UIWebView WebCore TimerBase crash only on 11.3 (15E216) : SIGTRAP WebCore _ZN7WebCore9TimerBaseD2Ev

I've recently got a crash report from Crash Report Tools. This crash is being refered to UIWebView WebCore crash, my app uses UIWebView only ,And i can't switch to WKWebview recently. Below is the crash report,and I can't reproduce it. It happened on device iPhone 6,7,8,X, but only using version iOS 11.3 (15E216).

this crash has 3 diffrent crash stack. Any advice would be helpful.

type 1:

0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::ImageLoader::~ImageLoader() + 2076   3 WebCore WebCore::HTMLImageElement::~HTMLImageElement() + 224   4 WebCore WebCore::HTMLImageElement::~HTMLImageElement() + 12   5 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   

type 2:

0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::XMLHttpRequest::~XMLHttpRequest() + 116   3 WebCore WebCore::XMLHttpRequest::~XMLHttpRequest() + 12   4 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   5 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 408   

type 3:

0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::MediaElementSession::~MediaElementSession() + 96   3 WebCore WebCore::HTMLMediaElement::~HTMLMediaElement() + 1340   4 WebCore WebCore::HTMLVideoElement::~HTMLVideoElement() + 176   5 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   

==

fully crash stack:

type 1:

#0 Thread     SIGTRAP     0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::ImageLoader::~ImageLoader() + 2076   3 WebCore WebCore::HTMLImageElement::~HTMLImageElement() + 224   4 WebCore WebCore::HTMLImageElement::~HTMLImageElement() + 12   5 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   6 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 408   7 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) + 320   8 JavaScriptCore JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) + 32   9 JavaScriptCore JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) + 372   10 JavaScriptCore JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) + 40   11 JavaScriptCore JSC::LocalAllocator::tryAllocateWithoutCollecting() + 48   12 JavaScriptCore JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 292   13 JavaScriptCore JSC::CompleteSubspace::allocateNonVirtual(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 216   14 WebCore std::__1::enable_if<std::is_same<WebCore::GainNode, WebCore::GainNode>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::GainNode>::WrapperClass*>::type WebCore::createWrapper<WebCore::GainNode, WebCore::GainNode>(WebCore::JSDOMGlobalObject*, ***::Ref<WebCore::GainNode, ***::DumbPtrTraits<WebCore::GainNode> >&&) + 220   15 WebCore WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::GainNode&) + 136   16 WebCore WebCore::jsAudioContextPrototypeFunctionCreateGain(JSC::ExecState*) + 264   17 JavaScriptCore _llint_entry + 31860   18 JavaScriptCore _llint_entry + 29020   19 JavaScriptCore _llint_entry + 30040   20 JavaScriptCore _llint_entry + 29020   21 JavaScriptCore _llint_entry + 29020   22 JavaScriptCore _llint_entry + 29020   23 JavaScriptCore _llint_entry + 29020   24 JavaScriptCore _llint_entry + 29020   25 JavaScriptCore _llint_entry + 29020   26 JavaScriptCore _llint_entry + 29020   27 JavaScriptCore _llint_entry + 29020   28 JavaScriptCore _llint_entry + 29020   29 JavaScriptCore _llint_entry + 29020   30 JavaScriptCore _llint_entry + 29020   31 JavaScriptCore _llint_entry + 29020   32 JavaScriptCore _llint_entry + 29020   33 JavaScriptCore _llint_entry + 29020   34 JavaScriptCore _llint_entry + 29020   35 JavaScriptCore _llint_entry + 29020   36 JavaScriptCore _vmEntryToJavaScript + 272   37 JavaScriptCore JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184   38 JavaScriptCore JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464   39 JavaScriptCore JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, ***::NakedPtr<JSC::Exception>&) + 180   40 WebCore WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 1176   41 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&, ***::Vector<***::RefPtr<WebCore::RegisteredEventListener, ***::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>) + 760   42 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 596   43 WebCore WebCore::EventTarget::dispatchEvent(WebCore::Event&) + 116   44 WebCore WebCore::WebSocket::didReceiveBinaryData(***::Vector<unsigned char, 0ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>&&) + 236   45 WebCore WebCore::WebSocketChannel::processFrame() + 2912   46 WebCore WebCore::WebSocketChannel::processBuffer() + 112   47 WebCore WebCore::WebSocketChannel::didReceiveSocketStreamData(WebCore::SocketStreamHandle&, char const*, unsigned long) + 112   48 WebCore WebCore::SocketStreamHandleImpl::readStreamCallback(unsigned long) + 544   49 CoreFoundation __signalEventSync + 212   50 CoreFoundation __cfstream_solo_signalEventSync + 260   51 CoreFoundation __CFStreamSignalEvent + 548   52 CFNetwork SocketStream::dispatchSignalFromSocketCallbackUnlocked(SocketStreamSignalHolder*) + 64   53 CFNetwork SocketStream::socketCallback(__CFSocket*, unsigned long, __CFData const*, void const*) + 148   54 CFNetwork SocketStream::_SocketCallBack_stream(__CFSocket*, unsigned long, __CFData const*, void const*, void*) + 88   55 CoreFoundation ___CFSocketPerformV0 + 1352   56 CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24   57 CoreFoundation ___CFRunLoopDoSources0 + 276   58 CoreFoundation ___CFRunLoopRun + 1204   59 CoreFoundation CFRunLoopRunSpecific + 552   60 GraphicsServices GSEventRunModal + 100   61 UIKit UIApplicationMain + 236   62 x5gamehelper main + 88   63 libdyld.dylib _start + 4   

type 2:

#0 Thread     SIGTRAP     0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::XMLHttpRequest::~XMLHttpRequest() + 116   3 WebCore WebCore::XMLHttpRequest::~XMLHttpRequest() + 12   4 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   5 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 408   6 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) + 320   7 JavaScriptCore JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) + 32   8 JavaScriptCore JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) + 372   9 JavaScriptCore JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) + 40   10 JavaScriptCore JSC::LocalAllocator::tryAllocateWithoutCollecting() + 48   11 JavaScriptCore JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 292   12 JavaScriptCore JSC::CompleteSubspace::allocateNonVirtual(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 216   13 WebCore std::__1::enable_if<std::is_same<WebCore::GainNode, WebCore::GainNode>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::GainNode>::WrapperClass*>::type WebCore::createWrapper<WebCore::GainNode, WebCore::GainNode>(WebCore::JSDOMGlobalObject*, ***::Ref<WebCore::GainNode, ***::DumbPtrTraits<WebCore::GainNode> >&&) + 220   14 WebCore WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::GainNode&) + 136   15 WebCore WebCore::jsAudioContextPrototypeFunctionCreateGain(JSC::ExecState*) + 264   16 JavaScriptCore _llint_entry + 31860   17 JavaScriptCore _llint_entry + 29020   18 JavaScriptCore _llint_entry + 30040   19 JavaScriptCore _llint_entry + 29020   20 JavaScriptCore _llint_entry + 29020   21 JavaScriptCore _llint_entry + 29020   22 JavaScriptCore _llint_entry + 29020   23 JavaScriptCore _llint_entry + 29020   24 JavaScriptCore _llint_entry + 29020   25 JavaScriptCore _llint_entry + 29020   26 JavaScriptCore _llint_entry + 29020   27 JavaScriptCore _llint_entry + 29020   28 JavaScriptCore _llint_entry + 29020   29 JavaScriptCore _llint_entry + 28904   30 JavaScriptCore _llint_entry + 28904   31 JavaScriptCore _llint_entry + 28904   32 JavaScriptCore _llint_entry + 29020   33 JavaScriptCore _llint_entry + 29020   34 JavaScriptCore _llint_entry + 28904   35 JavaScriptCore _llint_entry + 29020   36 JavaScriptCore _llint_entry + 29020   37 JavaScriptCore _vmEntryToJavaScript + 272   38 JavaScriptCore JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184   39 JavaScriptCore JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464   40 JavaScriptCore JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, ***::NakedPtr<JSC::Exception>&) + 180   41 WebCore WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 1176   42 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&, ***::Vector<***::RefPtr<WebCore::RegisteredEventListener, ***::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>) + 760   43 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 596   44 WebCore WebCore::EventTarget::dispatchEvent(WebCore::Event&) + 116   45 WebCore WebCore::WebSocket::didReceiveBinaryData(***::Vector<unsigned char, 0ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>&&) + 236   46 WebCore WebCore::WebSocketChannel::processFrame() + 2912   47 WebCore WebCore::WebSocketChannel::processBuffer() + 112   48 WebCore WebCore::WebSocketChannel::didReceiveSocketStreamData(WebCore::SocketStreamHandle&, char const*, unsigned long) + 112   49 WebCore WebCore::SocketStreamHandleImpl::readStreamCallback(unsigned long) + 544   50 CoreFoundation __signalEventSync + 212   51 CoreFoundation __cfstream_solo_signalEventSync + 260   52 CoreFoundation __CFStreamSignalEvent + 548   53 CFNetwork SocketStream::dispatchSignalFromSocketCallbackUnlocked(SocketStreamSignalHolder*) + 64   54 CFNetwork SocketStream::socketCallback(__CFSocket*, unsigned long, __CFData const*, void const*) + 148   55 CFNetwork SocketStream::_SocketCallBack_stream(__CFSocket*, unsigned long, __CFData const*, void const*, void*) + 88   56 CoreFoundation ___CFSocketPerformV0 + 1352   57 CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24   58 CoreFoundation ___CFRunLoopDoSources0 + 276   59 CoreFoundation ___CFRunLoopRun + 1204   60 CoreFoundation CFRunLoopRunSpecific + 552   61 GraphicsServices GSEventRunModal + 100   62 UIKit UIApplicationMain + 236   63 x5gamehelper main + 88   64 libdyld.dylib _start + 4   

type 3:

#0 Thread     SIGTRAP     0 WebCore WebCore::TimerBase::~TimerBase() + 120   1 WebCore WebCore::TimerBase::~TimerBase() + 40   2 WebCore WebCore::MediaElementSession::~MediaElementSession() + 96   3 WebCore WebCore::HTMLMediaElement::~HTMLMediaElement() + 1340   4 WebCore WebCore::HTMLVideoElement::~HTMLVideoElement() + 176   5 JavaScriptCore void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 212   6 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 408   7 JavaScriptCore void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) + 320   8 JavaScriptCore JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) + 32   9 JavaScriptCore JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) + 372   10 JavaScriptCore JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) + 40   11 JavaScriptCore JSC::LocalAllocator::tryAllocateWithoutCollecting() + 48   12 JavaScriptCore JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 292   13 JavaScriptCore JSC::CompleteSubspace::allocateNonVirtual(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 216   14 WebCore std::__1::enable_if<std::is_same<WebCore::WebSocket, WebCore::WebSocket>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::WebSocket>::WrapperClass*>::type WebCore::createWrapper<WebCore::WebSocket, WebCore::WebSocket>(WebCore::JSDOMGlobalObject*, ***::Ref<WebCore::WebSocket, ***::DumbPtrTraits<WebCore::WebSocket> >&&) + 220   15 WebCore WebCore::constructJSWebSocket1(JSC::ExecState*) + 284   16 WebCore WebCore::JSDOMConstructor<WebCore::JSWebSocket>::construct(JSC::ExecState*) + 136   17 JavaScriptCore JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 580   18 JavaScriptCore _llint_entry + 30024   19 JavaScriptCore _llint_entry + 28904   20 JavaScriptCore _llint_entry + 28904   21 JavaScriptCore _llint_entry + 29020   22 JavaScriptCore _llint_entry + 28904   23 JavaScriptCore _llint_entry + 28904   24 JavaScriptCore _llint_entry + 29020   25 JavaScriptCore _llint_entry + 29020   26 JavaScriptCore _llint_entry + 29020   27 JavaScriptCore _llint_entry + 29020   28 JavaScriptCore _vmEntryToJavaScript + 272   29 JavaScriptCore JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184   30 JavaScriptCore JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464   31 JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::ExecState*) + 512   32 JavaScriptCore _llint_entry + 31860   33 JavaScriptCore _llint_entry + 29020   34 JavaScriptCore _vmEntryToJavaScript + 272   35 JavaScriptCore JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184   36 JavaScriptCore JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464   37 JavaScriptCore JSC::boundThisNoArgsFunctionCall(JSC::ExecState*) + 512   38 JavaScriptCore _llint_entry + 31860   39 JavaScriptCore _llint_entry + 29020   40 JavaScriptCore _llint_entry + 29020   41 JavaScriptCore _llint_entry + 29020   42 JavaScriptCore _llint_entry + 28904   43 JavaScriptCore _llint_entry + 29020   44 JavaScriptCore _llint_entry + 28904   45 JavaScriptCore _llint_entry + 28904   46 JavaScriptCore _llint_entry + 28904   47 JavaScriptCore _vmEntryToJavaScript + 272   48 JavaScriptCore JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184   49 JavaScriptCore JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464   50 JavaScriptCore JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, ***::NakedPtr<JSC::Exception>&) + 180   51 WebCore WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 1176   52 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&, ***::Vector<***::RefPtr<WebCore::RegisteredEventListener, ***::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>) + 760   53 WebCore WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 596   54 WebCore WebCore::EventTarget::dispatchEvent(WebCore::Event&) + 116   55 WebCore WebCore::WebSocket::didReceiveBinaryData(***::Vector<unsigned char, 0ul, ***::CrashOnOverflow, 16ul, ***::FastMalloc>&&) + 236   56 WebCore WebCore::WebSocketChannel::processFrame() + 2912   57 WebCore WebCore::WebSocketChannel::processBuffer() + 112   58 WebCore WebCore::WebSocketChannel::didReceiveSocketStreamData(WebCore::SocketStreamHandle&, char const*, unsigned long) + 112   59 WebCore WebCore::SocketStreamHandleImpl::readStreamCallback(unsigned long) + 544   60 CoreFoundation __signalEventSync + 212   61 CoreFoundation __cfstream_solo_signalEventSync + 260   62 CoreFoundation __CFStreamSignalEvent + 548   63 CFNetwork SocketStream::dispatchSignalFromSocketCallbackUnlocked(SocketStreamSignalHolder*) + 64   64 CFNetwork SocketStream::socketCallback(__CFSocket*, unsigned long, __CFData const*, void const*) + 148   65 CFNetwork SocketStream::_SocketCallBack_stream(__CFSocket*, unsigned long, __CFData const*, void const*, void*) + 88   66 CoreFoundation ___CFSocketPerformV0 + 1352   67 CoreFoundation ___CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24   68 CoreFoundation ___CFRunLoopDoSources0 + 276   69 CoreFoundation ___CFRunLoopRun + 1204   70 CoreFoundation CFRunLoopRunSpecific + 552   71 GraphicsServices GSEventRunModal + 100   72 UIKit UIApplicationMain + 236   73 x5gamehelper main + 88   74 libdyld.dylib _start + 4   

Can anybody help me ? :)

2 Answers

Answers 1

You appear to have exposed a bug with TimerBase in WebKit as reported here: https://bugs.webkit.org/show_bug.cgi?id=182931

They mention a fix, which may have been picked up in the recently released 11.3.1.

You can see the fix here if you're curious.

Answers 2

I had faced same type of issue due to JavaScriptCore. After wasted 3-4 days time, Finally got below solution.

Just disable JSC_useJIT envirnment to false for iOS 11.0. It is worked for me.

   setenv("JSC_useJIT", "false", 0); 

Find reference from Here

Read More

Double message on ios when get geolocation

I have created an ios app (Xcode) with a single WebKit View component that loads an external website. This website tries to get the current geolocation with this Javascript: navigator.geolocation.

This all works fine, but the problem is, I get 2 messages:

1. First a message for the app: 'Allow "NameApp" to access your location while you are using the app?'
2. Second a message for the webview: 'https://mywebsite.com would like to use your current location'.

I have seen similar questions about this issue, but they all went about a native/offline Cordova app. I have an online app in my Webview.

How can I prevent this double message? Or a workaround for this problem?

0 Answers

Read More

WKWebKit javascript execution when not attached to a view hierarchy

I want to switch to WKWebView from UIWebView. In my code the web view instance is created offscreen (without attaching to the view hierarchy) and URL is loaded. When loading is done, the web view is presented to the user in a separate UIWindow (like interstitial ad). Everything works fine with UIWebView; but after switching to WKWebView, the angular javascript code behaves in unexpected way.

After doing some research, I've figured out that javascript timers (and http loaders) are suspended when the WKWebView instance is not attached to the view hierarchy: if you start a timer in javascript which runs in detached WKWebView - it won't be fired until the web view is attached.

Can anyone suggest a possible workaround (besides attaching a hidden web view to the key window and then moving it to another window)?

I've created a sample project to demonstrate the issue (or, more likely, a WebKit feature)

https://dl.dropboxusercontent.com/u/148568148/WebKitViewTest.zip

The test application loads a web page with javascript which schedules a timer and loads http request. You can use switches to show/hide web view (sets 'hidden' property) and attach/detach it from the view hierarchy.

If the the web view is attached (hidden or visible) and you hit Load, the javascript works fine: you can see success or failure alert dialog. If it's detached - the timer will only fires when it's attached to the view hierarchy (switch "Detached" to "on", hit "Load", wait a couple of seconds and switch back to "off"). You can also check console.log from Safari Web Inspector.

Here's the test web page source:

<!doctype html> <html ng-app="project">   <head>     <script       src="https://ajax.googleapis.com/ajax/libs/angularjs/1.3.16/angular.js"></script>     <script src="project.js"></script>   </head>   <body>     <div id="simple" ng-controller="MyController" data-ng-init="callNotify(message);">     </div>   </body> </html> 

And the javascript:

angular.   module('project', []).   controller('MyController', ['$scope','notify', function ($scope, notify) {   $scope.callNotify = function(msg) {     notify(msg);   }; }]).   factory('notify', ['$window', '$http', '$q', '$timeout', function(win, $http, $q, $timeout) {   return function(msg) {     deferred = $q.defer();      $timeout(function() {       $http.get('http://jsonplaceholder.typicode.com/posts').       success(function(data, status, headers, config) {         alert("success");         console.log("success")       }).         error(function(data, status, headers, config) {         alert("error");         console.log("error")       });     });     return deferred.promise;   }; }]); 

0 Answers

Read More

Optimizing animation performance in WebKit on Linux

How does one optimize a compiled WebKit browser to take the best advantage of the GPU?

Background

My team and I are working on configuring a Linux box (CentOS) to display full screen HTML with smooth, CSS-driven animations. The box has more than adequate GPU and CPU power and is able to play back these animations easily in Chromium.

However, we are attempting to use pure WebKit to render these animations both by using WebKitGTK+ in Python and by compiling WebKit to a simplistic browser from the source.

Current Status

In both "pure" webkit applications, the animations are vastly slower than on Chromium, which is making us scratch our heads to answer what exactly is different between the two. We understand Chromium uses Blink, a fork of WebKit, and we currently believe the difference in performance is due to the fact that Chromium, Safari, and other WebKit-based browsers each use their own graphics component that is separate from WebKit and Web Core itself, based on what we've read.

It would be great if we could customize our WebKit build to perform even to half the specs of what we're seeing in Chromium but we're not sure where to start.

