NSInvocation appears to add all retained arguments (which includes the target) into an internal NSArray when retainArguments is turned on, and never removes them. This array is only freed up when the invocation itself is dealloced. Because CTAppearance by necessity has its stored invocations retain their arguments, every target the calls were invoked on got added to these arrays, and were never freed. They will not show up in Leaks because there are valid pointers to them.

My fix is to only turn on retainArguments if any of the arguments are in fact objects, since we never care about retaining the targets (and I don't think we care about retaining the return values, so I didn't check for that). Most setter methods of scalar values will fall into this category, so it seems worth it to check. When invoking, if the NSInvocation does not retain arguments, we can call invokeWithTarget: directly. Otherwise, we have to make a new NSInvocation instance as a copy, and call invokeWithTarget on the copy instead, to avoid the target from being retained, or if it is retained, then the copy will be dealloced right away and the strong reference will be released.