ParticalTest Crashes on iPhone4 (iOS 4.3.3)

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x00000000, 0x00000000
Crashed Thread: 0

Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libsystem_kernel.dylib 0x3558fa1c pthread_kill + 8
1 libsystem_c.dylib 0x356663b4 pthread_kill + 52
2 libsystem_c.dylib 0x3565ebf8 abort + 72
3 libsystem_c.dylib 0x3568c6d4
assert_rtn + 140
4 iphone 0x000d1af4 cocos2d::CCCopying::copyWithZone(cocos2d::CCZone*) (CCObject.cpp:34)
5 iphone 0x000c56ae cocos2d::CCAtlasNode::updateBlendFunc() (CCAtlasNode.cpp:220)
6 iphone 0x000c5afa cocos2d::CCAtlasNode::initWithTileFile(char const*, unsigned int, unsigned int, unsigned int) (CCAtlasNode.cpp:92)
7 iphone 0x000d65d4 cocos2d::CCLabelAtlas::initWithString(char const**, char const**, unsigned int, unsigned int, unsigned char) (CCLabelAtlas.cpp:50)
8 iphone 0x000d66cc cocos2d::CCLabelAtlas::labelWithString(char const**, char const**, unsigned int, unsigned int, unsigned char) (CCLabelAtlas.cpp:38)
9 iphone 0x0003bcde ParticleDemo::ParticleDemo() (ParticleTest.cpp:1087)
10 iphone 0x0003fb10 createParticleLayer(int) (ParticleTest.cpp:976)
11 iphone 0x00040ce0 nextParticleAction() (ParticleTest.cpp:1018)
12 iphone 0x00040d06 ParticleTestScene::runThisTest() (ParticleTest.cpp:1202)
13 iphone 0x0002af26 TestController::menuCallback(cocos2d::CCObject*) (controller.cpp:173)
14 iphone 0x000e085c cocos2d::CCMenuItem::activate() (CCMenuItem.cpp:94)
15 iphone 0x000e0958 cocos2d::CCMenuItemLabel::activate() (CCMenuItem.cpp:200)
16 iphone 0x0013ac44 cocos2d::CCMenu::ccTouchEnded(cocos2d::CCTouch**, cocos2d::CCEvent**) (CCMenu.cpp:205)
17 iphone 0x00124a10 cocos2d::CCTouchDispatcher::touches(cocos2d::CCSet**, cocos2d::CCEvent**, unsigned int) (CCTouchDispatcher.cpp:347)
18 iphone 0x00124e5e cocos2d::CCTouchDispatcher::touchesEnded(cocos2d::CCSet**, cocos2d::CCEvent**) (CCTouchDispatcher.cpp:477)
19 iphone 0x000f205c cocos2d::CCEGLView::touchesEnded(cocos2d::CCSet*) (CCEGLView_ios.mm:103)
20 iphone 0x000f9378 ~~
21 UIKit 0x309fdbee~~[UIWindow sendTouchesForEvent:] + 362
22 UIKit 0x309fd568 + 256
23 UIKit 0x309e630c
+ 292
24 UIKit 0x309e5c4c
UIApplicationHandleEvent + 5084
25 GraphicsServices 0x30269e70 PurpleEventCallback + 660
26 CoreFoundation 0x30957a90 CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION + 20
27 CoreFoundation 0x30959838 CFRunLoopDoSource1 + 160
28 CoreFoundation 0x3095a606
CFRunLoopRun + 514
29 CoreFoundation 0x308eaebc CFRunLoopRunSpecific + 224
30 CoreFoundation 0x308eadc4 CFRunLoopRunInMode + 52
31 GraphicsServices 0x30269418 GSEventRunModal + 108
32 GraphicsServices 0x302694c4 GSEventRun + 56
33 UIKit 0x30a10d62 + 398
34 UIKit 0x30a0e800 UIApplicationMain + 664
35 iphone 0x00002cf0 main
36 iphone 0x00002cb8 start + 32
Thread 1 name: Dispatch queue: com.apple.libdispatch-manager
Thread 1:
0 libsystem_kernel.dylib 0x35590fbc kevent + 24
1 libdispatch.dylib 0x35261032 dispatch_mgr_invoke + 706
2 libdispatch.dylib 0x3526203a
dispatch_queue_invoke + 86
3 libdispatch.dylib 0x352615ea dispatch_worker_thread2 + 186
4 libsystem_c.dylib 0x3566758a
pthread_wqthread + 258
5 libsystem_c.dylib 0x35667bbc start_wqthread + 0
Thread 2 name: WebThread
Thread 2:
0 libsystem_kernel.dylib 0x3558dc00 mach_msg_trap + 20
1 libsystem_kernel.dylib 0x3558d758 mach_msg + 44
2 CoreFoundation 0x309582b8 CFRunLoopServiceMachPort + 88
3 CoreFoundation 0x3095a562
CFRunLoopRun + 350
4 CoreFoundation 0x308eaebc CFRunLoopRunSpecific + 224
5 CoreFoundation 0x308eadc4 CFRunLoopRunInMode + 52
6 WebCore 0x35f5327e ZL12RunWebThreadPv + 382
7 libsystem_c.dylib 0x3566630a
pthread_start + 242
8 libsystem_c.dylib 0x35667bb4 thread_start + 0
Thread 3:
0 libsystem_kernel.dylib 0x355903ec **workq_kernreturn + 8
1 libsystem_c.dylib 0x356676d8pthread_wqthread + 592
2 libsystem_c.dylib 0x35667bbc start_wqthread + 0
Thread 4:
0 libsystem_kernel.dylib 0x3558dc00 mach_msg_trap + 20
1 libsystem_kernel.dylib 0x3558d758 mach_msg + 44
2 libsystem_kernel.dylib 0x3558a630 thread_policy + 116
3 libsystem_c.dylib 0x35665b3e pthread_setschedparam_internal + 62
4 libsystem_c.dylib 0x356673c6 pthread_setschedparam + 74
5 TextInput 0x318a15aa KB::kb_set_thread_priority + 18
6 TextInput 0x318921b4
ZN2KBL14BackgroundLoadEPv + 84
7 libsystem_c.dylib 0x3566630a _pthread_start + 242
8 libsystem_c.dylib 0x35667bb4 thread_start + 0
Thread 0 crashed with ARM Thread State:
r0: 0x00000000 r1: 0x00000000 r2: 0x00000001 r3: 0x00000000
r4: 0x3ef6348c r5: 0x00000006 r6: 0x00000022 r7: 0x2fecbad0
r8: 0x0024ee9c r9: 0x00000000 r10: 0x00255fb0 r11: 0x00000000
ip: 0x00000148 sp: 0x2fecbac4 lr: 0x3589b3bb pc: 0x357c4a1c
cpsr: 0x000f0010
Binary Images:
0xcf000
0x26afff iphone armv7 /var/mobile/Applications/AE090D73-1C6C-4F5A-8396-3B66DE212D66/iphone.app/iphone
0x56f000 - 0x56ffff
MobileSubstrate.dylib armv6 <4070bd34b2c273416bcec248fd8b873d> /Library/MobileSubstrate/MobileSubstrate.dylib
0x5a3000 - 0x5a4fff SubstrateLoader.dylib armv6 /Library/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateLoader.dylib
0x164c000 - 0x1671fff
Activator.dylib armv6 <40b211a1d5903dad9847e6d62468cedf> /Library/MobileSubstrate/DynamicLibraries/Activator.dylib
0x1682000 - 0x1688fff libstatusbar.dylib armv6 /Library/MobileSubstrate/DynamicLibraries/libstatusbar.dylib
0x168c000 - 0x168ffff libsubstrate.dylib armv6 <5f24c4f6863b75d701ee663ed761c423> /usr/lib/libsubstrate.dylib
0x2fece000 - 0x2fef3fff dyld armv7 /usr/lib/dyld
0x3023a000 - 0x30263fff MobileCoreServices armv7 <57fef84bdc17301d8bf53ba0fb967fe6> /System/Library/Frameworks/MobileCoreServices.framework/MobileCoreServices
0x30264000 - 0x3029bfff Security armv7 <6599f42a910b3b31a0e1d98c883d61cb> /System/Library/Frameworks/Security.framework/Security
0x3029c000 - 0x3029dfff libsystem_network.dylib armv7 <39bf0f48bd8539169a77f8f61cdcd4c9> /usr/lib/system/libsystem_network.dylib
0x302fa000 - 0x302fafff Accelerate armv7 <7d5ad465049136afaa1f0d89aac600bc> /System/Library/Frameworks/Accelerate.framework/Accelerate
0x303f8000 - 0x3048dfff ImageIO armv7 /System/Library/Frameworks/ImageIO.framework/ImageIO
0x3049a000 - 0x304a6fff GraphicsServices armv7 /System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices
0x305bb000 - 0x305effff VideoToolbox armv7 <570c63dc3a273a5a8c9072fd5567f5c1> /System/Library/PrivateFrameworks/VideoToolbox.framework/VideoToolbox
0x30605000 - 0x30607fff libgcc_s.1.dylib armv7 /usr/lib/libgcc_s.1.dylib
0x30608000 - 0x30722fff libicucore.A.dylib armv7 /usr/lib/libicucore.A.dylib
0x30727000 - 0x3073dfff EAP8021X armv7 <9fefc0ada30435fbb3b51818c74f6cb8> /System/Library/PrivateFrameworks/EAP8021X.framework/EAP8021X
0x308cb000 - 0x308d2fff libMobileGestalt.dylib armv7 <55f29184efcc3046bb833dd72a4487e1> /usr/lib/libMobileGestalt.dylib
0x308d6000 - 0x308defff MobileBluetooth armv7 <63f11756c4aa3262b2317ff3b8e2a977> /System/Library/PrivateFrameworks/MobileBluetooth.framework/MobileBluetooth
0x308df000 - 0x308dffff vecLib armv7 <0c60cd0a60f43d2791d36cb357d30e3c> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/vecLib
0x3091c000 - 0x30959fff CoreText armv7 /System/Library/Frameworks/CoreText.framework/CoreText
0x30a64000 - 0x30ab2fff CoreMotion armv7 <58c353bb7e33361f881da07c72f4cdfb> /System/Library/Frameworks/CoreMotion.framework/CoreMotion
0x30b17000 - 0x30bfcfff CoreFoundation armv7 /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
0x30c17000 - 0x30fa4fff UIKit armv7 /System/Library/Frameworks/UIKit.framework/UIKit
0x30fc5000 - 0x310b2fff libiconv.2.dylib armv7 /usr/lib/libiconv.2.dylib
0x310b3000 - 0x310b4fff libremovefile.dylib armv7 /usr/lib/system/libremovefile.dylib
0x310b5000 - 0x310bffff AccountSettings armv7 /System/Library/PrivateFrameworks/AccountSettings.framework/AccountSettings
0x310c5000 - 0x310cefff CoreVideo armv7 /System/Library/Frameworks/CoreVideo.framework/CoreVideo
0x3111f000 - 0x31121fff libAccessibility.dylib armv7 /usr/lib/libAccessibility.dylib
0x31122000 - 0x31173fff libsqlite3.dylib armv7 <8a41cc6a6d9332308bc415d27577fd24> /usr/lib/libsqlite3.dylib
0x3118d000 - 0x31194fff libbz2.1.0.dylib armv7 <0a082e1d475432959ba93aa3dbf7fb31> /usr/lib/libbz2.1.0.dylib
0x31195000 - 0x311d8fff ManagedConfiguration armv7 /System/Library/PrivateFrameworks/ManagedConfiguration.framework/ManagedConfiguration
0x311d9000 - 0x311defff liblaunch.dylib armv7 /usr/lib/system/liblaunch.dylib
0x31219000 - 0x31224fff libz.1.dylib armv7 /usr/lib/libz.1.dylib
0x31225000 - 0x31371fff MediaToolbox armv7 <482b13059e8a329fa5d832baede25103> /System/Library/PrivateFrameworks/MediaToolbox.framework/MediaToolbox
0x31395000 - 0x31395fff libdnsinfo.dylib armv7 <21415179ffa03f949fa8cc851c6c31c7> /usr/lib/system/libdnsinfo.dylib
0x31396000 - 0x31397fff libsystem_blocks.dylib armv7 /usr/lib/system/libsystem_blocks.dylib
0x31398000 - 0x313b8fff PrintKit armv7 /System/Library/PrivateFrameworks/PrintKit.framework/PrintKit
0x313c5000 - 0x31407fff CoreAudio armv7 /System/Library/Frameworks/CoreAudio.framework/CoreAudio
0x31992000 - 0x319d2fff CoreMedia armv7 <8e0570582ba535bfa74f1f00eef64376> /System/Library/Frameworks/CoreMedia.framework/CoreMedia
0x319da000 - 0x31a12fff IOKit armv7 <80ae313ad69d3363935c88e51a11862d> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x31a53000 - 0x31a8ffff libGLImage.dylib armv7 <9d97699e44ee3651ba4ac37e5adec35b> /System/Library/Frameworks/OpenGLES.framework/libGLImage.dylib
0x31aba000 - 0x33508fff TextInput armv7 /System/Library/PrivateFrameworks/TextInput.framework/TextInput
0x33655000 - 0x3365afff MobileKeyBag armv7 <8c35c090bc373cb181fc26b961b8dba5> /System/Library/PrivateFrameworks/MobileKeyBag.framework/MobileKeyBag
0x3365b000 - 0x33664fff MobileWiFi armv7 <03d98d5cf6383695aa7d8a88da52f410> /System/Library/PrivateFrameworks/MobileWiFi.framework/MobileWiFi
0x3376e000 - 0x33771fff ApplePushService armv7 <015c68c15621348db9f6a012499170e1> /System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService
0x33772000 - 0x337b8fff CoreTelephony armv7 /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony
0x337b9000 - 0x337c5fff SpringBoardServices armv7 /System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices
0x33863000 - 0x33878fff OpenAL armv7 <162722d7da273d649798b27ae0e4458c> /System/Library/Frameworks/OpenAL.framework/OpenAL
0x3389a000 - 0x3389cfff IOMobileFramebuffer armv7 <683f321680763e519d61541170ba2133> /System/Library/PrivateFrameworks/IOMobileFramebuffer.framework/IOMobileFramebuffer
0x3389d000 - 0x338a2fff libcopyfile.dylib armv7 /usr/lib/system/libcopyfile.dylib
0x3398e000 - 0x33992fff libGFXShared.dylib armv7 /System/Library/Frameworks/OpenGLES.framework/libGFXShared.dylib
0x33ac8000 - 0x33accfff AssetsLibraryServices armv7 /System/Library/PrivateFrameworks/AssetsLibraryServices.framework/AssetsLibraryServices
0x33ace000 - 0x33b7ffff WebKit armv7 /System/Library/PrivateFrameworks/WebKit.framework/WebKit
0x33b80000 - 0x33b8dfff libbsm.0.dylib armv7 <0a1e2bb78d5138419ecad8ba0fe42fdd> /usr/lib/libbsm.0.dylib
0x33c66000 - 0x33c6cfff liblockdown.dylib armv7 <14c89b7346433c1f8675f454531f6ca3> /usr/lib/liblockdown.dylib
0x33f47000 - 0x33f48fff libdyld.dylib armv7 <41a7b5e5d9983449ab33affed0f635ad> /usr/lib/system/libdyld.dylib
0x33fb2000 - 0x33fb4fff CrashReporterSupport armv7 <9e7efa009730322f84bbc5d8bf1ded94> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/CrashReporterSupport
0x33fb5000 - 0x33fb8fff libmacho.dylib armv7 <43311c113a9d3182b7d007129819f029> /usr/lib/system/libmacho.dylib
0x33fb9000 - 0x33fcefff libresolv.9.dylib armv7 /usr/lib/libresolv.9.dylib
0x341d5000 - 0x341d8fff IOSurface armv7 /System/Library/PrivateFrameworks/IOSurface.framework/IOSurface
0x341d9000 - 0x34227fff GMM armv7 <049361f664eb3f30b0d25cd56ffc1f0f> /System/Library/PrivateFrameworks/GMM.framework/GMM
0x342d9000 - 0x34338fff libBLAS.dylib armv7 <0b36b2272aa33a8c9aa22d99c89d7189> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBLAS.dylib