I'm wondering...

1. Is our assumption about the separate graphics component correct?
2. What options exist for us to optimize CSS animation performance in a "pure" WebKit browser such as ours?

0 Answers

Read More

Deleting cookies with WKHTTPCookieStore

I'm using the new WKHTTPCookieStore class in order to inject and delete cookies from WKWebViews in an app.

All of the WKWebViews share a common WKWebViewConfiguration so that they can share a common cookie store.

Injecting cookies works fine using the add() method, and each of the web views can see the new cookies and send them with their requests. Deleting cookies seems to be a problem - the web views all still see the supposedly deleted cookie, and continue to send it with each request:

let cookieStore = self.webkitConfiguration.websiteDataStore.httpCookieStore cookieStore.getAllCookies { (cookies) in     for cookie:HTTPCookie in cookies {         if cookie.name == "CookieIWantToDelete" {             cookieStore.delete(cookie, completionHandler: {                 self.webView.reload() //Deleted cookie is still sent with this request             })         }     } } 

I can work around it by trashing all of the cookies in the WKWebsiteDataStore, but it seems a bit overkill.

Any ideas?

1 Answers

Answers 1

You need to clear WKWebView cache before reloading by using URLCache.shared.removeAllCachedResponses(), for exampe, or use self.webView.reloadFromOrigin() to load fresh data.

Read More

CSS animation bug in Safari

I have a CSS animation with a delay and I pause it during the delay. It works as expected on Firefox and Chrome, the "Hello" does not move. However on Safari, the animation jumps to the last frame. Why and how to fix please?

function test() {    var timeout = 1000;    setTimeout(function() {      document.getElementById('animation').style.animationPlayState = 'paused';    }, timeout);  }    document.addEventListener("DOMContentLoaded", test);

#animation {    animation: test 2s linear 2s;  }    @keyframes test {    to {      transform: translateY(100px);    }  }

<div id="animation">    Hello (this text should not move)  </div>

If I remove the 2s delay, set the duration to 4s, and add a keyframe with transform:none, I can make this simple example work. However my real case has multiple animations that are synchronized with delays.

2 Answers

Answers 1

The Safari behaviour is only buggy when timeout is set to a value smaller than the animation delay. So, a workaround is to set the initial state to paused via animation-play-state and then control it via JS, as shown below:

function test() {    let el = document.getElementById("animation");    let timeout = 1000;        // Get the delay. No luck with el.style.animationDelay    let delay =      window        .getComputedStyle(el)        .getPropertyValue("animation-delay")        .slice(0, -1) * 1000;      // Only resume and later pause when timeout is greater than animation delay    if (timeout > delay) {      el.style.animationPlayState = "running";      setTimeout(function() {        el.style.animationPlayState = "paused";      }, timeout);    }  }    document.addEventListener("DOMContentLoaded", test);

#animation {    animation: test 2s linear 3s;    animation-play-state: paused; /* Pause it right after you set it */  }    @keyframes test {    to {      transform: translateY(100px);    }  }

<div id="animation">    Hello (this text should not move)  </div>

Try different timeout values to see it working. Can't say why this is happening though. Looks like a bug to me. Tested on OS X El Capitan 10.11.6 / Safari 11.0 (11604.1.38.1.7).

Codepen demo

Answers 2

This is not an answer to the problem. However, if you remove the animation delay, pausing and restarting the animation works as it should. It seems then the animation delay is what is causing the problem. Perhaps rather than relying on css to handle the delay, programmatically control animation delay with javascript.

