JavaScriptCore`JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const:
0x18c6a4cac <+0>: stp x24, x23, [sp, #-0x40]!
0x18c6a4cb0 <+4>: stp x22, x21, [sp, #0x10]
0x18c6a4cb4 <+8>: stp x20, x19, [sp, #0x20]
0x18c6a4cb8 <+12>: stp x29, x30, [sp, #0x30]
0x18c6a4cbc <+16>: add x29, sp, #0x30 ; =0x30
0x18c6a4cc0 <+20>: mov x19, x1
0x18c6a4cc4 <+24>: mov x20, x0
0x18c6a4cc8 <+28>: ldr x8, [x19, #0x10]
0x18c6a4ccc <+32>: cbnz x8, 0x18c6a4d2c ; <+128>
0x18c6a4cd0 <+36>: ldr x0, [x19]
0x18c6a4cd4 <+40>: ldr x8, [x0, #0x8]
0x18c6a4cd8 <+44>: cbz x8, 0x18c6a4cf8 ; <+76>
0x18c6a4cdc <+48>: cbz x0, 0x18c6a4d14 ; <+104>
0x18c6a4ce0 <+52>: ldp x8, x9, [x0]
0x18c6a4ce4 <+56>: cbz x8, 0x18c6a4d00 ; <+84>
0x18c6a4ce8 <+60>: str x9, [x8, #0x8]
0x18c6a4cec <+64>: ldr x9, [x0, #0x8]
0x18c6a4cf0 <+68>: cbnz x9, 0x18c6a4d08 ; <+92>
0x18c6a4cf4 <+72>: b 0x18c6a4d10 ; <+100>
0x18c6a4cf8 <+76>: mov w0, #0x0
0x18c6a4cfc <+80>: b 0x18c6a4e58 ; <+428>
0x18c6a4d00 <+84>: str x9, [x19]
0x18c6a4d04 <+88>: cbz x9, 0x18c6a4d10 ; <+100>
0x18c6a4d08 <+92>: str x8, [x9]
0x18c6a4d0c <+96>: b 0x18c6a4d14 ; <+104>
0x18c6a4d10 <+100>: str x8, [x19, #0x8]
0x18c6a4d14 <+104>: bl 0x18bdf8d38 ; WTF::fastFree(void*)
0x18c6a4d18 <+108>: ldr x8, [x19, #0x18]
0x18c6a4d1c <+112>: sub x8, x8, #0x1 ; =0x1
0x18c6a4d20 <+116>: str x8, [x19, #0x18]
0x18c6a4d24 <+120>: orr w8, wzr, #0x1fe
0x18c6a4d28 <+124>: str x8, [x19, #0x10]
0x18c6a4d2c <+128>: cmp x20, x19
0x18c6a4d30 <+132>: cset w9, eq
0x18c6a4d34 <+136>: strb w9, [x20, #0xa8]
0x18c6a4d38 <+140>: adrp x9, 172246
0x18c6a4d3c <+144>: add x9, x9, #0xfa0 ; =0xfa0
0x18c6a4d40 <+148>: ldr w9, [x9, #0x1260]
0x18c6a4d44 <+152>: orr w0, wzr, #0x1
0x18c6a4d48 <+156>: cmp w9, #0x0 ; =0x0
0x18c6a4d4c <+160>: ccmp x8, #0x0, #0x4, ne
0x18c6a4d50 <+164>: b.eq 0x18c6a4e58 ; <+428>
0x18c6a4d54 <+168>: sub w22, w0, w9
0x18c6a4d58 <+172>: adrp x23, 166681
0x18c6a4d5c <+176>: add x23, x23, #0x28 ; =0x28
0x18c6a4d60 <+180>: b 0x18c6a4d78 ; <+204>
0x18c6a4d64 <+184>: ldrb w8, [x20, #0xa8]
0x18c6a4d68 <+188>: cbz w8, 0x18c6a4e40 ; <+404>
0x18c6a4d6c <+192>: mov x1, x21
0x18c6a4d70 <+196>: bl 0x18c3b2f8c ; JSC::HeapSnapshotBuilder::appendNode(JSC::JSCell*)
