31779360: UICollectionView batch update heap corruption

[openradar-mirror]

Description

Summary:
When performing a particular set of batch updates on a UICollectionView with a certain number of sections, it appears there is a heap corruption and crash in objc_release in -[UICollectionViewUpdate _computeItemUpdates].

Steps to Reproduce:

1. Setup a UICollectionView with 8 sections, each with 3 items
2. Perform batch updates with:
   a. Insert item at section 1, item 0
   b. Insert section 0
   c. Move section 3 to section 1
3. Make sure data source is properly updated to reflect changes

Expected Results:
UICollectionView performs the queued updates on the view hierarchy.

Actual Results:
UICollectionView crashes with the following trace:

#0 0x0000000101a3bd7b in objc_release ()
#1 0x000000010325241c in -[UICollectionViewUpdate _computeItemUpdates] ()
#2 0x0000000103251315 in -[UICollectionViewUpdate initWithCollectionView:updateItems:oldModel:newModel:oldVisibleBounds:newVisibleBounds:] ()
#3 0x00000001032c078b in -[UICollectionView _endItemAnimationsWithInvalidationContext:tentativelyForReordering:] ()
#4 0x00000001032c8497 in -[UICollectionView _performBatchUpdates:completion:invalidationContext:tentativelyForReordering:] ()
#5 0x00000001032c82d5 in -[UICollectionView _performBatchUpdates:completion:invalidationContext:] ()
#6 0x00000001032c8278 in -[UICollectionView performBatchUpdates:completion:] ()

Version:
9.3.1

Notes:
Crash reports from production show issue occurring on iOS 7.1.2, 8.3, 8.4, 9.1, 9.2, 9.2.1, 9.3, and 9.3.1. Locally reproduce on iOS 9.3.1 and Xcode 7.3 simulators.

Changing from 8 to 9 sections in the sample project seems to mitigate the issue. The same happens when using only 7 sections.

Product Version: 9.3.1
Created: 2017-04-23T22:01:26.033750
Originated: 2017-04-23T15:01:00
Open Radar Link: http://www.openradar.me/31779360