See below pausing and running the animation

function test() {    var timeout = 1000;    setTimeout(function() {      document.getElementById('animation').style.animationPlayState ='paused';      document.getElementById('animation').style.webkitAnimationPlayState ='paused';    }, timeout);    setTimeout(function() {      document.getElementById('animation').style.animationPlayState='running';      document.getElementById('animation').style.webkitAnimationPlayState ='running';    }, timeout * 2);  }    document.addEventListener("DOMContentLoaded", test);

#animation {      -webkit-animation: test 2s linear;          animation: test 2s linear;  }    @-webkit-keyframes test {    to {      -webkit-transform: translateY(100px);          transform: translateY(100px);    }  }    @keyframes test {    to {      -webkit-transform: translateY(100px);          transform: translateY(100px);    }  }

<div id="animation">    Hello (this text should not move)  </div>

Read More

Work around Safari table colspan/writing-mode width bug

I'd like a table to have a first cell which colspans several cells and the ones beneath to have vertical text, like the following example.

.second td * {    writing-mode: tb-rl;    -webkit-writing-mode: vertical-rl;    writing-mode: vertical-rl;  }

<table border=1><tr>  <td colspan=4>This cell has colspan=4</td>  </tr><tr class="second">  <td><div>Writing-mode:vertical-rl inside block</div></td>  <td><div>Writing-mode:vertical-rl inside block</div></td>  <td><div>Writing-mode:vertical-rl inside block</div></td>  <td><div>Writing-mode:vertical-rl inside block</div></td>  </tr></table>    <table border=1><tr>  <td colspan=4>This cell has colspan=4</td>  </tr><tr class="second">  <td><a>Writing-mode:vertical-rl inside inline</a></td>  <td><a>Writing-mode:vertical-rl inside inline</a></td>  <td><a>Writing-mode:vertical-rl inside inline</a></td>  <td><a>Writing-mode:vertical-rl inside inline</a></td>  </tr></table>

In every browser except Safari, this produces properly-sized cells containing sideways text. Safari either collapses them (if the container is block) or expands them as if they were horizontal (if the container is inline).

I've submitted the bug to Webkit, but until then, I'd like to use this pattern, so I'm looking for a way around it that preserves most of this structure and the ability to use colspan above vertical text. The actual use case is more complex, so simply setting fixed widths somewhere is not a viable solution.

I attempted reimplementing the table as display: flex and nesting column within row-direction flex, but encountered the same bug, this time in Firefox as well.

1 Answers

Answers 1

AFAIK vertical writing modes address blocks, not inline stuff. It's intended to rotate blocks. Ref: https://www.w3.org/TR/css-writing-modes-3/#block-flow-direction

This contains a somewhat similar question: Container of vertical writing mode elements uses their height to compute the container's width and the solution provided was to remove the inline-block on the child element. So from this: http://jsfiddle.net/zw8Gr/1/ to this: http://jsfiddle.net/zw8Gr/10/ by removing the display:inline-block they had.

In your case adding a display:block to the contacts of your cells that you put in vertical mode helps a bit. While it doesn't fix everything by a long shot, it might be a start. It makes them all at least react in the same (bad) way.

Essentially making the css:

.second td>* {   -webkit-writing-mode: vertical-rl;   writing-mode: vertical-rl;   display:block  ; } 

https://jsfiddle.net/0ze8xs0v/

Read More

Bug in Safari 9? adding blue color to links' border

I'm having some funny behavior with Safari 9 and a list of links with border.

Reproduction online

I isolated the problem as much as I could. It seems to get solved when:

• I remove the absolute position from #fp-nav ul li a
• Or whenever I use a bigger width in #fp-nav ul li a
• Or when I remove the style #fp-nav ul li:hover a span

And probably there are more cases, but nevertheless none of them make any sense to me, so I believe we are talking about a weird bug in Safari 9.X.

The problem was reported by a developer who found it using a javascript library. (fullPage.js)

2 Answers

Answers 1

You're right it's a bug with Safari 9.x.

I tested in on thoroughly on windows, osx and linux. It's the same everywhere.

Answers 2

I do see the issue in Safari 9, however I believe it's just a matter of how you've coded the solution. I have taken your online solution and coded it properly and there is no bugs anymore.

