iOS crash in executing JS by JavascriptCore

My iOS app suffers a crash that onerous to be reproduced. This is crash stack I can present.

EXC_BAD_ACCESS KERN_INVALID_ADDRESS 0x0000000000000000 (typically nonzero, like  0x1170000000007db7)
Crashed: com.apple.main-thread

0  JavaScriptCore                 0xe3dc1c     JSC::objectConstructorAssign(JSC::JSGlobalObject*, JSC::CallFrame*) + 656
1  JavaScriptCore                 0x2b80a0 llint_function_for_construct_arity_checkTagGateAfter + 160236
2  JavaScriptCore                 0x2b80a0 llint_function_for_construct_arity_checkTagGateAfter + 160236
3  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
4  JavaScriptCore                 0x2b4a48 llint_function_for_construct_arity_checkTagGateAfter + 146324
5  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
6  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
7  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
8  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
9  JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
10 JavaScriptCore                 0x2b4a48 llint_function_for_construct_arity_checkTagGateAfter + 146324
11 JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
12 JavaScriptCore                 0x2b4a48 llint_function_for_construct_arity_checkTagGateAfter + 146324
13 JavaScriptCore                 0x2b4990 llint_function_for_construct_arity_checkTagGateAfter + 146140
14 JavaScriptCore                 0x2b5f90 llint_function_for_construct_arity_checkTagGateAfter + 151772
15 JavaScriptCore                 0x28a980 vmEntryToJavaScriptGateAfter + 6
16 JavaScriptCore                 0x9fdfe8 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 532
17 JavaScriptCore                 0xc74cb0 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 184
18 JavaScriptCore                 0x36ecfc JSObjectCallAsFunction + 572
19 ... (skips app stack)

For extra info,

1. my app makes use of JSBinding to handle some JS objects.
2. jscontext(js international object) just isn’t probably dealloced.
3. cannot present full codes. The final code snippet is JSObjectCallAsFunction(jscontext, jsobject, NULL, 0, NULL, NULL);, whereas jsobject refers to a js perform.

I’ve bought some info by inner check. Right here’re some guesses,

1. perhaps JS objects has dealloc unexpectly.
2. it is not going a multi-thread challenge after reviewing my codes.

Can anybody assist to determine the foundation trigger? Any concepts shall be appreciated.