Objective-C ARC, blocks and Swift interop

cycle.m, a recorded program of this lesson, creates seven objects that it counts, and four of them are still alive when it ends: each is held, through a property or a block, in a ring of references that ARCARC (automatic reference counting): Objective-C memory management in which the compiler inserts the retain and release calls, so that an object lives while a strong reference to it exists and is freed after the last one goes. It does not collect reference cycles. never breaks. clang warned about one of those rings and said nothing about another that leaks in exactly the same way.

This lesson covers the parts of Objective-C where Swift habits help least. You will follow ARC as it frees objects, find and break a retain cycle, write blocks and see exactly what they capture, annotate a header so that Swift imports optionals and typed arrays instead of crashing, and spot the C hazards Objective-C keeps: format strings from outside the program, formats too narrow for their values, and integer overflow.

ARC frees an object when its last strong reference goes

lifetimes.m creates five tickets, each of which prints a line when it is created and when it is freed, and lets go of them in different ways. Apple’s ARC release notes describe the mechanism as code the compiler adds, so that each object lives for as long as something needs it and no longer. Clang’s specification makes it exact: storing an object in a strongstrong reference: A reference that keeps its object alive: under ARC an object lives while at least one strong variable, property or captured block points at it. Object pointers are strong unless declared otherwise. variable or property retains it, the value it replaced is released, and an object is freed when the last strong reference to it goes. Strong is the default for object pointers, so plain Ticket *a is strong.

// lifetimes.m: when ARC frees an object, and what a weak reference holds afterwards. Every ticket says when it is
// created and when it is freed.
#import <Foundation/Foundation.h>
#include <stdio.h>

@interface Ticket : NSObject
@property (nonatomic, copy) NSString *name;
- (instancetype)initWithName:(NSString *)name;
@end

@implementation Ticket
- (instancetype)initWithName:(NSString *)name {
    self = [super init];
    if (self) {
        _name = [name copy];
        printf("  + %s created\n", name.UTF8String);
    }
    return self;
}
- (void)dealloc {
    printf("  - %s freed\n", self.name.UTF8String);
}
@end

int main(void) {
    @autoreleasepool {
        printf("1. one strong reference, then none\n");
        Ticket *first = [[Ticket alloc] initWithName:@"T1"];
        printf("   first holds %s\n", first.name.UTF8String);
        first = nil;
        printf("2. two strong references to one ticket\n");
        Ticket *a = [[Ticket alloc] initWithName:@"T2"];
        Ticket *b = a;
        a = nil;
        printf("   a is nil, b still holds %s\n", b.name.UTF8String);
        b = nil;
        printf("3. a weak reference\n");
        Ticket *strong = [[Ticket alloc] initWithName:@"T3"];
        __weak Ticket *weak = strong;
        printf("   weak sees %s\n", weak.name.UTF8String);
        strong = nil;
        printf("   weak is now %s\n", weak == nil ? "nil" : "still an object");
        printf("4. a new ticket stored only in a weak variable\n");
        __weak Ticket *lost = [[Ticket alloc] initWithName:@"T4"];
        printf("   lost is %s\n", lost == nil ? "nil" : "an object");
        printf("5. a strong variable at the end of its scope\n");
        Ticket *last = [[Ticket alloc] initWithName:@"T5"];
        printf("   last holds %s\n", last.name.UTF8String);
    }
    printf("after the autorelease pool\n");
    return 0;
}

from session import run

# When ARC frees an object: build lifetimes.m, read its one warning, and run it.
run("""
cd arc
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation lifetimes.m -o lifetimes
./lifetimes
""")

$ cd arc
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation lifetimes.m -o lifetimes
lifetimes.m:44:24: warning: assigning retained object to weak variable; object will be released after assignment [-Warc-unsafe-retained-assign]
   44 |         __weak Ticket *lost = [[Ticket alloc] initWithName:@"T4"];
      |                        ^      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
$ ./lifetimes
1. one strong reference, then none
  + T1 created
   first holds T1
  - T1 freed
2. two strong references to one ticket
  + T2 created
   a is nil, b still holds T2
  - T2 freed
3. a weak reference
  + T3 created
   weak sees T3
  - T3 freed
   weak is now nil
4. a new ticket stored only in a weak variable
  + T4 created
  - T4 freed
   lost is nil
5. a strong variable at the end of its scope
  + T5 created
   last holds T5
  - T5 freed
after the autorelease pool

