Crash when popping to root view controller - iphone

Question

a user reported the following crash in my iPad app.
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libsystem_kernel.dylib 0x33200a1c __pthread_kill + 8
1 libsystem_c.dylib 0x30e373b4 pthread_kill
2 libsystem_c.dylib 0x30e2fbf8 abort
3 libstdc++.6.dylib 0x3669da64 __gnu_cxx::__verbose_terminate_handler() + 376
4 libobjc.A.dylib 0x36f8d06c _objc_terminate
5 libstdc++.6.dylib 0x3669be36 __cxxabiv1::__terminate(void (*)()) + 46
6 libstdc++.6.dylib 0x3669be8a std::terminate() + 10
7 libstdc++.6.dylib 0x3669bf5a __cxa_throw + 78
8 libobjc.A.dylib 0x36f8bc84 objc_exception_throw
9 CoreFoundation 0x361a3206 __CFRunLoopDoTimer
10 CoreFoundation 0x361e2396 -[NSMutableArray removeObjectsInRange:]
11 UIKit 0x32a622f0 -[UINavigationController popToViewController:transition:]
12 UIKit 0x32a1dd94 -[UINavigationController popToRootViewControllerWithTransition:]
13 UIKit 0x32a1dd46 -[UINavigationController popToRootViewControllerAnimated:]
14 IW Select 0x0001e00e -[CustomTabBarController onButtonTouchDown:] + 154
So apparently in some cases when that button is pressed and it's trying to switch to the root view controller, something goes wrong in the [NSMutableArray removeObjectsInRange:] call. I can't figure out what could be the problem there, does anyone have experience with this? Since it's a crash report from a user, I can't see which exception was thrown.
Edit: here's the full report I got.
Incident Identifier: 105E1288-3904-4AB2-842C-95D2B6D2C0E6
Hardware Model: iPad1,1
Process: IW Select [2124]
Path: /var/mobile/Applications/5AB7092A-AF9D-4702-9712-F154BCB638E7/IW Select.app/IW Select
Identifier: IW Select
Version: ??? (???)
Code Type: ARM (Native)
Parent Process: launchd [1]
Date/Time: 2011-04-03 22:06:56.052 -0400
OS Version: iPhone OS 4.3.1 (8G4)
Report Version: 104
Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x00000000, 0x00000000
Crashed Thread: 0
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libsystem_kernel.dylib 0x33200a1c __pthread_kill + 8
1 libsystem_c.dylib 0x30e373b4 pthread_kill
2 libsystem_c.dylib 0x30e2fbf8 abort
3 libstdc++.6.dylib 0x3669da64 __gnu_cxx::__verbose_terminate_handler() + 376
4 libobjc.A.dylib 0x36f8d06c _objc_terminate
5 libstdc++.6.dylib 0x3669be36 __cxxabiv1::__terminate(void (*)()) + 46
6 libstdc++.6.dylib 0x3669be8a std::terminate() + 10
7 libstdc++.6.dylib 0x3669bf5a __cxa_throw + 78
8 libobjc.A.dylib 0x36f8bc84 objc_exception_throw
9 CoreFoundation 0x361a3206 __CFRunLoopDoTimer
10 CoreFoundation 0x361e2396 -[NSMutableArray removeObjectsInRange:]
11 UIKit 0x32a622f0 -[UINavigationController popToViewController:transition:]
12 UIKit 0x32a1dd94 -[UINavigationController popToRootViewControllerWithTransition:]
13 UIKit 0x32a1dd46 -[UINavigationController popToRootViewControllerAnimated:]
14 IW Select 0x0001e00e -[CustomTabBarController onButtonTouchDown:] + 154
15 IW Select 0x0001d5f4 -[CustomTabBar onButtonTouchDown:] + 88
