iOS13/14/17下JSObjectCallAsFunction调用时JavaScriptCore偶现崩溃求助

在iOS 13、iOS 14及iOS 17.4.1系统中，频繁调用JSObjectCallAsFunction时偶现JavaScriptCore崩溃。崩溃栈入口函数均为JSObjectCallAsFunction，但不同系统后续崩溃位置不同。曾怀疑内存问题，但设备仍有大量可用内存；因调用频繁调试耗时久，且问题仅偶发，目前暂无排查思路。

以下是iOS 17下的崩溃栈：

JavaScriptCore
JSC::JSFinalObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
1
JavaScriptCore
JSC::SlotVisitor::drain(WTF::MonotonicTime)
2
JavaScriptCore
JSC::SlotVisitor::drain(WTF::MonotonicTime)
3
JavaScriptCore
JSC::Heap::runFixpointPhase(JSC::GCConductor)
4
JavaScriptCore
JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*)
5
JavaScriptCore
WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_23>::implFunction(void*, JSC::CurrentThreadState&)
6
JavaScriptCore
JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&)
7
JavaScriptCore
JSC::Heap::collectInMutatorThread()
8
JavaScriptCore
JSC::Heap::stopIfNecessary()
9
JavaScriptCore
JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
10
JavaScriptCore
_llint_slow_path_new_func_exp
11
JavaScriptCore
_llint_function_for_construct_arity_checkTagGateAfter
12
JavaScriptCore
_llint_function_for_construct_arity_checkTagGateAfter
13
JavaScriptCore
_vmEntryToJavaScriptTrampoline
14
JavaScriptCore
JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
15
JavaScriptCore
_JSObjectCallAsFunction
16
**APPNAME**
script::jsc_backend::toJscValues<script::Local<script::Value>, script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> const*) const::$_0>(OpaqueJSContext*, unsigned long, script::Local<script::Value> const*, script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> **APPNAME**const*) const::$_0)::{lambda(OpaqueJSValue const**)#1}::operator()(OpaqueJSValue const**) const JscHelper.hpp:36
17
**APPNAME**
script::Local<script::Function>::callImpl(script::Local<script::Value> const&, unsigned long, script::Local<script::Value> const*) const JscLocalReference.cc:498

怀疑该问题是否与变量释放有关，或是JavaScriptCore存在难以定位的底层问题，现寻求排查及解决方法。

内容的提问来源于stack exchange，提问作者冯浩臻