Every - … freed line sits exactly where the last strong reference went. T2 survived a = nil because b still held it, and went at b = nil. A weakweak reference: A reference, declared __weak or with the weak attribute, that does not keep its object alive. ARC sets it to nil when the object is freed, so it never points at freed memory. reference does not count: T3 was freed as soon as strong let go, and weak then read nil. Step through those two cases with the counts beside them:

The two other lines are the edges of the rule. T4 was stored only in a weak variable, so it had no strong reference from its first moment; clang warned at build time, assigning retained object to weak variable; object will be released after assignment, and the run printed + T4 created and - T4 freed back to back. T5 was freed at the closing brace of the @autoreleasepool block, where its variable’s scope ended, before after the autorelease pool.

A ring of strong references is never freed

A strong reference keeps its object alive, so two objects that hold each other strongly keep each other alive for ever. Clang’s specification says it plainly: ARC does not provide a cycle collector, and breaking cycles is the programmer’s job, by hand or with weak references. Apple’s release notes call such a ring a strong reference cycle, the name for what was earlier known as a retain cycleretain cycle: A ring of strong references, such as two objects that hold each other, which keeps every object in it alive after the rest of the program lets go. Apple also calls it a strong reference cycle; ARC never collects one.. cycle.m counts its live objects: each init adds one and each dealloc subtracts one, the dealloc counter a debug build can keep:

// cycle.m: three ways to keep objects alive by accident, each beside its fix. A counter of live objects says how many
// are left at the end of each case.
#import <Foundation/Foundation.h>
#include <stdio.h>

static int live = 0;

@class Order;

@interface Customer : NSObject
@property (nonatomic, copy) NSString *name;
@property (nonatomic, strong) Order *order;
@end

@interface Order : NSObject
@property (nonatomic, strong) Customer *buyer;      // a strong reference back: the cycle
@property (nonatomic, weak) Customer *weakBuyer;    // a weak reference back: the fix
@end

@implementation Customer
- (instancetype)init { if ((self = [super init])) { live++; } return self; }
- (void)dealloc { live--; printf("  - customer %s freed\n", self.name.UTF8String); }
@end

@implementation Order
- (instancetype)init { if ((self = [super init])) { live++; } return self; }
- (void)dealloc { live--; printf("  - order freed\n"); }
@end

@interface Feed : NSObject
@property (nonatomic, copy) NSString *label;
@property (nonatomic, copy) void (^onUpdate)(void);
@property (nonatomic, strong) NSMutableArray *handlers;
- (void)watch;
- (void)watchWeakly;
- (void)watchThroughAList;
@end

@implementation Feed
- (instancetype)init { if ((self = [super init])) { live++; _handlers = [NSMutableArray array]; } return self; }
- (void)watch {
    self.onUpdate = ^{
        printf("    update for %s\n", self.label.UTF8String);
    };
}
- (void)watchWeakly {
    __weak Feed *weakSelf = self;
    self.onUpdate = ^{
        Feed *strongSelf = weakSelf;
        if (strongSelf) {
            printf("    update for %s\n", strongSelf.label.UTF8String);
        }
    };
}
- (void)watchThroughAList {
    NSMutableArray *list = self.handlers;
    [list addObject:^{
        printf("    update for %s\n", self.label.UTF8String);
    }];
}
- (void)dealloc { live--; printf("  - feed %s freed\n", self.label.UTF8String); }
@end