0x34339000 - 0x343bdfff AVFoundation armv7 /System/Library/Frameworks/AVFoundation.framework/AVFoundation
0x343e8000 - 0x34507fff Foundation armv7 <09ff368178c5321c9715b9c8d491d53f> /System/Library/Frameworks/Foundation.framework/Foundation
0x345d4000 - 0x34683fff QuartzCore armv7 /System/Library/Frameworks/QuartzCore.framework/QuartzCore
0x34684000 - 0x346cafff CoreLocation armv7 /System/Library/Frameworks/CoreLocation.framework/CoreLocation
0x346cc000 - 0x34790fff libobjc.A.dylib armv7 <6b51e76fde9f381bb7b3bc5badbfee3a> /usr/lib/libobjc.A.dylib
0x34976000 - 0x349a9fff AppSupport armv7 <0217468bd9f839229a47910b7816b3d5> /System/Library/PrivateFrameworks/AppSupport.framework/AppSupport
0x349aa000 - 0x349b1fff AggregateDictionary armv7 /System/Library/PrivateFrameworks/AggregateDictionary.framework/AggregateDictionary
0x349b2000 - 0x349b3fff DataMigration armv7 <42e9e87a4e0735c3837e27d4f2adcf55> /System/Library/PrivateFrameworks/DataMigration.framework/DataMigration
0x349b4000 - 0x34ad5fff CoreGraphics armv7 <65f6c8701b563542820a26b0dfc4f6a4> /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics
0x34b16000 - 0x34e03fff libLAPACK.dylib armv7 /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLAPACK.dylib
0x34e2f000 - 0x34e64fff AddressBook armv7 <3f2071a77bc134cd82065eef90d4082f> /System/Library/Frameworks/AddressBook.framework/AddressBook
0x34e65000 - 0x34f24fff CFNetwork armv7 /System/Library/Frameworks/CFNetwork.framework/CFNetwork
0x34f25000 - 0x34f3efff libRIP.A.dylib armv7 <4825c3e392983aba947eca06555e4480> /System/Library/Frameworks/CoreGraphics.framework/Resources/libRIP.A.dylib
0x34f5b000 - 0x3505bfff libGLProgrammability.dylib armv7 /System/Library/Frameworks/OpenGLES.framework/libGLProgrammability.dylib
0x3505f000 - 0x351b3fff AudioToolbox armv7 <6619c8c13f8d328e923e797fa8d0df23> /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox
0x35254000 - 0x35255fff CoreSurface armv7 <7b83cd757da73e6e826693c29296d3fa> /System/Library/PrivateFrameworks/CoreSurface.framework/CoreSurface
0x3525a000 - 0x35303fff libxml2.2.dylib armv7 <5538d3f2c7d83b88b06168488fe6326b> /usr/lib/libxml2.2.dylib
0x3532e000 - 0x35333fff libsystem_dnssd.dylib armv7 /usr/lib/system/libsystem_dnssd.dylib
0x35334000 - 0x35420fff GLEngine armv7 /System/Library/Frameworks/OpenGLES.framework/GLEngine.bundle/GLEngine
0x35421000 - 0x3543efff libsystem_info.dylib armv7 <48016be86e3f3cd9aeee1c6590e1ac6f> /usr/lib/system/libsystem_info.dylib
0x35478000 - 0x3548afff PersistentConnection armv7 <659ea9d5b13d3fefb37acff09016a69c> /System/Library/PrivateFrameworks/PersistentConnection.framework/PersistentConnection
0x3548b000 - 0x3548ffff libcache.dylib armv7 /usr/lib/system/libcache.dylib
0x35490000 - 0x3549dfff libdispatch.dylib armv7 <9a0511ad5ebc3db898f1f49ed1a73d34> /usr/lib/system/libdispatch.dylib
0x354ce000 - 0x3550dfff libSystem.B.dylib armv7 <33dcf9a403ae3fd5971d6030ada2fcab> /usr/lib/libSystem.B.dylib
