Why is this an over-release of CTFrame

Question

Working with some CoreText code on iOS and I am confused as to why this is an overrelease of the CTFrame. I have confirmed it is an over-release but I am baffled because it is created with a create method.

for (NSValue *value in [self frameArray]) {
  CGRect column = [value CGRectValue];
  CGMutablePathRef path = CGPathCreateMutable();
  CGPathAddRect(path, NULL, column);
  CTFrameRef frame = CTFramesetterCreateFrame(bodyFramesetter, CFRangeMake(position, 0), path, NULL);
  CTFrameDraw(frame, context);
  position += CTFrameGetVisibleStringRange(frame).length;
  CGPathRelease(path);
  // ???: Why does this cause an overrelease?
  //CFRelease(frame);
}

Update

The code base is 3.2 and the crash does not occur on the first release. It occurs "randomly" at some point while drawing the view. This loop, as you can probably guess is in the -drawRect: of the view. There is no multi-threading in this application.

Answer 1

Turns out that Jason was on the right track and that the issue was passing in a empty framesetter to the CTFramesetterCreateFrame function which then returned NULL.