Analyzing NSZombie

I keep getting bad instruction or bad exception so I enabled NSZombieEnabled and the other vars needed, and I have no idea how to analyze the results. This is what was logged:

ToDoWall(1634) malloc: recording malloc stacks to disk using standard recorder
ToDoWall(1634) malloc: stack logging compaction turned off; size of log files on disk can increase rapidly
ToDoWall(1634) malloc: process 1623 no longer exists, stack logs deleted from /tmp/stack-logs.1623.ToDoWall.iCfMUD.index
ToDoWall(1634) malloc: stack logs being written into /tmp/stack-logs.1634.ToDoWall.8UpPt8.index
2010-07-06 13:25:47.018 ToDoWall[1634:207] *** -[CALayer release]: message sent to deallocated instance 0x39361c0

(gdb) shell malloc_history 1634 0x39361c0

ALLOC 0x39361c0-0x39361df [size=32]: thread_a06c9500 |start | main | UIApplicationMain | -[UIApplication _run] | CFRunLoopRunInMode | CFRunLoopRunSpecific | PurpleEventCallback | _UIApplicationHandleEvent | -[UIApplication sendEvent:] | -[UIApplication handleEvent:withNewEvent:] | -[UIApplication _reportAppLaunchFinished] | CA::Transaction::commit() | CA::Context::commit_transaction(CA::Transaction*) | CALayerDisplayIfNeeded | -[CAL开发者_高级运维ayer _display] | CABackingStoreUpdate | backing_callback(CGContext*, void*) | -[CALayer drawInContext:] | -[UIView(CALayerDelegate) drawLayer:inContext:] | -[UINavigationItemView drawRect:] | -[UINavigationItemView drawText:inRect:] | -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:] | -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:letterSpacing:includeEmoji:] | -[NSString(WebStringDrawing) _web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:] | drawAtPoint(WebCore::String const&, WebCore::FloatPoint const&, WebCore::Font const&, WebCore::GraphicsContext*, WebCore::BidiStatus*, int) | WebCore::Font::drawSimpleText(WebCore::GraphicsContext*, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int) const | WebCore::Font::drawGlyphBuffer(WebCore::GraphicsContext*, WebCore::GlyphBuffer const&, WebCore::TextRun const&, WebCore::FloatPoint&) const | WebCore::Font::drawGlyphs(WebCore::GraphicsContext*, WebCore::SimpleFontData const*, WebCore::GlyphBuffer const&, int, int, WebCore::FloatPoint const&, bool) const | CGContextShowGlyphsWithAdvances | draw_glyphs | ripc_DrawGlyphs | ripc_RenderGlyphs | CGGlyphLockUnlock | add_bitmaps_to_cache | CGFontCacheSetValues | CGFontCacheSetValue | calloc | malloc_zone_calloc 
----
FREE  0x39361c0-0x39361df [size=32]: thread_a06c9500 |start | main | UIApplicationMain | GSEventRun | GSEventRunModal | CFRunLoopRunInMode | CFRunLoopRunSpecific | __CFRunLoopDoObservers | CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) | CA::Transaction::commit() | CA::Context::commit_transaction(CA::Transaction*) | CALayerDisplayIfNeeded | -[CALayer _display] | CABackingStoreUpdate | backing_callback(CGContext*, void*) | -[CALayer drawInContext:] | -[UIView(CALayerDelegate) drawLayer:inContext:] | -[UILabel drawTextInRect:] | -[UILabel _drawTextInRect:baselineCalculationOnly:] | -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:] | -[NSString(UIStringDrawing) drawAtPoint:forWidth:withFont:lineBreakMode:letterSpacing:includeEmoji:] | -[NSString(WebStringDrawing) _web_drawAtPoint:forWidth:withFont:ellipsis:letterSpacing:includeEmoji:] | drawAtPoint(WebCore::String const&, WebCore::FloatPoint const&, WebCore::Font const&, WebCore::GraphicsContext*, WebCore::BidiStatus*, int) | WebCore::Font::drawSimpleText(WebCore::GraphicsContext*, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int) const | WebCore::Font::drawGlyphBuffer(WebCore::GraphicsContext*, WebCore::GlyphBuffer const&, WebCore::TextRun const&, WebCore::FloatPoint&) const | WebCore::Font::drawGlyphs(WebCore::GraphicsContext*, WebCore::SimpleFontData const*, WebCore::GlyphBuffer const&, int, int, WebCore::FloatPoint const&, bool) const | CGContextShowGlyphsWithAdvances | draw_glyphs | ripc_DrawGlyphs | ripc_RenderGlyphs | CGGlyphLockUnlock | CGFontCacheUnlock | expire_glyphs_nl | evict_glyph_entry_from_cache | free 

ALLOC 0x39361c0-0x39361ef [size=48]: thread_a06c9500 |start | main | UIApplicationMain | GSEventRun | GSEventRunModal | CFRunLoopRunInMode | CFRunLoopRunSpecific | PurpleEventCallback | _UIApplicationHandleEvent | -[UIApplication sendEvent:] | -[UIWindow _sendTouchesForEvent:] | -[UIControl touchesEnded:withEvent:] | -[UIControl(Internal) _sendActionsForEvents:withEvent:] | -[UIControl sendAction:to:forEvent:] | -[UIApplication sendAction:to:from:forEvent:] | -[RootViewController changeFont] | -[UINavigationController pushViewController:animated:] | -[UINavigationController pushViewController:transition:forceImmediate:] | -[UINavigationController _startDeferredTransitionIfNeeded] | -[UINavigationController _startTransition:fromViewController:toViewController:] | -[UINavigationController _layoutViewController:] | -[UINavigationController _computeAndApplyScrollContentInsetDeltaForViewController:] | -[UIViewController contentScrollView] | -[UIViewController view] | -[UIViewController loadView] | -[UIViewController _loadViewFromNibNamed:bundle:] | -[NSBundle(NSBundleAdditions) loadNibNamed:owner:options:] | -[UINib instantiateWithOptions:owner:loadingResourcesFromBundle:] | _decodeObject | _decodeObjectBinary | -[NSArray(NSArray) initWithCoder:] | -[NSKeyedUnarchiver _decodeArrayOfObjectsForKey:] | _decodeObjectBinary | -[UIRuntimeConnection initWithCoder:] | _decodeObject | _decodeObjectBinary | -[UITextView initWithCoder:] | -[UIScrollView initWithCoder:] | -[UIView initWithCoder:] | UIViewCommonInitWithFrame | -[UIView _createLayerWithFrame:] | +[NSObject alloc] | +[NSObject allocWithZone:] | _internal_class_createInstance | _internal_class_createInstanceFromZone | calloc | malloc_zone_calloc 

UPDATE:

I think I found the source of the problem.

- (IBAction)changeBackground {
    BackgroundTableViewController *viewController = [[BackgroundTableViewController alloc] init];
    NSLog(@"%d",[viewController retainCount]);
    [viewController setTitle:@"Change Background"];
    NSLog(@"%d",[viewController retainCount]);
    [[self navigationController] pushViewController:viewController animated:YES];
    NSLog(@"%d",[viewController retainCount]);
    [viewController release];
    NSLog(@"%d",[viewController retainCount]);
}

The retainCounts are logged as: 1 1 5 4

I don't get why pushing the viewController jumps the retainCount up to 5 =\

All the "malloc: ..." statements appear to be fine.

The issue is that you're releasing a CALayer that hasn't been retain'd. Read up on memory management in Cocoa.

Without a code excerpt, I can't help you any further.