16 CoreFoundation 0x361a856a -[NSObject(NSObject) performSelector:withObject:withObject:]
17 UIKit 0x32941ec2 -[UIApplication sendAction:to:from:forEvent:]
18 UIKit 0x32941e62 -[UIApplication sendAction:toTarget:fromSender:forEvent:]
19 UIKit 0x32941e34 -[UIControl sendAction:to:forEvent:]
20 UIKit 0x32941b86 -[UIControl(Internal) _sendActionsForEvents:withEvent:]
21 UIKit 0x32941834 -[UIControl touchesBegan:withEvent:]
22 UIKit 0x32940baa -[UIWindow _sendTouchesForEvent:]
23 UIKit 0x32940568 -[UIWindow sendEvent:]
24 UIKit 0x3292930c -[UIApplication sendEvent:]
25 UIKit 0x32928c4c _UIApplicationHandleEvent
26 GraphicsServices 0x327ffe70 PurpleEventCallback
27 CoreFoundation 0x3620fa90 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__
28 CoreFoundation 0x36211838 __CFRunLoopDoSource1
29 CoreFoundation 0x36212606 __CFRunLoopRun
30 CoreFoundation 0x361a2ebc CFRunLoopRunSpecific
31 CoreFoundation 0x361a2dc4 CFRunLoopRunInMode
32 GraphicsServices 0x327ff418 GSEventRunModal
33 GraphicsServices 0x327ff4c4 GSEventRun
34 UIKit 0x32953d62 -[UIApplication _run]
35 UIKit 0x32951800 UIApplicationMain
36 IW Select 0x00002b60 main + 44
37 IW Select 0x00002b28 start + 32
Thread 1 name: Dispatch queue: com.apple.libdispatch-manager
Thread 1:
0 libsystem_kernel.dylib 0x33201fbc kevent + 24
1 libdispatch.dylib 0x35387094 _dispatch_mgr_invoke
2 libdispatch.dylib 0x3538804a _dispatch_queue_invoke
3 libdispatch.dylib 0x3538760a _dispatch_worker_thread2
4 libsystem_c.dylib 0x30e3858a _pthread_wqthread
5 libsystem_c.dylib 0x30e38bbc start_wqthread + 0
Thread 2 name: WebThread
Thread 2:
0 libsystem_kernel.dylib 0x331fec00 mach_msg_trap + 20
1 libsystem_kernel.dylib 0x331fe758 mach_msg
2 CoreFoundation 0x362102b8 __CFRunLoopServiceMachPort
3 CoreFoundation 0x36212562 __CFRunLoopRun
4 CoreFoundation 0x361a2ebc CFRunLoopRunSpecific
5 CoreFoundation 0x361a2dc4 CFRunLoopRunInMode
6 WebCore 0x31058292 RunWebThread
7 libsystem_c.dylib 0x30e3730a _pthread_start
8 libsystem_c.dylib 0x30e38bb4 thread_start + 0
Thread 3:
0 libsystem_kernel.dylib 0x331fec00 mach_msg_trap + 20
1 libsystem_kernel.dylib 0x331fe758 mach_msg
2 CoreFoundation 0x362102b8 __CFRunLoopServiceMachPort
3 CoreFoundation 0x36212562 __CFRunLoopRun
4 CoreFoundation 0x361a2ebc CFRunLoopRunSpecific
5 CoreFoundation 0x361a2dc4 CFRunLoopRunInMode
6 Foundation 0x35b4a7f6 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:]
7 Foundation 0x35b3d382 -[NSThread main]
8 Foundation 0x35baf5c6 __NSThread__main__
9 libsystem_c.dylib 0x30e3730a _pthread_start
10 libsystem_c.dylib 0x30e38bb4 thread_start + 0
Thread 4 name: com.apple.CFSocket.private
Thread 4:
0 libsystem_kernel.dylib 0x33200c60 __select + 20
1 CoreFoundation 0x362158f2 __CFSocketManager
2 libsystem_c.dylib 0x30e3730a _pthread_start
3 libsystem_c.dylib 0x30e38bb4 thread_start + 0
Thread 5:
0 libsystem_kernel.dylib 0x332013ec __workq_kernreturn + 8
1 libsystem_c.dylib 0x30e386d8 _pthread_wqthread
2 libsystem_c.dylib 0x30e38bbc start_wqthread + 0
Thread 0 crashed with ARM Thread State:
r0: 0x00000000 r1: 0x00000000 r2: 0x00000001 r3: 0x00000000
r4: 0x3eb4948c r5: 0x00000006 r6: 0x001bafbc r7: 0x2fdfdfa8
r8: 0x32c1f4e8 r9: 0x00000065 r10: 0x3f35b9f8 r11: 0x0017eea0
ip: 0x00000148 sp: 0x2fdfdf9c lr: 0x30e373bb pc: 0x33200a1c
cpsr: 0x080f0010
Binary Images:
0x1000 - 0x3bfff +IW Select armv7 <f5aa1f825f883a0565038f9f1902c658> /var/mobile/Applications/5AB7092A-AF9D-4702-9712-F154BCB638E7/IW Select.app/IW Select
0x2fe00000 - 0x2fe25fff dyld armv7 <8dbdf7bab30e355b81e7b2e333d5459b> /usr/lib/dyld
0x30ae7000 - 0x30aeafff ActorKit armv7 <f7aa6cdd654231988aafcf448978f450> /System/Library/PrivateFrameworks/ActorKit.framework/ActorKit
0x30aeb000 - 0x30af5fff AccountSettings armv7 <d083fb384dc7311eb6766b9b2d2dd9c8> /System/Library/PrivateFrameworks/AccountSettings.framework/AccountSettings
0x30af7000 - 0x30b3efff MessageUI armv7 <35a81f5d4eb03467a1447db80337e570> /System/Library/Frameworks/MessageUI.framework/MessageUI
0x30b3f000 - 0x30b3ffff vecLib armv7 <0c60cd0a60f43d2791d36cb357d30e3c> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/vecLib
0x30b60000 - 0x30b75fff libresolv.9.dylib armv7 <e92cfbb83f7b330db19181e797bb3f7b> /usr/lib/libresolv.9.dylib
0x30b90000 - 0x30b93fff ApplePushService armv7 <015c68c15621348db9f6a012499170e1> /System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService
0x30b94000 - 0x30b95fff libsystem_network.dylib armv7 <39bf0f48bd8539169a77f8f61cdcd4c9> /usr/lib/system/libsystem_network.dylib
0x30b96000 - 0x30b9ffff CoreVideo armv7 <ea847e6dba2d36b1826b255c73b39539> /System/Library/Frameworks/CoreVideo.framework/CoreVideo
0x30c5d000 - 0x30cbbfff libBLAS.dylib armv7 <d3f7360687333cad987890c314ae0d6f> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBLAS.dylib
0x30cbc000 - 0x30cfefff CoreAudio armv7 <d45e275525ef3c32b36e0f1020cad705> /System/Library/Frameworks/CoreAudio.framework/CoreAudio
0x30d01000 - 0x30d2afff ContentIndex armv7 <f5a3613ec5b6392995d7ed0742f7419f> /System/Library/PrivateFrameworks/ContentIndex.framework/ContentIndex
0x30d36000 - 0x30d36fff libCVMSPluginSupport.dylib armv7 <68322643de8030978c862de530055bd9> /System/Library/Frameworks/OpenGLES.framework/libCVMSPluginSupport.dylib
0x30d37000 - 0x30df8fff RawCamera armv7 <4f817644f26c309abadc961569141496> /System/Library/CoreServices/RawCamera.bundle/RawCamera
0x30df9000 - 0x30dfafff libremovefile.dylib armv7 <5f077c4d204d3cd7b04452c42d41f763> /usr/lib/system/libremovefile.dylib
0x30dfb000 - 0x30dfdfff IOMobileFramebuffer armv7 <683f321680763e519d61541170ba2133> /System/Library/PrivateFrameworks/IOMobileFramebuffer.framework/IOMobileFramebuffer
0x30e04000 - 0x30e85fff libsystem_c.dylib armv7 <caa1846ad2583d1b84c1a15c50c126a2> /usr/lib/system/libsystem_c.dylib
0x30f4f000 - 0x30f55fff liblockdown.dylib armv7 <14c89b7346433c1f8675f454531f6ca3> /usr/lib/liblockdown.dylib
0x30f88000 - 0x30fb6fff MIME armv7 <28e35d5e19893de6bc28463efec5222f> /System/Library/PrivateFrameworks/MIME.framework/MIME
0x30fb7000 - 0x30fbcfff MobileKeyBag armv7 <8c35c090bc373cb181fc26b961b8dba5> /System/Library/PrivateFrameworks/MobileKeyBag.framework/MobileKeyBag
0x30fbd000 - 0x30fd6fff libRIP.A.dylib armv7 <4825c3e392983aba947eca06555e4480> /System/Library/Frameworks/CoreGraphics.framework/Resources/libRIP.A.dylib
0x31052000 - 0x3165dfff WebCore armv7 <b25d7d87ebd235ecbceca611a063c73b> /System/Library/PrivateFrameworks/WebCore.framework/WebCore
0x31694000 - 0x316a7fff libmis.dylib armv7 <529ea6e3a87230ce9f6cf3285c22429c> /usr/lib/libmis.dylib
0x316a8000 - 0x316affff libMobileGestalt.dylib armv7 <55f29184efcc3046bb833dd72a4487e1> /usr/lib/libMobileGestalt.dylib
0x316b0000 - 0x31997fff libLAPACK.dylib armv7 <652c97e211553d4e84968a61f62a0ac5> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLAPACK.dylib
0x31a92000 - 0x31ae7fff libvDSP.dylib armv7 <0221caba81a235c5a896a835e2aac047> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvDSP.dylib
0x31b5f000 - 0x31bb8fff EventKit armv7 <0d4e597ee229337183e96e921a72e30a> /System/Library/Frameworks/EventKit.framework/EventKit
0x31bbf000 - 0x31bd5fff EAP8021X armv7 <9776dd6c96b531e9885bddacd2a8adb1> /System/Library/PrivateFrameworks/EAP8021X.framework/EAP8021X
0x31c09000 - 0x31c09fff libdnsinfo.dylib armv7 <21415179ffa03f949fa8cc851c6c31c7> /usr/lib/system/libdnsinfo.dylib
0x31c0a000 - 0x31c0cfff libAccessibility.dylib armv7 <d55f1553d14831a2a5435ae27ef75ef4> /usr/lib/libAccessibility.dylib
0x31c0e000 - 0x31c2efff PrintKit armv7 <e5a01ca9083a36afacc08611a398e2ad> /System/Library/PrivateFrameworks/PrintKit.framework/PrintKit
0x31c2f000 - 0x31c37fff MobileBluetooth armv7 <63f11756c4aa3262b2317ff3b8e2a977> /System/Library/PrivateFrameworks/MobileBluetooth.framework/MobileBluetooth
0x32032000 - 0x32041fff MobileDeviceLink armv7 <f258d39dc7d93faa9c9ff5cf81c5dcbd> /System/Library/PrivateFrameworks/MobileDeviceLink.framework/MobileDeviceLink
0x3204a000 - 0x320d4fff Message armv7 <1e4680ca7d4936bf9f575269b67e4402> /System/Library/PrivateFrameworks/Message.framework/Message
0x3215b000 - 0x3219efff ManagedConfiguration armv7 <01a5c5442e173624bdbde3c1f4ad4665> /System/Library/PrivateFrameworks/ManagedConfiguration.framework/ManagedConfiguration
0x3232d000 - 0x3232dfff Accelerate armv7 <7d5ad465049136afaa1f0d89aac600bc> /System/Library/Frameworks/Accelerate.framework/Accelerate
0x323ee000 - 0x32421fff iCalendar armv7 <e52c54abaab734e8b0278f358217c4b5> /System/Library/PrivateFrameworks/iCalendar.framework/iCalendar
0x32533000 - 0x325f2fff CFNetwork armv7 <b09e0d53de9f3bc8bde494780f3cdd4f> /System/Library/Frameworks/CFNetwork.framework/CFNetwork
0x32616000 - 0x32624fff DataDetectorsCore armv7 <e54fa5bf6f9333618401cdbaf665f227> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/DataDetectorsCore
0x32689000 - 0x3269bfff PersistentConnection armv7 <8de1cf029f8132a2946ccca351dbd4fb> /System/Library/PrivateFrameworks/PersistentConnection.framework/PersistentConnection
0x326a3000 - 0x326ebfff CoreLocation armv7 <90a87c2cdf823e6892aff81a6dde3430> /System/Library/Frameworks/CoreLocation.framework/CoreLocation
0x3274c000 - 0x3274ffff libgermantok.dylib armv7 <a58c5595d1ca3c2ebc77d486d46d8c4f> /usr/lib/libgermantok.dylib
0x32750000 - 0x32752fff libgcc_s.1.dylib armv7 <a2631ac302f4310dae8367939e16b7c2> /usr/lib/libgcc_s.1.dylib
0x32760000 - 0x327a0fff CoreMedia armv7 <0fcb3d1136d033d3acd97519c4be3ac3> /System/Library/Frameworks/CoreMedia.framework/CoreMedia
0x327fb000 - 0x32807fff GraphicsServices armv7 <c508734deb43352782433a290ff235bb> /System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices
0x32808000 - 0x3280bfff IOSurface armv7 <ad50e71624583d06b891344d832f9b08> /System/Library/PrivateFrameworks/IOSurface.framework/IOSurface
0x3280c000 - 0x3280cfff liblangid.dylib armv7 <ffe9658cbc6e3464898da2d12f1a66d2> /usr/lib/liblangid.dylib
0x32925000 - 0x32cb2fff UIKit armv7 <c271b78464d93cb7bf28c6e49df293ba> /System/Library/Frameworks/UIKit.framework/UIKit
0x32cb3000 - 0x32dfffff MediaToolbox armv7 <7b1ac06abad33dca99a29629b667f929> /System/Library/PrivateFrameworks/MediaToolbox.framework/MediaToolbox
0x32ede000 - 0x32ee1fff CertUI armv7 <9060fe03a4943ef295531feced9a17dd> /System/Library/PrivateFrameworks/CertUI.framework/CertUI
0x32ee2000 - 0x32f02fff AppleAccount armv7 <4e0ac5cf93b338ab8c5f34ba3c5e2ee4> /System/Library/PrivateFrameworks/AppleAccount.framework/AppleAccount
0x32f11000 - 0x33032fff CoreGraphics armv7 <54e27b8aa66c32b48ffeadadcc514331> /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
0x33033000 - 0x3306bfff IOKit armv7 <80ae313ad69d3363935c88e51a11862d> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x3309f000 - 0x330a2fff libmacho.dylib armv7 <0479a171c00d3f629d639713acb72b5b> /usr/lib/system/libmacho.dylib
0x33145000 - 0x331eefff libxml2.2.dylib armv7 <5538d3f2c7d83b88b06168488fe6326b> /usr/lib/libxml2.2.dylib
0x331ef000 - 0x33206fff libsystem_kernel.dylib armv7 <29eb602b615b3c3b95722868100a2d1c> /usr/lib/system/libsystem_kernel.dylib
0x3326a000 - 0x3328afff MobileSync armv7 <4df400c4559435889eccd88db77a110c> /System/Library/PrivateFrameworks/MobileSync.framework/MobileSync
0x333a4000 - 0x333c1fff libsystem_info.dylib armv7 <48016be86e3f3cd9aeee1c6590e1ac6f> /usr/lib/system/libsystem_info.dylib
0x333c2000 - 0x333c9fff AggregateDictionary armv7 <ab9777b39e8e3026ad64dc90323cad7e> /System/Library/PrivateFrameworks/AggregateDictionary.framework/AggregateDictionary
0x334d1000 - 0x335d9fff CoreData armv7 <9843a401dd1d322383e3e40021cc8b95> /System/Library/Frameworks/CoreData.framework/CoreData
0x3360b000 - 0x3360ffff libGFXShared.dylib armv7 <2c61a8f7e7bf32d890e957d768d769ce> /System/Library/Frameworks/OpenGLES.framework/libGFXShared.dylib
0x33610000 - 0x33617fff libbz2.1.0.dylib armv7 <0a082e1d475432959ba93aa3dbf7fb31> /usr/lib/libbz2.1.0.dylib
