The entry function calls of the crash stack are all JSObjectCallAsFunction, but the subsequent crash location is different on each system. We have suspected a memory problem, but the device still has a lot of available memory. In addition, this method will be called frequently and debugging will take a long time. It only happens once in a while that I don’t have any troubleshooting ideas.
This is the crash stack on ios17, Could it be related to the release of certain variables? Or is there some hard-to-find problem with javascriptcore？
JavaScriptCore JSC::JSFinalObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) 1 JavaScriptCore JSC::SlotVisitor::drain(WTF::MonotonicTime) 2 JavaScriptCore JSC::SlotVisitor::drain(WTF::MonotonicTime) 3 JavaScriptCore JSC::Heap::runFixpointPhase(JSC::GCConductor) 4 JavaScriptCore JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) 5 JavaScriptCore WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_23>::implFunction(void*, JSC::CurrentThreadState&) 6 JavaScriptCore JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&) 7 JavaScriptCore JSC::Heap::collectInMutatorThread() 8 JavaScriptCore JSC::Heap::stopIfNecessary() 9 JavaScriptCore JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 10 JavaScriptCore _llint_slow_path_new_func_exp 11 JavaScriptCore _llint_function_for_construct_arity_checkTagGateAfter 12 JavaScriptCore _llint_function_for_construct_arity_checkTagGateAfter 13 JavaScriptCore _vmEntryToJavaScriptTrampoline 14 JavaScriptCore JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 15 JavaScriptCore _JSObjectCallAsFunction 16 **APPNAME** script::jsc_backend::toJscValues<script::Local<script::Value>, script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> const*) const::$_0>(OpaqueJSContext*, unsigned long, script::Local<script::Value> const*, script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> **APPNAME**const*) const::$_0)::{lambda(OpaqueJSValue const**)#1}::operator()(OpaqueJSValue const**) const JscHelper.hpp:36 17 **APPNAME** script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> const*) const JscLocalReference.cc:498 An occasional issue that occurs when calling JSObject CallAsFunction frequently, with many instances on IOS13, IOS14, and IOS17.4.1, without any solution
