How can an array contain a deallocated object?

[wjkoontz]

I have a weird memory management problem.
I have created an NSMutableArray called "internalExpression" into which I store some objects (NSString's and NSNumber's).
I expose it as a read-only property called expression whose getter returns a NSArray copy:
@interface CalculatorBrain : NSObject {
@private
NSMutableArray *internalExpression;
}
@property (readonly) id expression;

Getter:
- (id)expression
{
NSArray *anExpression = [internalExpression copy];
[anExpression autorelease];
return anExpression;
}

Everything works fine, but after several times it crashes in the getter trying to copy the array.
I enabled NSZombie and found that the "internalExpression" array contains 4 objects, but the last one is a ZOMBIE!
How can an array contain a zombie?!
If I add an object to the array, the array should retain it.
How then do I end up with a 4 element array, with 3 good elements and 1 that has a release count of 0 ?
Here is what I see in Debug for internalExpression:
Early in run:
(gdb) po brain.internalExpression
<__NSArrayM 0x4b8fdb0>(
3,
+,
%x,
=
)

After crash in local window:
internalExpression __NSArrayM * 0x4b8fdb0
0 NSCFNumber * 0x4bbe010
1 NSCFString * 0x638ed00
2 NSCFString * 0x4bbe5a0
3 _NSZombie_CFString * 0x638f250

Somehow the string containing the "=" sign has been released.
Nowhere in my code do I remove objects from the array.
I add them, and whenever I'm done with the array I release the whole array.
However I have NOT done that between those two outputs (If I had the other 3 array elements would also have been gone).

[Domele]

Post your code that you are using to insert objects into internal expression.

[wjkoontz]

Originally Posted by Domele

Post your code that you are using to insert objects into internal expression.

For anyone experiencing similar problem, go back and comment out a bunch of calls to release (or all of them) and of course the problem will clear, and you will leak memory.
Now put them back one at at time, and it should help narrow down.
In my case there was two that would cause it.

I was releasing one of the strings I had put into the array.
I didn't need to because I didn't ever really own the string, it was a mutable copy, and I had put a pointer to it into a mutable array, then put a copy into an array, then released the second array, and released the string. OOPS, that's 2 releases for that string, so the original array lost one of its retain counts!

So it certainly is possible for an array to lose one of its members, if the member is also owned by anyone else who calls release too many times.