int main(void) {
    @autoreleasepool {
        printf("1. customer and order hold each other strongly\n");
        {
            Customer *c = [[Customer alloc] init];
            c.name = @"Asha";
            c.order = [[Order alloc] init];
            c.order.buyer = c;
        }
        printf("   live objects: %d\n", live);
        printf("2. the order points back weakly\n");
        {
            Customer *c = [[Customer alloc] init];
            c.name = @"Ravi";
            c.order = [[Order alloc] init];
            c.order.weakBuyer = c;
        }
        printf("   live objects: %d\n", live);
        printf("3. a block property that uses self\n");
        {
            Feed *f = [[Feed alloc] init];
            f.label = @"news";
            [f watch];
            f.onUpdate();
        }
        printf("   live objects: %d\n", live);
        printf("4. the block uses a weak self\n");
        {
            Feed *f = [[Feed alloc] init];
            f.label = @"sport";
            [f watchWeakly];
            f.onUpdate();
        }
        printf("   live objects: %d\n", live);
        printf("5. the block reaches self's array through a local variable\n");
        {
            Feed *f = [[Feed alloc] init];
            f.label = @"weather";
            [f watchThroughAList];
        }
        printf("   live objects: %d\n", live);
    }
    return 0;
}

from session import run

# Three cycles and their fixes: build cycle.m, read which of the cycles clang warned about, and run it.
run("""
cd arc
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation cycle.m -o cycle
./cycle
""")

$ cd arc
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation cycle.m -o cycle
cycle.m:43:39: warning: capturing 'self' strongly in this block is likely to lead to a retain cycle [-Warc-retain-cycles]
   43 |         printf("    update for %s\n", self.label.UTF8String);
      |                                       ^~~~
cycle.m:42:5: note: block will be retained by the captured object
   42 |     self.onUpdate = ^{
      |     ^~~~
1 warning generated.
$ ./cycle
1. customer and order hold each other strongly
   live objects: 2
2. the order points back weakly
  - customer Ravi freed
  - order freed
   live objects: 2
3. a block property that uses self
    update for news
   live objects: 3
4. the block uses a weak self
    update for sport
  - feed sport freed
   live objects: 3
5. the block reaches self's array through a local variable
   live objects: 4

Case 1 ended with 2 live objects: the customer held its order and the order held the customer, so when the variable c went at the closing brace, each still had one strong reference, from the other. Case 2 is the same pair with one change, @property (nonatomic, weak) Customer *weakBuyer, and both were freed: the customer first, because only c held it, then the order, which the customer had held. The count stayed at 2, the leak of case 1.

The rule that prevents most cycles is about ownership: a parent holds its children strongly, and a child points back to its parent weakly. Choosing the attribute of a property is mostly answering that question, and two more:

In short: strong for what an object owns, weak for a reference back to its owner or anything that may go first, copy for strings, collections and blocks that a caller might change, and unsafe_unretained almost never, because it keeps pointing at freed memory.

A block captures values when it is created

A blockblock: A piece of code written ^(arguments) { … } that can be stored and called later, with the variables it uses captured: the Objective-C and C counterpart of a Swift closure. Blocks are Objective-C objects. is a piece of code with the variables it uses, written ^(int price) { … }, the Objective-C form of a Swift closure. Clang’s Blocks specification fixes what it captures: local variables are copied into the block as constants at the moment the block literal is evaluated, and a variable marked __block__block variable: A local variable declared with __block, which the blocks that use it share with its scope instead of copying, so that a block can change it and the code around it sees the change. is shared between the block and its scope instead, so that both see changes. Blocks are also Objective-C objects, which can be stored in collections and properties:

// blocks.m: what a block captures and when, a __block variable, a block that keeps an object alive, and blocks
// stored in a collection.
#import <Foundation/Foundation.h>
#include <stdio.h>

@interface Ticket : NSObject
@end

@implementation Ticket
- (void)dealloc { printf("  - ticket freed\n"); }
@end

int main(void) {
    @autoreleasepool {
        int discount = 10;
        int (^priceAfter)(int) = ^(int price) {
            return price - discount;
        };
        discount = 50;
        printf("1. priceAfter(200) = %d, with discount now %d\n", priceAfter(200), discount);

