Hi, I'm consistently seeing the same message sent in as a crash report from users of an app. It's clear that an object is being over-released but I'm unable to replicate it and I'm looking for tips on tracing the source of it.

The relevant section from the crash report shows this:

Application Specific Information:
objc_msgSend() selector name: release

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib                     0x90892edb objc_msgSend + 27
1   com.apple.CoreFoundation            0x95ec5a40 __CFBasicHashStandardCallback + 384
2   com.apple.CoreFoundation            0x95ec564e __CFBasicHashDrain + 478
3   com.apple.CoreFoundation            0x95ead6f1 _CFRelease + 353
4   com.apple.CoreFoundation            0x95eda0ed _CFAutoreleasePoolPop + 253
5   com.apple.Foundation                0x97ecedd6 NSPopAutoreleasePool + 76
6   com.apple.Foundation                0x97ececfe -[NSAutoreleasePool drain] + 130
7   com.apple.AppKit                    0x9211255f -[NSApplication run] + 1013
8   com.apple.AppKit                    0x9210a535 NSApplicationMain + 574
9   TheApp                          0x000020a6 start + 54

I've used zombies and leaks, but haven't seen anything there. I've gone through the code and can't see it.

What's the next step? Are there any hints I can discern from this information as to the source of it?

Does the fact that this nearly exact same crash report is coming in repeatedly mean that it's the same object that's being over released, or because this is referring to the autorelease pool mean it could be any object?

Does the reference to _CFRelease mean it's a Core Foundation object that's being over released?