关于WebCore::RenderTreeBuilder::RenderTreeBuilder(WebCore::RenderView&)的闪退

一个日志是

Thread 11 name:
Thread 11 Crashed:
0   WebCore                       	0x00000002160ed170 WebCore::RenderTreeBuilder::RenderTreeBuilder(WebCore::RenderView&) + 304 (RenderTreeBuilder.cpp:142)
1   WebCore                       	0x00000002160ed134 WebCore::RenderTreeBuilder::RenderTreeBuilder(WebCore::RenderView&) + 244 (RenderTreeBuilderFullScreen.h:38)
2   WebCore                       	0x00000002160f7c00 WebCore::RenderTreeUpdater::RenderTreeUpdater(WebCore::Document&) + 60 (RenderTreeUpdater.cpp:87)
3   WebCore                       	0x000000021582480c WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 1012 (Document.cpp:1863)
4   WebCore                       	0x00000002158251e0 WebCore::Document::updateStyleIfNeeded() + 344 (Document.cpp:1968)
5   WebCore                       	0x0000000215c87120 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() + 540 (FrameView.cpp:4279)
6   WebKitLegacy                  	0x00000002165a0ab4 LayerFlushController::flushLayers() + 52 (WebView.mm:9299)
7   WebCore                       	0x0000000215dfab04 WebCore::LayerFlushScheduler::layerFlushCallback() + 44 (LayerFlushSchedulerMac.cpp:73)
8   WebKitLegacy                  	0x00000002165a2c14 WebViewLayerFlushScheduler::layerFlushCallback() + 36 (WebViewData.h:121)
9   CoreFoundation                	0x000000020c289b94 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32 (CFRunLoop.c:1822)
10  CoreFoundation                	0x000000020c284828 __CFRunLoopDoObservers + 412 (CFRunLoop.c:1932)
11  CoreFoundation                	0x000000020c284dc8 __CFRunLoopRun + 1264 (CFRunLoop.c:2950)
12  CoreFoundation                	0x000000020c2845b8 CFRunLoopRunSpecific + 436 (CFRunLoop.c:3247)
13  WebCore                       	0x00000002150abba4 RunWebThread(void*) + 592 (WebCoreThread.mm:612)
14  libsystem_pthread.dylib       	0x000000020bf152fc _pthread_body + 128 (pthread.c:837)
15  libsystem_pthread.dylib       	0x000000020bf1525c _pthread_start + 48 (pthread.c:864)
16  libsystem_pthread.dylib       	0x000000020bf18d08 thread_start + 4

另一个日志是

Date/Time:           2018-11-05 17:02:59.1622 +0800
Launch Time:         2018-11-05 17:01:56.4377 +0800
OS Version:          iPhone OS 12.0.1 (16A404)
Baseband Version:    3.00.00
Report Version:      104

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x000000021bf57304
Termination Signal: Trace/BPT trap: 5
Termination Reason: Namespace SIGNAL, Code 0x5
Terminating Process: exc handler [3125]
Triggered by Thread:  0

Thread 0 name:
Thread 0 Crashed:
0   WebCore                       	0x000000021bf57304 WebCore::RenderTreeBuilder::detachFromRenderElement(WebCore::RenderElement&, WebCore::RenderObject&) + 664 (RenderTreeBuilder.cpp:777)
1   WebCore                       	0x000000021bf570a4 WebCore::RenderTreeBuilder::detachFromRenderElement(WebCore::RenderElement&, WebCore::RenderObject&) + 56 (RenderTreeBuilder.cpp:777)
2   WebCore                       	0x000000021bf56c30 WebCore::RenderTreeBuilder::Block::detach(WebCore::RenderBlock&, WebCore::RenderObject&) + 576 (RenderTreeBuilderBlock.cpp:289)
3   WebCore                       	0x000000021bf552a8 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&) + 44 (RenderTreeBuilder.cpp:155)
4   WebCore                       	0x000000021bf58a08 WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&) + 348 (RenderTreeBuilder.cpp:741)
5   WebCore                       	0x000000021bf624a8 WebCore::RenderTreeUpdater::tearDownRenderer(WebCore::Text&) + 80 (RenderTreeUpdater.cpp:611)
6   WebCore                       	0x000000021b66dad0 WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) + 160 (ContainerNode.cpp:247)
7   WebCore                       	0x000000021b66e558 WebCore::ContainerNode::replaceAllChildren(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 620 (ContainerNode.cpp:110)
8   WebCore                       	0x000000021b842d80 WebCore::HTMLElement::setInnerText(WTF::String const&) + 532 (utility:0)
9   WebCore                       	0x000000021ae077b8 WebCore::setJSHTMLElementInnerText(JSC::ExecState*, long long, long long) + 332 (JSHTMLElement.cpp:871)
10  JavaScriptCore                	0x0000000219cb97f4 JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) + 32 (CustomGetterSetter.cpp:41)
11  JavaScriptCore                	0x0000000219d5cb88 JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 892 (JSObject.cpp:793)
12  JavaScriptCore                	0x0000000219b72460 llint_slow_path_put_by_id + 848 (JSObjectInlines.h:245)
13  JavaScriptCore                	0x0000000219464f24 llint_entry + 13060
14  JavaScriptCore                	0x0000000219461a1c vmEntryToJavaScript + 300
15  JavaScriptCore                	0x0000000219ad93f0 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 424 (JITCodeInlines.h:38)
16  JavaScriptCore                	0x0000000219c90068 JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 172 (CallData.cpp:41)
17  JavaScriptCore                	0x0000000219497284 JSObjectCallAsFunction + 368 (JSObjectRef.cpp:620)
18  JavaScriptCore                	0x0000000219401284 -[JSValue callWithArguments:] + 292 (JSValue.mm:426)