0x33618000 - 0x33619fff DataMigration armv7 <42e9e87a4e0735c3837e27d4f2adcf55> /System/Library/PrivateFrameworks/DataMigration.framework/DataMigration
0x3361a000 - 0x33689fff ProofReader armv7 <6d843c6aecdd37ae84baa40af8ad7e65> /System/Library/PrivateFrameworks/ProofReader.framework/ProofReader
0x336a3000 - 0x33752fff QuartzCore armv7 <ef9632c9781f3101916b65e9faae1579> /System/Library/Frameworks/QuartzCore.framework/QuartzCore
0x33783000 - 0x33829fff Celestial armv7 <6a54406a081a3b5fa6b22754b013b629> /System/Library/PrivateFrameworks/Celestial.framework/Celestial
0x33848000 - 0x33851fff MobileWiFi armv7 <03d98d5cf6383695aa7d8a88da52f410> /System/Library/PrivateFrameworks/MobileWiFi.framework/MobileWiFi
0x3533c000 - 0x35349fff libbsm.0.dylib armv7 <0a1e2bb78d5138419ecad8ba0fe42fdd> /usr/lib/libbsm.0.dylib
0x35371000 - 0x35380fff Notes armv7 <d9c976ca976e3d029f69febd48f17601> /System/Library/PrivateFrameworks/Notes.framework/Notes
0x35381000 - 0x3538efff libdispatch.dylib armv7 <6c4eeb08757b365f8429ef6747f89ad3> /usr/lib/system/libdispatch.dylib
0x356a3000 - 0x356a4fff CoreSurface armv7 <7b83cd757da73e6e826693c29296d3fa> /System/Library/PrivateFrameworks/CoreSurface.framework/CoreSurface
0x356a5000 - 0x356a9fff libcache.dylib armv7 <36e96d0a7dda330281a43172d0ada49a> /usr/lib/system/libcache.dylib
0x356aa000 - 0x356defff VideoToolbox armv7 <aec2e22a2055380e82d4d0279faad0a7> /System/Library/PrivateFrameworks/VideoToolbox.framework/VideoToolbox
0x356ea000 - 0x35738fff GMM armv7 <049361f664eb3f30b0d25cd56ffc1f0f> /System/Library/PrivateFrameworks/GMM.framework/GMM
0x35739000 - 0x357d6fff AddressBookUI armv7 <e354aeb3d96e30338e90cc3638ffe81b> /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI
0x357d7000 - 0x3581dfff CoreTelephony armv7 <4319daea186b3a22b148ca78000f11ce> /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony
0x358e7000 - 0x359d4fff libiconv.2.dylib armv7 <f4146ce07e3031ea8a81fa5516fd77d0> /usr/lib/libiconv.2.dylib
0x35ad9000 - 0x35ae2fff ITSync armv7 <dc57c003aad83864827ccf95fc579563> /System/Library/PrivateFrameworks/ITSync.framework/ITSync
0x35ae3000 - 0x35b1ffff libGLImage.dylib armv7 <79d00adb09de3da991ed21f48f27adb4> /System/Library/Frameworks/OpenGLES.framework/libGLImage.dylib
0x35b20000 - 0x35c3ffff Foundation armv7 <09ff368178c5321c9715b9c8d491d53f> /System/Library/Frameworks/Foundation.framework/Foundation
0x35c65000 - 0x35c69fff AssetsLibraryServices armv7 <e1cbfe599c96369ca4bdb0dd99d3cd9f> /System/Library/PrivateFrameworks/AssetsLibraryServices.framework/AssetsLibraryServices
0x35cd9000 - 0x35dddfff JavaScriptCore armv7 <f63386018d703534b766514e4bbbd1d8> /System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore
0x35dde000 - 0x35e8ffff WebKit armv7 <eb9a0d69c64b3127b2bffd71641add3b> /System/Library/PrivateFrameworks/WebKit.framework/WebKit
0x35e99000 - 0x35e9bfff CrashReporterSupport armv7 <c0617d2a41283cc2bff1a1d770c06f8b> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/CrashReporterSupport