        __block int sum = 0;
        [@[@3, @1, @2] enumerateObjectsUsingBlock:^(NSNumber *mark, NSUInteger index, BOOL *stop) {
            (void)index;
            (void)stop;
            sum += mark.intValue;
        }];
        printf("2. sum of 3, 1 and 2 with __block: %d\n", sum);

        printf("3. a block that captured a ticket\n");
        void (^show)(void);
        {
            Ticket *ticket = [[Ticket alloc] init];
            show = ^{
                printf("   the block still has %s\n", ticket == nil ? "nothing" : "the ticket");
            };
            ticket = nil;
            printf("   the variable is nil\n");
        }
        show();
        show = nil;
        printf("   the block is gone\n");

        NSArray *steps = @[^{ printf("4. step one\n"); }, ^{ printf("   step two\n"); }];
        for (void (^step)(void) in steps) {
            step();
        }
    }
    return 0;
}

from session import run

# What blocks capture: build and run blocks.m, then compile a block that assigns to a variable without __block.
run("""
cd blocks
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation blocks.m -o blocks
./blocks
!clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation blocks_bad.m -o blocks_bad
""")

$ cd blocks
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation blocks.m -o blocks
$ ./blocks
1. priceAfter(200) = 190, with discount now 50
2. sum of 3, 1 and 2 with __block: 6
3. a block that captured a ticket
   the variable is nil
   the block still has the ticket
  - ticket freed
   the block is gone
4. step one
   step two
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation blocks_bad.m -o blocks_bad
blocks_bad.m:10:17: error: variable is not assignable (missing __block type specifier)
   10 |             sum += mark.intValue;
      |             ~~~ ^
1 error generated.
[exit status 1]

priceAfter(200) gave 190, not 150: the block had copied discount when it was 10, and changing the variable afterwards did not reach the copy. The sum of 3, 1 and 2 reached 6 only because sum was __block; without it, blocks_bad.m did not compile: variable is not assignable (missing __block type specifier). The third case is the one that matters for memory: the ticket survived ticket = nil, because the block captured the object strongly, and it was freed only when the block itself went at show = nil. Apple’s guide states the rule: blocks keep strong references to any objects they capture.

The last row hides a trap: the specification says that a block using an instance variable, such as _label, imports self, so the block holds the whole object even though the word self never appears in it.

A block that uses self can keep its object alive

Cases 3 to 5 of cycle.m are the same ring as case 1, with a block in it. In case 3 the feed keeps the block in its onUpdate property, and the block uses self.label, so it keeps the feed. Step through it, and then through the fix:

The fix of case 4 is the pattern Apple’s guide recommends. The method first stores self in a weak variable, __weak Feed *weakSelf = self;, and the block uses weakSelf, so it holds nothing strongly. Inside the block, Feed *strongSelf = weakSelf; takes a strong reference for the length of one run and tests it for nil, because the feed may already be gone by the time the block runs; Apple’s guide says the weak pointer is then simply nil. The run printed - feed sport freed, and the live count did not grow.

Case 5 is the reason not to rely on the compiler. clang flagged case 3 with capturing 'self' strongly in this block is likely to lead to a retain cycle, but case 5, where the block reaches the feed’s array through a local variable, NSMutableArray *list = self.handlers;, made the same ring with no warning at all, and the count rose to 4. The warning sees a block stored straight into self; it cannot follow every path to it.

Nullability and generics decide what Swift sees

Swift imports every Objective-C header, and what it sees depends on what the header says. Apple’s page on designating nullability lists the rules: a pointer marked nonnull comes in as a plain type, one marked nullable as an optional, and one with no annotation as an implicitly unwrapped optionalimplicitly unwrapped optional: A Swift type written with !, such as String!, that may hold nil but can be used without unwrapping; if it is nil when used, the program stops. Swift imports unannotated Objective-C pointers this way., a value Swift lets you use as if it could not be nil. Lightweight generics, such as NSArray<NSString *> *, keep the type of a collection’s elements; without them, Swift sees [Any]. Between NS_ASSUME_NONNULL_BEGIN and NS_ASSUME_NONNULL_END every declaration without an annotation counts as nonnull, so only the nullable ones need a word.