第三个日志在ios11.4上的

Date/Time:           2018-12-12 23:20:09.1501 +0800
Launch Time:         2018-12-12 23:16:39.1852 +0800
OS Version:          iPhone OS 11.4.1 (15G77)
Baseband Version:    3.70.00
Report Version:      104

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x000000018c4099d8
Termination Signal: Trace/BPT trap: 5
Termination Reason: Namespace SIGNAL, Code 0x5
Terminating Process: exc handler [0]
Triggered by Thread:  0

Thread 0 name:
Thread 0 Crashed:
0   WebCore                       	0x000000018c4099d8 WebCore::RenderElement::takeChildInternal(WebCore::RenderObject&) + 756 (RenderElement.cpp:591)
1   WebCore                       	0x000000018c409720 WebCore::RenderElement::takeChildInternal(WebCore::RenderObject&) + 60 (RenderElement.cpp:591)
2   WebCore                       	0x000000018c3ac59c WebCore::RenderBlock::takeChild(WebCore::RenderObject&) + 312 (RenderBlock.cpp:874)
3   WebCore                       	0x000000018c4099f8 WebCore::RenderElement::removeAndDestroyChild(WebCore::RenderObject&) + 28 (RenderElement.cpp:521)
4   WebCore                       	0x000000018c47d180 WebCore::RenderObject::removeFromParentAndDestroyCleaningUpAnonymousWrappers() + 232 (RenderObject.cpp:1512)
5   WebCore                       	0x000000018c54f730 WebCore::RenderTreeUpdater::tearDownRenderer(WebCore::Text&) + 48 (RenderTreeUpdater.cpp:582)
6   WebCore                       	0x000000018bde8f08 WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) + 160 (ContainerNode.cpp:244)
7   WebCore                       	0x000000018bde9570 WebCore::ContainerNode::replaceAllChildren(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 652 (ContainerNode.cpp:107)
8   WebCore                       	0x000000018bf75914 WebCore::HTMLElement::setInnerText(WTF::String const&) + 532 (utility:0)
9   WebCore                       	0x000000018b1d212c WebCore::HTMLTextFormControlElement::setInnerTextValue(WTF::String const&) + 160 (HTMLTextFormControlElement.cpp:577)
10  WebCore                       	0x000000018b299c1c WebCore::TextFieldInputType::setValue(WTF::String const&, bool, WebCore::TextFieldEventBehavior) + 112 (TextFieldInputType.cpp:603)
11  WebCore                       	0x000000018b299b24 WebCore::HTMLInputElement::setValue(WTF::String const&, WebCore::TextFieldEventBehavior) + 308 (HTMLInputElement.cpp:1055)
12  WebCore                       	0x000000018b6978f0 WebCore::setJSHTMLInputElementValue(JSC::ExecState*, long long, long long) + 348 (JSHTMLInputElement.cpp:1379)
13  JavaScriptCore                	0x000000018a45c148 JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) + 80 (CustomGetterSetter.cpp:41)
14  JavaScriptCore                	0x000000018a4db934 JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1020 (JSObject.cpp:794)
15  JavaScriptCore                	0x0000000189c28158 llint_slow_path_put_by_id + 820 (JSObjectInlines.h:238)
16  JavaScriptCore                	0x0000000189d2dd20 llint_entry + 13216
17  JavaScriptCore                	0x0000000189d2a7b0 vmEntryToJavaScript + 272
18  JavaScriptCore                	0x000000018a2edf50 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 184 (JITCode.cpp:81)
19  JavaScriptCore                	0x0000000189c33664 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 464 (Interpreter.cpp:1028)
20  JavaScriptCore                	0x000000018a415d74 JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 168 (CallData.cpp:41)
21  JavaScriptCore                	0x0000000189c33370 JSObjectCallAsFunction + 392 (JSObjectRef.cpp:620)
22  JavaScriptCore                	0x0000000189d38f2c -[JSValue callWithArguments:] + 292 (JSValue.mm:411)

 

 

这几个崩溃和上篇讲的是一样的，这里不再重复  ->  https://blog.csdn.net/qq_15509071/article/details/88596178