0x36076000 - 0x36190fff libicucore.A.dylib armv7 <bada0c2725bb31a483d5adf9aaf1f8df> /usr/lib/libicucore.A.dylib
0x36197000 - 0x36199fff MobileInstallation armv7 <94b6d6c5d9883175af26764567528127> /System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation
0x3619a000 - 0x3627ffff CoreFoundation armv7 <4f643539f91f330790f112ea7150b3a8> /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
0x36280000 - 0x362affff SystemConfiguration armv7 <1d73b8a159363f96bb9c039655c5eae6> /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
0x362b0000 - 0x362effff libSystem.B.dylib armv7 <b5735b0f3dba32c087c5b58aa48ae592> /usr/lib/libSystem.B.dylib
0x3664b000 - 0x36658fff DataDetectorsUI armv7 <d454cde062983860a41694922eb5c042> /System/Library/PrivateFrameworks/DataDetectorsUI.framework/DataDetectorsUI
0x36659000 - 0x366a3fff libstdc++.6.dylib armv7 <b2cac408951c3f3c9ba3cf563e54ce81> /usr/lib/libstdc++.6.dylib
0x366bb000 - 0x36750fff ImageIO armv7 <d520e3241d1130e8ac1375ee0f2c1095> /System/Library/Frameworks/ImageIO.framework/ImageIO
0x3677d000 - 0x36788fff libz.1.dylib armv7 <ac706bee36593dc683fd5a96a389d72e> /usr/lib/libz.1.dylib
0x3678e000 - 0x36793fff libcopyfile.dylib armv7 <a19b1caf96c73568b14a1660f147ae2f> /usr/lib/system/libcopyfile.dylib
0x367d1000 - 0x367d6fff libsystem_dnssd.dylib armv7 <1eaf25ddd98e3a249bca536671c5819d> /usr/lib/system/libsystem_dnssd.dylib
0x36837000 - 0x36839fff MailServices armv7 <74ae0145ef713c6d91fd8f68885b0a61> /System/Library/PrivateFrameworks/MailServices.framework/MailServices
0x3683a000 - 0x3686ffff AddressBook armv7 <3f2071a77bc134cd82065eef90d4082f> /System/Library/Frameworks/AddressBook.framework/AddressBook
0x368f3000 - 0x368f8fff liblaunch.dylib armv7 <f5ccc8234aea3ebd9a88bd37f0fa23ae> /usr/lib/system/liblaunch.dylib
0x3691f000 - 0x36926fff WebUI armv7 <74070ad76277301fba6d3a5eb5f214b1> /System/Library/PrivateFrameworks/WebUI.framework/WebUI
0x36930000 - 0x3695efff DataAccess armv7 <3a2e67aa1d8834b7a8fc2fbb56654b15> /System/Library/PrivateFrameworks/DataAccess.framework/DataAccess
0x36a5f000 - 0x36a5ffff libsystem_sandbox.dylib armv7 <f47c01d627853b328e088b3fdd08e87d> /usr/lib/system/libsystem_sandbox.dylib
0x36a70000 - 0x36a76fff ProtocolBuffer armv7 <f9277ee9b85b3722975ad319a323aca0> /System/Library/PrivateFrameworks/ProtocolBuffer.framework/ProtocolBuffer
0x36a7b000 - 0x36a80fff libnotify.dylib armv7 <9d7198e91de9386a9e5ea43608a66a57> /usr/lib/system/libnotify.dylib
0x36bd9000 - 0x36c0cfff QuickLook armv7 <29d2d981d1d6358381f5716ee37314b4> /System/Library/Frameworks/QuickLook.framework/QuickLook
0x36d2c000 - 0x36d4bfff Bom armv7 <b178e3efb4d733c694bd5a55e57a314f> /System/Library/PrivateFrameworks/Bom.framework/Bom
0x36d4c000 - 0x36d9afff CoreMotion armv7 <8660c1394c5c39089407c07fd7fd8b52> /System/Library/Frameworks/CoreMotion.framework/CoreMotion
0x36d9b000 - 0x36dcefff StoreServices armv7 <a74659288dea34bca7a7911c19cf2c28> /System/Library/PrivateFrameworks/StoreServices.framework/StoreServices
