code></pre>
  
  <p>I don't really know what else to try; hopefully someone with more iphone experience will be able to recognize this memory as something meaningful.</p>
  
  <p><strong>Update 2:</strong> I just discovered that the problem only occurs when compiling with -O2, -O3, and -Os. Not sure what that implies.</p>