WebTryThreadLock thread crash 0xbbadbeef - ios

Question

The most frequent crash we're seeing from customers is an exception (0xbbadbeef always in WebThread, thread #2) from _WebTryThreadLock. Usually the crashes contain other threads (main thread included) that has nothing specific to do with our code. We can't reproduce it internally. We've looked in cases in our code where we might be using UIWebView's from other threads but we've found nothing. We always unset the webview's delegate before it's freed.
We see this from all kinds of devices and from what I can see any iOS version (in the 5.x-current range). Based on logs, it does appear that it primarily happens when the application is resumed from background.
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0xbbadbeef
Crashed Thread: 2
Thread 0 name: Dispatch queue: com.apple.root.default-priority
Thread 0:
0 libsystem_kernel.dylib 0x328e31d4 madvise + 8
1 ImageIO 0x3306c550 CGImageRead_willNeed + 52
2 ImageIO 0x331bcd98 __copyImageBlockSetPNG_block_invoke_0 + 476
3 libdispatch.dylib 0x35d03a68 _dispatch_apply_serial + 16
4 libdispatch.dylib 0x35cf44b4 _dispatch_client_callout + 20
5 libdispatch.dylib 0x35d02886 _dispatch_sync_f_invoke + 22
6 ImageIO 0x331bb446 copyImageBlockSetPNG + 2102
7 ImageIO 0x3306b53e ImageProviderCopyImageBlockSetCallback + 510
8 CoreGraphics 0x33fc59d6 CGImageProviderCopyImageBlockSetWithOptions + 158
9 QuartzCore 0x3a4f474c CA::Render::create_image(CGImage*, CGColorSpace*, unsigned int) + 668
10 QuartzCore 0x3a4f433a CA::Render::copy_image(CGImage*, CGColorSpace*, unsigned int, double) + 254
11 QuartzCore 0x3a4f4226 CA::Render::prepare_image(CGImage*, CGColorSpace*, unsigned int, double) + 14
12 QuartzCore 0x3a4e2af0 CA::Layer::prepare_commit(CA::Transaction*) + 416
13 QuartzCore 0x3a4e221e CA::Context::commit_transaction(CA::Transaction*) + 242
14 QuartzCore 0x3a4e2024 CA::Transaction::commit() + 312
15 UIKit 0x3af260b6 -[UIApplication _reportAppLaunchFinished] + 38
[...]
Thread 2 name: WebThread
Thread 2 Crashed:
0 WebCore 0x379a99ca _WebTryThreadLock(bool) + 298
1 WebCore 0x379a988a WebRunLoopLock(__CFRunLoopObserver*, unsigned long, void*) + 42
2 CoreFoundation 0x336da6ca __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 18
3 CoreFoundation 0x336d89bc __CFRunLoopDoObservers + 272
4 CoreFoundation 0x336d8c8c __CFRunLoopRun + 604
5 CoreFoundation 0x3364beb8 CFRunLoopRunSpecific + 352
6 CoreFoundation 0x3364bd44 CFRunLoopRunInMode + 100
7 WebCore 0x379a7a40 RunWebThread(void*) + 440
8 libsystem_c.dylib 0x35d3e30e _pthread_start + 306
9 libsystem_c.dylib 0x35d3e1d4 thread_start + 4
[...]
Thread 5 name: JavaScriptCore::BlockFree
Thread 5:
0 libsystem_kernel.dylib 0x328f308c __psynch_cvwait + 24
1 libsystem_c.dylib 0x35d36d2a _pthread_cond_wait + 642
2 libsystem_c.dylib 0x35d36aa0 pthread_cond_timedwait + 40
3 JavaScriptCore 0x39b67c70 WTF::ThreadCondition::timedWait(WTF::Mutex&, double) + 104
4 JavaScriptCore 0x39c79552 JSC::BlockAllocator::blockFreeingThreadMain() + 78
5 JavaScriptCore 0x39c8bfa8 WTF::wtfThreadEntryPoint(void*) + 12
6 libsystem_c.dylib 0x35d3e30e _pthread_start + 306
7 libsystem_c.dylib 0x35d3e1d4 thread_start + 4
Thread 6 name: WebCore: CFNetwork Loader
Thread 6:
0 libsystem_kernel.dylib 0x328e2eb4 mach_msg_trap + 20
1 libsystem_kernel.dylib 0x328e3048 mach_msg + 36
2 CoreFoundation 0x336da040 __CFRunLoopServiceMachPort + 124
3 CoreFoundation 0x336d8d9e __CFRunLoopRun + 878
4 CoreFoundation 0x3364beb8 CFRunLoopRunSpecific + 352
5 CoreFoundation 0x3364bd44 CFRunLoopRunInMode + 100
6 WebCore 0x37a42f6a WebCore::runLoaderThread(void*) + 138
7 JavaScriptCore 0x39c8bfa8 WTF::wtfThreadEntryPoint(void*) + 12
8 libsystem_c.dylib 0x35d3e30e _pthread_start + 306
9 libsystem_c.dylib 0x35d3e1d4 thread_start + 4

Answer 1

Per my project's current experience, this is an example of the WebKit running out of memory due to memory leaks in the GWT application that we are trying to fix.