Open Radar

 
Summary:
The code below will crash right away - every time.

Steps to Reproduce:
Execute this code targeting Mac or iOS.

#import <Foundation/Foundation.h>

@interface TestObject : NSObject
@property NSString *foo;
@end

@implementation TestObject

- (id)init {
    self = [super init];
    // Start a bunch of work hitting the property
    dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
        while (YES) {
            self.foo = @"ouch";
        }
    });

    // Start work that will constantly observe and unobserve the property
    [self observe];
    return self;
}

- (void)observe {
    [self addObserver:self forKeyPath:@"foo" options:0 context:NULL];
    [self removeObserver:self forKeyPath:@"foo"];
    dispatch_async(dispatch_get_main_queue(), ^{
        [self observe];
    });
}

@end

int main(int argc, const char * argv[]) {
    TestObject *t = [[TestObject alloc] init];
    CFRunLoopRunInMode(kCFRunLoopDefaultMode, 10000, false);
    return 0;
}

Expected Results:
No crash

Actual Results:
Crash with the following stack
* thread #2: tid = 0xfe278, 0x00007fff84092097 libobjc.A.dylib`objc_msgSend + 23, queue = 'com.apple.root.default-priority', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
    frame #0: 0x00007fff84092097 libobjc.A.dylib`objc_msgSend + 23
    frame #1: 0x00007fff8493cb11 CoreFoundation`CFDictionaryGetValue + 145
    frame #2: 0x00007fff89078da0 Foundation`_NSSetObjectValueAndNotify + 144
  * frame #3: 0x0000000100001a85 testy2`__18-[TestObject init]_block_invoke(.block_descriptor=<unavailable>) + 53 at main.m:14

Version:
iOS 8

Notes:
It is obviously impractical to expect observers to serialize their observation/unobservation with respect to the internal mutation of property in another class. 

Configuration:
Doesn't matter. Easily repros on any iOS simulator or when targeting Mac as well.

Attachments: