系統(tǒng)：
iOS 10或更低版本
復(fù)現(xiàn)步驟：
新建一個空的UIWebView工程洛退，然后
加載含有輸入框的網(wǎng)頁(如 https://www.baidu.com)块蚌，輸入任意幾個字符传轰，然后收起鍵盤背传；
長按網(wǎng)頁其他位置的文本呆瞻，出現(xiàn)放大鏡后拖動到之前的輸入框里，此時必現(xiàn) crash
5b0b7bdc194f2.gif
堆棧信息：
Application Specific Information:
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[_NSObserverList setCursorPosition:]: unrecognized selector sent to instance 0x1700bcf80'
Last Exception Backtrace:
0 CoreFoundation __exceptionPreprocess + 124
1 libobjc.A.dylib objc_exception_throw + 56
2 CoreFoundation __methodDescriptionForSelector + 0
3 CoreFoundation ___forwarding___ + 916
4 CoreFoundation _CF_forwarding_prep_0 + 92
5 UIKit -[_UIKeyboardTextSelectionController selectTextWithGranularity:atPoint:executionContext:] + 784
6 UIKit -[_UIKeyboardBasedNonEditableTextSelectionGestureController oneFingerForcePress:] + 1008
7 UIKit -[UIGestureRecognizerTarget _sendActionWithGestureRecognizer:] + 64
8 UIKit _UIGestureRecognizerSendTargetActions + 124
9 UIKit -[UIGestureRecognizer _forceLevelClassifier:currentForceLevelDidChange:] + 368
10 UIKit -[_UIForceLevelClassifier setCurrentForceLevel:] + 108
11 UIKit -[_UILinearForceLevelClassifier observeTouchWithForceValue:atTimestamp:withCentroidAtLocation:] + 156
12 UIKit __48-[_UIForceLevelClassifier receiveObservedValue:]_block_invoke + 160
13 UIKit -[_UITouchForceMessage ifObservation:ifReset:] + 304
14 UIKit -[_UIForceLevelClassifier receiveObservedValue:] + 280
15 Foundation -[_NSObserverList _receiveBox:] + 568
16 Foundation __68-[NSObject(DefaultObservationImplementations) receiveObservedValue:]_block_invoke + 64
17 Foundation -[NSObject(DefaultObservationImplementations) receiveObservedValue:] + 216
18 UIKit -[_UITouchForceObservable receiveObservedValue:] + 440
19 QuartzCore CA::Display::DisplayLinkItem::dispatch(unsigned long long) + 44
20 QuartzCore CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 444
21 IOKit IODispatchCalloutFromCFMessage + 372
22 CoreFoundation __CFMachPortPerform + 180
23 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
24 CoreFoundation __CFRunLoopDoSource1 + 436
25 CoreFoundation __CFRunLoopRun + 1840
26 CoreFoundation CFRunLoopRunSpecific + 444
27 GraphicsServices GSEventRunModal + 180
28 UIKit -[UIApplication _run] + 684
29 UIKit UIApplicationMain + 208
30 seagull main (main.m:14)
解決方案：
- 禁用webView長按出現(xiàn)放大鏡功能径玖。 該方法有副作用痴脾，用戶可能無法長按復(fù)制文本。
[webView tt_evaluateJavaScript:@"document.documentElement.style.webkitUserSelect='none';"
completionHandler:NULL];
- 參考蜜蜂團隊的解決思路：
結(jié)合控制臺輸出的錯誤信息
[_UIKeyboardTextSelectionController setCursorPosition:]: message sent to deallocated instance 0x6080000f5a20初步分析梳星，可認(rèn)為某個 UIGestureRecognizer 觸發(fā)回調(diào)時赞赖，_UIKeyboardTextSelectionController 已經(jīng)被釋放，但 UIGestureRecognizerTarget 引用的指針未置空（可能由于 assign 修飾符導(dǎo)致）冤灾，從而造成 bad access前域。
考慮 crash 的原因是 _UIKeyboardTextSelectionController 對象銷毀過早，因此可以使用變通的辦法韵吨，即 hook 導(dǎo)致其銷毀的方法（-[UIWebDocumentView useSelectionAssistantWithMode:] ）话侄，然后通過 GCD 延遲釋放。
- Code
@implementation UIWebView (SelectionAssistantFix)
+ (void)load
{
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
//UIKeyboardTextSelectionController
Class webDocumentViewCls = NSClassFromString(@"UIWebDocumentView");
SEL swizzedSel = NSSelectorFromString(@"useSelectionAssistantWithMode:");
SEL overrideSelector = @selector(p_useSelectionAssistantWithMode:);
SwizzledMethod(webDocumentViewCls, self, swizzedSel, overrideSelector);
});
}
- (void)p_useSelectionAssistantWithMode:(int)arg1
{
NSString *key = @"webSelectionAssistant";
if ([self respondsToSelector:NSSelectorFromString(key)]) {
__block id assistant = [self valueForKey:key];
dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
[assistant isKindOfClass:[NSObject class]];
assistant = nil;
});
}
}
@end
```