Considering the animation of the elements only :

• If you can, I think it makes more sense to add the active class to the li elements. In your case it's easier because the width of the a and span is related to the li so you just need to scale its size for your animation,
• Only transition the properties that need to change. In your case it's the transform property,
• What you want is to increase the size of your element without affecting the other li. This is what the scale property is for in CSS,
• The order of your CSS is important (for the a tag it should be in this order visited, hover and active).

Here is the code (and the JSFiddle):

body {    background-color: #000;  }    #fp-nav {    position: fixed;    z-index: 100;    height: 100vh; /* IE9+ */    display: table; /* that will be used to center the li elements */  }    #fp-nav.right {    right: 17px;  }    #fp-nav ul {    margin: 0;    padding: 0;    /* center the li elements (vertical and horizontal) */    display: table-cell;    text-align: center;    vertical-align: middle;  }    #fp-nav li {    display: block;    width: 8px;    height: 8px;    margin: 1em;    border: 3px solid green;    border-radius: 50%; /* 50% is enough to create a circle */    background-color: #fff;    overflow: hidden; /* To hide everything outside the li */    transition: transform 0.3s; /* your transition for the size */  }    #fp-nav a {    display: block;    width: 100%;    height: 100%;    cursor: pointer;    text-decoration: none;  }    #fp-nav li.active,  #fp-nav li:hover {    transform: scale(1.4); /* the transformation */  }    #fp-nav span {    /* To remove the text inside the span (better for accessibility) */    text-indent: 100%;    white-space: nowrap;    opacity: 0;    visibility: hidden;  }

<div id="fp-nav" class="right">    <ul>      <li><a href="#"><span>Page1</span></a></li>      <li class="active"><a href="#"><span>Page2</span></a></li>      <li><a href="#"><span>Page3</span></a></li>      <li><a href="#"><span>Page4</span></a></li>    </ul>  </div>

Of course you need to include any vendor-prefixes needed (and probably some style for the :active and :visited states).

Let me know if you need any clarification!

Read More

How did CSS `content` property work for `img` element in WebKit?

Long time ago there was a draft of CSS3 Generated Content spec which allowed the content property for any HTML element (not only ::before/::after pseudo-elements), without any formal restriction for empty or replaced elements. It was once supported by Opera Presto (1, 2) and, at least to some extent, by WebKit (3). By the end of 2011, WebKit's implementation of content for img element seemed to effectively convert it from an empty replaced element to non-replaced element like span (even its context menu changed, removing options like 'Save image as...'). It also made it possible to apply pseudo elements like img::before.

In the current Blink (Chrome etc.) implementation, seeting content property to img element has no visible effect. But the img element clearly has different structure depending on whether it loaded properly or is broken: if loaded, it is shown by the DOM Inspector as a simple empty element, but if broken, it exposes the internal Shadow DOM structure like this:

<div id="alttext-container" style="overflow: hidden; border: 1px solid silver; display: inline-block; box-sizing: border-box; padding: 1px;">   <img id="alttext-image" width="16" height="16" align="left" style="margin: 0px; float: left; display: inline;">   <div id="alttext" style="overflow: hidden; display: block;">Alt text</div> </div> 

Probably because the broken img is displayed with the help of the shadow divs, it's possible to apply pseudo elements to it in this case only (4).

Current WebKit doesn't support pseudo elements for img. But, interestingly, at least iOS 9.2.1 Safari starts to support them after setting the content property for that img (5).

Why does this property make such change? I guess that if an empty element gets any content (even generated), the browser has to provide something to display this content in, effectively replacing the empty element with some sort of a container (like Blink's shadow div id="alttext-container"), and this container can have pseudos. Am I wrong? And wasn't this behavior removed from the latest WebKit versions?

0 Answers

Read More

How to tell if WKWebView is playing audio?

I was curious if there was a way of telling if audio is coming from a specific WKWebView similar to the way you can find the tab playing audio in Chrome and Safari?

1 Answers

Answers 1

In the WKWebView's delegate, after webview loading finished, execute javascript that addEventListener to audio and video tag with event play, pause, ended. Then check the playback state for purpose.

Read More