Question

I’m initializing a C array of objects and setting the first element:

id __strong *_objs =  (id __strong *)calloc(16,sizeof(*_objs));
_objs[0] = @1;
_count++;

Then I’m using the following implementation of NSFastEnumeration:

- (NSUInteger) countByEnumeratingWithState: (NSFastEnumerationState*)state
                                   objects: (id __unsafe_unretained*)stackbuf
                                     count: (NSUInteger)len
{
    NSUInteger size = _count;
    NSInteger count;
    state->mutationsPtr = (unsigned long *)size;
    count = MIN(len, size - state->state);
    if (count > 0)
    {
        IMP imp = [self methodForSelector: @selector(objectAtIndex:)];
        int p = state->state;
        int i;
        for (i = 0; i < count; i++, p++) {
            stackbuf[i] = (*imp)(self, @selector(objectAtIndex:), p);
        }
        state->state += count;
    }
    else
    {
        count = 0;
    }
    state->itemsPtr = stackbuf;
    return count;
}

Unfortunately it crashes with EXC_BAD_ACCESS when I run it:

for (id object in array){  // EXC_BAD_ACCESS
    NSLog(@"%@",object)
}

Any idea why?

If you have CodeRunner, here is an executable version.

Answer 1

The problem is the mutationsPtr which points to the memory address 1 which you are not allowed to access (and which is not 4 byte aligned as well):

state->mutationsPtr = (unsigned long *)size;

Replace it with a valid pointer for starters (careful: the one below may make no sense at all in your scenario, but at least it fixes the EXC_BAD_ACCESS):

state->mutationsPtr = (unsigned long *)&_count;