0x3550e000 - 0x3550efff libCVMSPluginSupport.dylib armv7 <42d8aa2a31843a6e8bfff745644a7ba5> /System/Library/Frameworks/OpenGLES.framework/libCVMSPluginSupport.dylib
0x355ad000 - 0x3561cfff ProofReader armv7 <6d843c6aecdd37ae84baa40af8ad7e65> /System/Library/PrivateFrameworks/ProofReader.framework/ProofReader
0x3561d000 - 0x35672fff libvDSP.dylib armv7 <0221caba81a235c5a896a835e2aac047> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvDSP.dylib
0x35680000 - 0x357acfff libmecabra.dylib armv7 <113de5f9858c32b8b158bfdc68042a97> /usr/lib/libmecabra.dylib
0x357af000 - 0x357b2fff CaptiveNetwork armv7 /System/Library/PrivateFrameworks/CaptiveNetwork.framework/CaptiveNetwork
0x357b3000 - 0x357cafff libsystem_kernel.dylib armv7 /usr/lib/system/libsystem_kernel.dylib
0x35819000 - 0x35863fff libstdc
*.6.dylib armv7 /usr/lib/libstdc*+.6.dylib
0x35864000 - 0x35866fff MobileInstallation armv7 <94b6d6c5d9883175af26764567528127> /System/Library/PrivateFrameworks/MobileInstallation.framework/MobileInstallation
0x35868000 - 0x358e9fff libsystem_c.dylib armv7 /usr/lib/system/libsystem_c.dylib
0x358ea000 - 0x35922fff libCGFreetype.A.dylib armv7 /System/Library/Frameworks/CoreGraphics.framework/Resources/libCGFreetype.A.dylib
0x35925000 - 0x359cbfff Celestial armv7 <7fbd02fa664b33babaf0327c320d1491> /System/Library/PrivateFrameworks/Celestial.framework/Celestial
0x35d4e000 - 0x35e52fff JavaScriptCore armv7 <61a94142e2d23dafa2964190dd46e9e3> /System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore
0x35e53000 - 0x35e66fff libmis.dylib armv7 <529ea6e3a87230ce9f6cf3285c22429c> /usr/lib/libmis.dylib
0x35eb0000 - 0x35ecffff Bom armv7 /System/Library/PrivateFrameworks/Bom.framework/Bom
0x36182000 - 0x3678dfff WebCore armv7 <07941e59d0a33f94802c16c76238fddf> /System/Library/PrivateFrameworks/WebCore.framework/WebCore
0x3678e000 - 0x36794fff ProtocolBuffer armv7 /System/Library/PrivateFrameworks/ProtocolBuffer.framework/ProtocolBuffer
0x367b0000 - 0x36861fff IMGSGX535GLDriver armv7 <5cf6404bdab13066850d21477c92f4c3> /System/Library/Extensions/IMGSGX535GLDriver.bundle/IMGSGX535GLDriver
0x36862000 - 0x36891fff SystemConfiguration armv7 <1d73b8a159363f96bb9c039655c5eae6> /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration
0x3689b000 - 0x368a9fff OpenGLES armv7 <5a76beaeaa013f0cbf16e5cb154598ab> /System/Library/Frameworks/OpenGLES.framework/OpenGLES
0x368bc000 - 0x368c1fff libnotify.dylib armv7 <9d7198e91de9386a9e5ea43608a66a57> /usr/lib/system/libnotify.dylib
0x369c4000 - 0x369c4fff libsystem_sandbox.dylib armv7 /usr/lib/system/libsystem_sandbox.dylib

Which test case crashed?
I’m doing smoke test now, all particle test cases are passed on ios4.3 simulator. (Sorry I have no iphone4 device)
And do you have any progress on this crash?

Sorry, my environment is 4.3.2.
And I found it crashes on ios5 simulator.
Perhaps this bug starts since 4.3.3. I will dig it more.