0x36dfb000 - 0x36e0bfff DataAccessExpress armv7 <66d9047da79a31daa887e6d84c42ecb2> /System/Library/PrivateFrameworks/DataAccessExpress.framework/DataAccessExpress
0x36e50000 - 0x36ea1fff libsqlite3.dylib armv7 <8a41cc6a6d9332308bc415d27577fd24> /usr/lib/libsqlite3.dylib
0x36ecc000 - 0x36ef5fff MobileCoreServices armv7 <57fef84bdc17301d8bf53ba0fb967fe6> /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
0x36f26000 - 0x36f27fff libsystem_blocks.dylib armv7 <ccc041df3de73eafb7a59e74cdb1702b> /usr/lib/system/libsystem_blocks.dylib
0x36f28000 - 0x36f60fff libCGFreetype.A.dylib armv7 <ccea634795153164a681f0f311f4461d> /System/Library/Frameworks/CoreGraphics.framework/Resources/libCGFreetype.A.dylib
0x36f63000 - 0x36f73fff WebBookmarks armv7 <6956561235333e74b8ff316cb2edc93e> /System/Library/PrivateFrameworks/WebBookmarks.framework/WebBookmarks
0x36f74000 - 0x36f77fff CaptiveNetwork armv7 <fc834fd33a18341ea7506587ad895703> /System/Library/PrivateFrameworks/CaptiveNetwork.framework/CaptiveNetwork
0x36f78000 - 0x36f84fff SpringBoardServices armv7 <c68262667ac8397a949ce4e92dfec7db> /System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices
0x36f87000 - 0x3704bfff libobjc.A.dylib armv7 <f855251d90a53bdbb5d5a39fdbde6d9b> /usr/lib/libobjc.A.dylib
0x3704c000 - 0x3707ffff AppSupport armv7 <0217468bd9f839229a47910b7816b3d5> /System/Library/PrivateFrameworks/AppSupport.framework/AppSupport
0x37081000 - 0x3708ffff OpenGLES armv7 <f02d1c50f0f33991adb1a2caed02eb77> /System/Library/Frameworks/OpenGLES.framework/OpenGLES
0x37093000 - 0x370cafff Security armv7 <163414ba17df347ca76088015010e2c4> /System/Library/Frameworks/Security.framework/Security
0x370d1000 - 0x37225fff AudioToolbox armv7 <6619c8c13f8d328e923e797fa8d0df23> /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
0x37226000 - 0x37263fff CoreText armv7 <fb6a72faec2330c4b2cd33c2e9c59588> /System/Library/Frameworks/CoreText.framework/CoreText
0x3726c000 - 0x3726dfff libdyld.dylib armv7 <41a7b5e5d9983449ab33affed0f635ad> /usr/lib/system/libdyld.dylib
Edit 2:
Here's the [CustomTarBarController onButtonTouchDown:] method:
- (void)onButtonTouchDown:(NSUInteger)i {
self.selectedIndex = i;
for (UINavigationController *_controller in self.viewControllers) {
[_controller popToRootViewControllerAnimated:YES];
}
}

Answer 1

Try using popToRootViewControllerAnimated: without animation. I remember that once I've got crashes that have been caused by several animations at once; for example, with code like this:
[self.modalView dismissModalViewControllerAnimated:YES];
[self.navigationController popToTootViewControllerAnimated:YES];
In my case I just set YES in second line to NO, and it helped.

Answer 2

why are you using a for statement? Comment it out and see if that works for you.
- (void)onButtonTouchDown:(NSUInteger)i {
self.selectedIndex = i;
[self.navigationController popToRootViewControllerAnimated:YES];
}