Open Radar

 
Summary:
Calling -cancel on a MKMapSnapshotter instance randomly causes an EXC_BAD_ACCESS on a background thread

The number of iterations required for the crash to occur seems to be random, sometimes it takes a couple, other times hundreds...

Having a bad connection (or setting the Network Link Conditioner to 100% loss) seems to increase the odds of it happening.

Steps to Reproduce:
Sample code

- (void)execute
{
    [_snapshotter cancel];
    MKMapSnapshotOptions *options = [MKMapSnapshotOptions new];
    options.region = MKCoordinateRegionMakeWithDistance(CLLocationCoordinate2DMake(arc4random_uniform(90), arc4random_uniform(90)), 1000, 1000);
    _snapshotter = [[MKMapSnapshotter alloc] initWithOptions:options];
    [_snapshotter startWithCompletionHandler:^(MKMapSnapshot *snapshot, NSError *error) {
        NSLog(@"yeah");
    }];
    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(0.2 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
        [self execute];
    });
}

Expected Results:
Snapshotter is canceled and no crash

Actual Results:
EXC_BAD_ACCESS

Thread 5 Crashed:
0   libsystem_kernel.dylib        	0x39e0e1f0 __pthread_kill + 8
1   libsystem_pthread.dylib       	0x39e78792 pthread_kill + 54
2   libsystem_c.dylib             	0x39dbefd8 abort + 72
3   libc++abi.dylib               	0x390edcd2 abort_message + 70
4   libc++abi.dylib               	0x391066e0 default_terminate_handler() + 248
5   libobjc.A.dylib               	0x3984bf62 _objc_terminate() + 190
6   libc++abi.dylib               	0x391041c4 std::__terminate(void (*)()) + 76
7   libc++abi.dylib               	0x39103a18 __cxa_throw + 112
8   libobjc.A.dylib               	0x3984bd9e objc_exception_throw + 246
9   CoreFoundation                	0x2f0a0962 -[NSObject(NSObject) doesNotRecognizeSelector:] + 198
10  CoreFoundation                	0x2f09f24e ___forwarding___ + 702
11  CoreFoundation                	0x2efee7b4 _CF_forwarding_prep_0 + 20
12  VectorKit                     	0x36d7189a -[VKTileProvider changeTileForKey:toState:withMetadata:withTile:forLayer:] + 46
13  VectorKit                     	0x36dc19e0 -[VKTileProvider tileSource:invalidateKeys:] + 164
14  VectorKit                     	0x36ddf5ec -[VKTileSource didFailToLoadTileKey:error:] + 192
15  GeoServices                   	0x33d591fe ___ZN8LoadItem15deleteRequesterEP8NSStringbb_block_invoke + 86
16  libdispatch.dylib             	0x39d33830 _dispatch_call_block_and_release + 8
17  libdispatch.dylib             	0x39d33de8 _dispatch_queue_drain$VARIANT$up + 440
18  libdispatch.dylib             	0x39d34292 _dispatch_queue_invoke$VARIANT$up + 34
19  libdispatch.dylib             	0x39d4688a _dispatch_root_queue_drain + 74
20  libdispatch.dylib             	0x39d46b1c _dispatch_worker_thread2 + 52
21  libsystem_pthread.dylib       	0x39e75bd0 _pthread_wqthread + 296
22  libsystem_pthread.dylib       	0x39e75a94 start_wqthread + 4

==========================

Thread 2 Crashed:
0   libobjc.A.dylib               	0x39855626 objc_msgSend + 6
1   VectorKit                     	0x36d7189a -[VKTileProvider changeTileForKey:toState:withMetadata:withTile:forLayer:] + 46
2   VectorKit                     	0x36dc19e0 -[VKTileProvider tileSource:invalidateKeys:] + 164
3   VectorKit                     	0x36ddf5ec -[VKTileSource didFailToLoadTileKey:error:] + 192
4   GeoServices                   	0x33d591fe ___ZN8LoadItem15deleteRequesterEP8NSStringbb_block_invoke + 86
5   libdispatch.dylib             	0x39d33830 _dispatch_call_block_and_release + 8
6   libdispatch.dylib             	0x39d33de8 _dispatch_queue_drain$VARIANT$up + 440
7   libdispatch.dylib             	0x39d34292 _dispatch_queue_invoke$VARIANT$up + 34
8   libdispatch.dylib             	0x39d4688a _dispatch_root_queue_drain + 74
9   libdispatch.dylib             	0x39d46b1c _dispatch_worker_thread2 + 52
10  libsystem_pthread.dylib       	0x39e75bd0 _pthread_wqthread + 296
11  libsystem_pthread.dylib       	0x39e75a94 start_wqthread + 4