WebCore crash, iOS 11, related to UIWebView scripts. (JSC::JSLock::DropAllLocks::DropAllLocks)

Viewed 417

Tons of crashes start happening on iOS 11 in the apps using UIWebView and showing rich content, like ads or videos. It was a similar problem in 2015, which then was fixed (see here). Now it re-appears again.

I saw some similar, but I still decided to post my problem, this is not a duplicate, but aggregated information about this crash from different, seems not-related at glance sources. Hope it will help to bring attention and solve the case faster. I also want to give bounty on the solution, so please don't remove this question.

  1. My case - UIWebView in native Obj-C app. The problem only appears to happens in free version, which serves the ads. The date when it starts - July, 22. It was no app update at the time. All crashes in iOS 11 only. Thousands of them. Crash stack:

Crashed: WebThread 0 JavaScriptCore 0x188a8d464 JSC::JSLock::DropAllLocks::DropAllLocks(JSC::VM&) + 176 1 JavaScriptCore 0x188a8d438 JSC::JSLock::DropAllLocks::DropAllLocks(JSC::VM&) + 132 2 WebCore
0x1897d5cec SendDelegateMessage(NSInvocation*) + 360 3 CoreFoundation 0x18163c2d4 forwarding + 624 4 CoreFoundation
0x18152241c _CF_forwarding_prep_0 + 92 5 WebCore
0x189806588 WebCore::DOMWindow::removeAllEventListeners() + 412 6 WebCore 0x1897eee3c WebCore::Document::removeAllEventListeners() + 32 7 WebCore
0x1897ed47c WebCore::Document::~Document() + 544 8 WebCore
0x18a533860 WebCore::HTMLDocument::~HTMLDocument() + 12 9 WebCore
0x1897ed11c WebCore::Node::~Node() + 384 10 WebCore
0x1898538bc WebCore::HTMLLinkElement::~HTMLLinkElement() + 12 11 JavaScriptCore 0x188a69a5c void JSC::MarkedBlock::Handle::specializedSweep(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 196 12 JavaScriptCore
0x188a6846c void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 348 13 JavaScriptCore 0x188a67fa4 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) + 320 14 JavaScriptCore
0x188a67e58 JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) + 32 15 JavaScriptCore 0x1887e997c JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) + 372 16 JavaScriptCore 0x1887e0064 JSC::IncrementalSweeper::sweepNextBlock() + 132 17 JavaScriptCore
0x1881c27fc JSC::IncrementalSweeper::doWork() + 72 18 JavaScriptCore
0x188aad864 JSC::JSRunLoopTimer::timerDidFireCallback(CFRunLoopTimer*, void*) + 76 19 CoreFoundation 0x1815dfaa8 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION + 28 20 CoreFoundation 0x1815df76c __CFRunLoopDoTimer + 864 21 CoreFoundation 0x1815df010 __CFRunLoopDoTimers + 248 22 CoreFoundation 0x1815dcb60 __CFRunLoopRun + 2168 23 CoreFoundation 0x1814fcda8 CFRunLoopRunSpecific + 552 24 WebCore 0x1897c02d4 RunWebThread(void*) + 592 25 libsystem_pthread.dylib 0x18125d220 _pthread_body + 272 26 libsystem_pthread.dylib 0x18125d110 _pthread_body + 290 27 libsystem_pthread.dylib 0x18125bb10 thread_start + 4

  1. React Native IOS 11.3 - 11.4 Error: JavaScriptCore JSC::JSLock::DropAllLocks::DropAllLocks. It seems that embedded Video Widget causes the same problem, also only iOS 11. The React Native platform seems unrelated, because the problem happens also in native Obj-C apps.

  2. Javascript core crash when using YouTube iframe player in UIWebView in iOS 11.3. YouTube iframe player causes the same problem. Again, all starts iOS 11.

This is huge problem, please advise and help us solve this. Thanks!

0 Answers
Related