Shelf.h is written the old way. TypedShelf.h declares the same class with annotations, one nullable result and an element type, plus a method that reports a failure through NSError **:

// Shelf.h: a header written the old way, with no nullability annotations and no element types.
#import <Foundation/Foundation.h>

@interface Shelf : NSObject
@property (nonatomic, copy) NSArray *titles;
- (NSString *)titleAtIndex:(NSUInteger)index;   // nil when there is no book at that index
- (void)addTitle:(NSString *)title;
@end

// TypedShelf.h: the same class, annotated: nonnull unless marked, one nullable result, the element type of the
// array, and a method that reports a failure through NSError.
#import <Foundation/Foundation.h>

NS_ASSUME_NONNULL_BEGIN

@interface TypedShelf : NSObject
@property (nonatomic, copy) NSArray<NSString *> *titles;
- (nullable NSString *)titleAtIndex:(NSUInteger)index;
- (void)addTitle:(NSString *)title;
- (BOOL)removeTitle:(NSString *)title error:(NSError **)error;
@end

NS_ASSUME_NONNULL_END

// plain.swift: Swift using the unannotated Shelf. Both lines with String compile.
let shelf = Shelf()
shelf.addTitle("Gitanjali")
print("titles:", shelf.titles.count)
let first: String = shelf.title(at: 0)
print("first:", first)
let sixth: String = shelf.title(at: 5)
print("sixth:", sixth)

// typed_fixed.swift: TypedShelf used as Swift wants it: the optional unwrapped, and the NSError ** method called
// with try.
let shelf = TypedShelf()
shelf.addTitle("Gitanjali")
for title in shelf.titles {
    print(title.uppercased())
}
if let sixth = shelf.title(at: 5) {
    print("sixth:", sixth)
} else {
    print("no book at index 5")
}
do {
    try shelf.removeTitle("Kabir")
} catch {
    print("removeTitle failed:", error.localizedDescription)
}

The session compiles each class with clang and builds Swift programs against its header with -import-objc-header, which hands swiftc a header to import, the job a bridging header does in an Xcode target, as Apple’s page on importing Objective-C describes it:

from session import run

# Swift and Objective-C in one program: compile each Objective-C class to an object file, then build Swift programs
# that import its header (-import-objc-header, the command-line form of a bridging header) and link the object file.
run("""
cd swift
swiftc --version
clang -fobjc-arc -Wall -Wextra -c Shelf.m -o Shelf.o
clang -fobjc-arc -Wall -Wextra -c TypedShelf.m -o TypedShelf.o
swiftc -import-objc-header Shelf.h plain.swift Shelf.o -o plain
!./plain
!swiftc -import-objc-header Shelf.h plain_loop.swift Shelf.o -o plain_loop
!swiftc -import-objc-header TypedShelf.h typed.swift TypedShelf.o -o typed
swiftc -import-objc-header TypedShelf.h typed_fixed.swift TypedShelf.o -o typed_fixed
./typed_fixed
""")

