I've had some downtime so I spent about 2 hours analyzing this problem. I stripped out all of the internal calls so the buck stops at allocWithZone....as in the following (instead of NSAllocateObject):
size_t size = class_getInstanceSize([self class]);
if(size < 16) size = 16;
id result = (id)malloc(size);
bzero(result,size);
if(result) result->isa = [self class];
return result;
In the SPRectangle methods, etc, I changed them to directly call allocWithZone:nil and the result was the same...same leaks. This is quite puzzling....I checked the assembly too and it is line per line the same instructions in both SDKs.
UPDATE: I am pretty sure I found the function responsible for the performance hits, but I don't know how it relates to the memory leaks (I'm convinced they are false positives). If I run the Time Profiler on Pandemic in simulator 4.3, all is well. If I run it in simulator 5 (or device 5) I notice a new function that wasn't present in 4.3. It is a C++ function from the libobjc.A.dylib library called (it is really long):
objc::DenseMap<objc_object*, unsigned long, true, objc::DenseMapInfo<objc_object*>, objc::DenseMapInfo<unsigned long> >::LookupBucketFor(objc_object*, const&, std::pair<objc_object*, unsigned long>*&) const
If I disable memory pooling, this function stays in about 3rd place in the low single digit percent of CPU time. If I enable memory pooling, it starts to skyrocket and gets up to 20% or more (over double the time spent on objc_msgsend).
FURTHER UPDATE: The source code for the function in question (Open Source component released by apple)
http://www.opensource.apple.com/source/objc4/objc4-493.9/runtime/llvm-DenseMap.h
It is called from the method objc_rootReleaseWasZero in this (new to iOS 5) file:
http://www.opensource.apple.com/source/objc4/objc4-493.9/runtime/objc-arr.mm