NSURLCache crashes with autoreleased objects, but leaks otherwise...

Question

UPDATE: After submitting a radar to Apple it appears that this is a known issue (Radar #7640470).

CSURLCache is designed to cache resources for offline browsing, as NSURLCache only stores data in-memory.

If cachedResponse is autoreleased before returning the application crashes, if not, the objects are simply leaked.

Any light that could be shed onto this would be much appreciated.

Please note stringByEncodingURLEntities is a category method on NSString.

@interface CSURLCache : NSURLCache {} @end

@implementation CSURLCache

- (NSCachedURLResponse *)cachedResponseForRequest:(NSURLRequest *)request
{
    NSString *path = [[NSSearchPathForDirectoriesInDomains(NSCachesDirectory, NSUserDomainMask, YES) lastObject] stringByAppendingPathComponent:[[[request URL] absoluteString] stringByEncodingURLEntities]];

    if ([[NSFileManager defaultManager] fileExistsAtPath:path])
    {
        NSData *data = [[NSData alloc] initWithContentsOfFile:path];
        NSURLResponse *response = [[NSURLResponse alloc] initWithURL:[request URL]
                                                            MIMEType:nil
                                               expectedContentLength:[data length]
                                                    textEncodingName:nil];

        NSCachedURLResponse *cachedResponse = [[NSCachedURLResponse alloc] initWithResponse:response
                                                                                       data:data];
        [response release];
        [data release];

        return cachedResponse;
    }

    return nil;
}

@end

Answer 1

- (NSCachedURLResponse *)cachedResponseForRequest:(NSURLRequest *)request

Well, this isn't an alloc, new, or copy method…

… and CSURLCache doesn't hold on to the object anywhere, so it's not owning it.

So, you need to autorelease it.

Of course, that means the object is doomed unless something retains it. Your app crashed because it tried to use the object after the object died.

Run your app under Instruments with the Zombies template. Look at where the app crashes and what it was doing when cachedResponseForRequest: was called. The caller needs to own the object until the time when the application would crash otherwise, and then release it.

Answer 2

I have the exact same issue.

Autoreleasing the response crashes the client while not autoreleasing it apparently leaks (according to naming convention convention and clang).

My caller is UIWebView so I can't really know what's going on inside there.

Anyone has an idea how to fix this?

Answer 3

I am having the same trouble...

The issue seems to be if you replace sharedCache with a subclass of NSURLCache then the cached response is over released somewhere in foundation (or under retained). You can repeat this yourself:

NSURLCache *replaceCache;
NSString *diskPath = @"/tmp/cacheCrashCache";
const int memoryCapacity = 10000;
const int diskCapacity = 100000;

if(USE_SUBCLASS) // USE_SUBCLASS = YES, then it crashes, USE_SUBCLASS = NO then no crash
{
    replaceCache = [[NSURLCache_Subclass alloc] initWithMemoryCapacity:memoryCapacity diskCapacity:diskCapacity diskPath:diskPath];
}
else {
    replaceCache = [[NSURLCache alloc] initWithMemoryCapacity:memoryCapacity diskCapacity:diskCapacity diskPath:diskPath];
}

[NSURLCache setSharedURLCache:replaceCache];
[replaceCache release];

[[webView mainFrame] loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@"http://www.apple.com"]]];

Webview should be a simple webview (like the demo browser), and NSURLCache_subclass can be a blank subclass of NSURLCache (which should function exactly the same way). With Zombies turned on the error shown is:

2010-08-30 12:57:48.987 CacheCrash[6445:5e03] *** -[Not A Type release]: message sent to deallocated instance 0x1001b3d00

I was able to track down that this is occurring when the NSCacheResponse item is deallocated. So, likely there is something that is being released from NSCacheResponse that isn't properly being retained.

I can't seem to find a work around that doesn't leak. I've even tried making my subclass simply a buffer to pass messages to a legitimate copy of NSURLCache, but this also failed. The only solution seems to leak:

- (NSCachedURLResponse *)cachedResponseForRequest:(NSURLRequest *)request
{
    NSCachedURLResponse *response = [super cachedResponseForRequest:request];

    if(HACK_FIX)
    {
        [response retain];
        return response; // Over-retain
    }
    else
        return response;
}

Anyone have a better fix for this?