$ cd swift
$ swiftc --version
swift-driver version: 1.168.6 Apple Swift version 6.4 (swiftlang-6.4.0.34.1 clang-2100.3.34.1)
Target: arm64-apple-macosx26.0
$ clang -fobjc-arc -Wall -Wextra -c Shelf.m -o Shelf.o
$ clang -fobjc-arc -Wall -Wextra -c TypedShelf.m -o TypedShelf.o
$ swiftc -import-objc-header Shelf.h plain.swift Shelf.o -o plain
$ ./plain
titles: 1
first: Gitanjali
plain/plain.swift:7: Fatal error: Unexpectedly found nil while implicitly unwrapping an Optional value
[exit status 133]
$ swiftc -import-objc-header Shelf.h plain_loop.swift Shelf.o -o plain_loop
plain_loop.swift:5:17: error: value of type 'Any' has no member 'uppercased'
3 | shelf.addTitle("Gitanjali")
4 | for title in shelf.titles {
5 |     print(title.uppercased())
  |                 |- error: value of type 'Any' has no member 'uppercased'
  |                 `- note: cast 'Any' to 'AnyObject' or use 'as!' to force downcast to a more specific type to access members
6 | }
7 |
[exit status 1]
$ swiftc -import-objc-header TypedShelf.h typed.swift TypedShelf.o -o typed
typed.swift:7:27: error: value of optional type 'String?' must be unwrapped to a value of type 'String'
5 |     print(title.uppercased())
6 | }
7 | let sixth: String = shelf.title(at: 5)
  |                           |- error: value of optional type 'String?' must be unwrapped to a value of type 'String'
  |                           |- note: coalesce using '??' to provide a default when the optional value contains 'nil'
  |                           `- note: force-unwrap using '!' to abort execution if the optional value contains 'nil'
8 | print("sixth:", sixth)
9 |
[exit status 1]
$ swiftc -import-objc-header TypedShelf.h typed_fixed.swift TypedShelf.o -o typed_fixed
$ ./typed_fixed
GITANJALI
no book at index 5
removeTitle failed: no book called Kabir on the shelf

The first row is the expensive one. With no annotation, the Swift compiler had no way to know that the method can return nil, accepted the program, and the program stopped at run time with Unexpectedly found nil while implicitly unwrapping an Optional value. The annotated header moved the same mistake to compile time, where it costs nothing. The last row shows Apple’s rule for error parameters at work: the NSError ** became throws.

C’s hazards stay: format strings, widths and overflow

Objective-C is C underneath, so C’s ways to go wrong come with it. The most serious is a format string that comes from outside the program. note_unsafe.m passes a note from its command line to stringWithFormat: as the format itself; note_safe.m passes it as the argument of @"%@":

// note_unsafe.m: prints a note that comes from outside the program, using the note itself as the format.
#import <Foundation/Foundation.h>
#include <stdio.h>

int main(int argc, const char *argv[]) {
    @autoreleasepool {
        if (argc != 2) {
            fprintf(stderr, "usage: note_unsafe <note>\n");
            return 2;
        }
        NSString *note = @(argv[1]);
        NSString *line = [NSString stringWithFormat:note];
        printf("note: %s\n", line.UTF8String);
    }
    return 0;
}

// note_safe.m: the same program with a fixed format; the note is only ever an argument.
#import <Foundation/Foundation.h>
#include <stdio.h>

int main(int argc, const char *argv[]) {
    @autoreleasepool {
        if (argc != 2) {
            fprintf(stderr, "usage: note_safe <note>\n");
            return 2;
        }
        NSString *note = @(argv[1]);
        NSString *line = [NSString stringWithFormat:@"%@", note];
        printf("note: %s\n", line.UTF8String);
    }
    return 0;
}

from session import run

# A note from outside the program used as a format, then used as an argument; and the check that tells the two apart
# at build time, -Werror=format-security.
run("""
cd format
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation note_unsafe.m -o note_unsafe
./note_unsafe 'Paid in full: 100%'
!./note_unsafe 'Refund %@ %@'
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation note_safe.m -o note_safe
./note_safe 'Paid in full: 100%'
./note_safe 'Refund %@ %@'
!clang -fobjc-arc -Wall -Wextra -Werror=format-security -framework Foundation note_unsafe.m -o note_unsafe
clang -fobjc-arc -Wall -Wextra -Werror=format-security -framework Foundation note_safe.m -o note_safe
""")

$ cd format
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation note_unsafe.m -o note_unsafe
note_unsafe.m:12:53: warning: format string is not a string literal (potentially insecure) [-Wformat-security]
   12 |         NSString *line = [NSString stringWithFormat:note];
      |                                                     ^~~~
note_unsafe.m:12:53: note: treat the string as an argument to avoid this
   12 |         NSString *line = [NSString stringWithFormat:note];
      |                                                     ^
      |                                                     @"%@",
1 warning generated.
$ ./note_unsafe 'Paid in full: 100%'
note: Paid in full: 100
$ ./note_unsafe 'Refund %@ %@'
[exit status 139]
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation note_safe.m -o note_safe
$ ./note_safe 'Paid in full: 100%'
note: Paid in full: 100%
$ ./note_safe 'Refund %@ %@'
note: Refund %@ %@
$ clang -fobjc-arc -Wall -Wextra -Werror=format-security -framework Foundation note_unsafe.m -o note_unsafe
note_unsafe.m:12:53: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security]
   12 |         NSString *line = [NSString stringWithFormat:note];
      |                                                     ^~~~
note_unsafe.m:12:53: note: treat the string as an argument to avoid this
   12 |         NSString *line = [NSString stringWithFormat:note];
      |                                                     ^
      |                                                     @"%@",
1 error generated.
[exit status 1]
$ clang -fobjc-arc -Wall -Wextra -Werror=format-security -framework Foundation note_safe.m -o note_safe

clang warned at once: format string is not a string literal (potentially insecure), with the fix spelled out, treat the string as an argument. The two runs of the unsafe program show why. A note ending in 100% lost its percent sign without a word, because % started a conversion. A note with two %@ made stringWithFormat: read two objects that were never passed, and the program died with exit status 139, 128 plus signal 11, a segmentation fault. The safe program printed both notes exactly. MITRE lists this weakness as CWE-134, use of an externally controlled format string, and its mitigations include passing format functions only fixed strings and building with high warning levels.

Two quieter hazards come from C’s integer types. A format must match the size of its argument, and an NSInteger is 8 bytes on a 64-bit Mac while %d reads 4, so 5,000,000,000 paise printed as 705,032,704; clang’s -Wformat warning even offered the fix, %ld with a (long) cast. And signed overflow is undefined in C: 2147483647 + 1 in an int printed −2,147,483,648 with no complaint, until the program was built with -fsanitize=undefined, whose check reported the line and the values: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int':

// widths.m: two C hazards that Objective-C keeps: a format that is too narrow for its argument, and a signed
// overflow, which C leaves undefined.
#import <Foundation/Foundation.h>
#include <stdio.h>

int main(void) {
    @autoreleasepool {
        NSInteger paise = 5000000000;
        NSString *wrong = [NSString stringWithFormat:@"%d paise", paise];
        NSString *right = [NSString stringWithFormat:@"%ld paise", (long)paise];
        printf("with %%d:  %s\nwith %%ld: %s\n", wrong.UTF8String, right.UTF8String);
        int count = 2147483647;
        count = count + 1;
        printf("2147483647 + 1 in an int: %d\n", count);
    }
    return 0;
}

from session import run

# A format too narrow for its argument and a signed overflow: the warning clang gives, what the program prints, and
# what the undefined-behaviour sanitizer reports when the same program is built with -fsanitize=undefined.
run("""
cd format
clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation widths.m -o widths
./widths
clang -fobjc-arc -Wall -Wextra -Wno-format -fsanitize=undefined -framework Foundation widths.m -o widths_checked
./widths_checked
""")

$ cd format
$ clang -fobjc-arc -Wall -Wextra -Wformat-security -framework Foundation widths.m -o widths
widths.m:9:67: warning: values of type 'NSInteger' should not be used as format arguments; add an explicit cast to 'long' instead [-Wformat]
    9 |         NSString *wrong = [NSString stringWithFormat:@"%d paise", paise];
      |                                                        ~~         ^~~~~
      |                                                        %ld        (long)
1 warning generated.
$ ./widths
with %d:  705032704 paise
with %ld: 5000000000 paise
2147483647 + 1 in an int: -2147483648
$ clang -fobjc-arc -Wall -Wextra -Wno-format -fsanitize=undefined -framework Foundation widths.m -o widths_checked
$ ./widths_checked
with %d:  705032704 paise
with %ld: 5000000000 paise
widths.m:13:23: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior widths.m:13:23
2147483647 + 1 in an int: -2147483648

Practise: predict which objects ARC never frees

The exercise turns the counting rule of this lesson into a function. Given the strong and weak references between a program’s objects and the variables that hold some of them, it returns the objects that are still alive after those variables let go, which is what cycle.m’s counter measured. Its sample tests are the five cases of cycle.m, the lost ticket T4, the ticket T2 that two variables held, and a chain that ends in a ring:

def survivors(objects, strong, weak, held):
    """Return, sorted, the names of the objects still alive after every variable in held lets go."""
    # A garbage collector frees everything that no variable can reach any more, so this first try returns nothing.
    # ARC counts references instead: replace this with the counting the prompt describes.
    return []

from survivors import survivors


def test_case_1_strong_both_ways():
    """case 1: customer and order hold each other strongly, so both stay"""
    assert survivors(["customer", "order"], [("customer", "order"), ("order", "customer")], [], ["customer"]) == ["customer", "order"]


def test_case_2_weak_back_reference():
    """case 2: the order points back weakly, so both are freed"""
    assert survivors(["customer", "order"], [("customer", "order")], [("order", "customer")], ["customer"]) == []


def test_cases_3_and_4_block_and_self():
    """case 3: the feed keeps its block and the block keeps the feed; case 4: the block holds a weak self"""
    assert survivors(["block", "feed"], [("feed", "block"), ("block", "feed")], [], ["feed"]) == ["block", "feed"]
    assert survivors(["block", "feed"], [("feed", "block")], [("block", "feed")], ["feed"]) == []


def test_case_5_ring_through_an_array():
    """case 5: feed, its array and the block in it form a ring of three"""
    strong = [("feed", "list"), ("list", "block"), ("block", "feed")]
    assert survivors(["block", "feed", "list"], strong, [], ["feed"]) == ["block", "feed", "list"]


def test_object_held_by_nothing():
    """T4: an object stored only in a weak variable is freed at once"""
    assert survivors(["T4"], [], [], []) == []


def test_two_variables_one_object():
    """T2: two variables hold one ticket, and both let go"""
    assert survivors(["T2"], [], [], ["T2", "T2"]) == []


def test_chain_into_a_ring():
    """a holds b, b holds c, and c and d hold each other: a and b are freed, the ring of c and d stays"""
    strong = [("a", "b"), ("b", "c"), ("c", "d"), ("d", "c")]
    assert survivors(["a", "b", "c", "d"], strong, [], ["a"]) == ["c", "d"]

Then take the self-check on the six ideas of the lesson. Ideas you have answered wrongly come back first, and every option you choose is explained straight away:

Interview questions

Warm-up (fresher to mid-level): What is a retain cycle, and how does a weak reference break it?

A retain cycle is a ring of strong references: object A holds B strongly and B holds A, directly or through other objects. Under ARC an object is freed when its last strong reference goes, so when the rest of the program lets go of the ring, every object in it still has one strong reference, from its neighbour, and none is ever freed: Clang’s ARC specification says ARC has no cycle collector. A weak reference does not keep its object alive, and ARC sets it to nil when the object goes, so making one link weak, usually the one from a child back to its parent or from a block back to self, lets the whole ring be freed. In the lesson, a customer and an order that held each other strongly stayed alive; with a weak reference back, both were freed.

Three questions of the kind asked about memory, Swift boundaries and safe printing:

Key takeaways

• Under ARC an object is freed when its last strong reference goes; weak references do not count and read nil afterwards, and an object stored only in a weak variable is freed at once.
• ARC has no cycle collector, so two objects that hold each other strongly are never freed; a child’s reference back to its parent is weak, and properties are strong, weak or copy by ownership.
• A block copies the local values it uses when it is created, shares only __block variables, and keeps every object it captures alive, self included, even when it only uses an instance variable.
• A block stored by self must use a weak self; clang’s warning caught the direct case and missed one that went through a local variable, so the live count is the real test.
• Unannotated headers give Swift String! and [Any]; NS_ASSUME_NONNULL_BEGIN, nullable and element types give it optionals and typed arrays, and an NSError ** method becomes one that throws.
• A format string from outside the program crashed it with exit status 139 and silently dropped a %; build with -Werror=format-security, match formats to their types, and use -fsanitize=undefined to catch overflow.