0x18c6a4d74 <+200>: b 0x18c6a4e40 ; <+404>
0x18c6a4d78 <+204>: ldr x9, [x19]
0x18c6a4d7c <+208>: sub x8, x8, #0x1 ; =0x1
0x18c6a4d80 <+212>: add x9, x9, x8, lsl #3
0x18c6a4d84 <+216>: str x8, [x19, #0x10]
0x18c6a4d88 <+220>: ldr x21, [x9, #0x10]
0x18c6a4d8c <+224>: str x21, [x20, #0xa0]
0x18c6a4d90 <+228>: strb wzr, [x21, #0x7]
0x18c6a4d94 <+232>: dmb ish
0x18c6a4d98 <+236>: ldrb w8, [x21, #0x5]
0x18c6a4d9c <+240>: cmp w8, #0x22 ; =0x22
0x18c6a4da0 <+244>: b.eq 0x18c6a4dcc ; <+288>
0x18c6a4da4 <+248>: cmp w8, #0x18 ; =0x18
0x18c6a4da8 <+252>: b.eq 0x18c6a4de4 ; <+312>
0x18c6a4dac <+256>: cmp w8, #0x6 ; =0x6
0x18c6a4db0 <+260>: b.ne 0x18c6a4dfc ; <+336>
0x18c6a4db4 <+264>: mov x0, x21
0x18c6a4db8 <+268>: mov x1, x20
0x18c6a4dbc <+272>: bl 0x18be0a288 ; JSC::JSString::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
0x18c6a4dc0 <+276>: ldr x0, [x20, #0x98]
0x18c6a4dc4 <+280>: cbz x0, 0x18c6a4e40 ; <+404>
0x18c6a4dc8 <+284>: b 0x18c6a4d64 ; <+184>
0x18c6a4dcc <+288>: mov x0, x21
0x18c6a4dd0 <+292>: mov x1, x20
0x18c6a4dd4 <+296>: bl 0x18beae2c0 ; JSC::JSObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
0x18c6a4dd8 <+300>: ldr x0, [x20, #0x98]
0x18c6a4ddc <+304>: cbz x0, 0x18c6a4e40 ; <+404>
0x18c6a4de0 <+308>: b 0x18c6a4d64 ; <+184>
0x18c6a4de4 <+312>: mov x0, x21
0x18c6a4de8 <+316>: mov x1, x20
0x18c6a4dec <+320>: bl 0x18beafa60 ; JSC::JSFinalObject::visitChildren(JSC::JSCell*, JSC::SlotVisitor&)
0x18c6a4df0 <+324>: ldr x0, [x20, #0x98]
0x18c6a4df4 <+328>: cbz x0, 0x18c6a4e40 ; <+404>
0x18c6a4df8 <+332>: b 0x18c6a4d64 ; <+184>
0x18c6a4dfc <+336>: ldr x8, [x20, #0x90]
0x18c6a4e00 <+340>: ldr x8, [x8, #0x388]
0x18c6a4e04 <+344>: ldr w9, [x21]
0x18c6a4e08 <+348>: ldr x8, [x8, #0xf8]
0x18c6a4e0c <+352>: and x9, x9, #0x7fffffff
0x18c6a4e10 <+356>: ldr x8, [x8, x9, lsl #3]
-> 0x18c6a4e14 <+360>: ldr x8, [x8, #0x40]
0x18c6a4e18 <+364>: ldr x9, [x23]
0x18c6a4e1c <+368>: eor x9, x9, x8
0x18c6a4e20 <+372>: cmp x8, #0x0 ; =0x0
0x18c6a4e24 <+376>: csel x8, xzr, x9, eq
0x18c6a4e28 <+380>: ldr x8, [x8, #0x28]
0x18c6a4e2c <+384>: mov x0, x21
0x18c6a4e30 <+388>: mov x1, x20
0x18c6a4e34 <+392>: blr x8
0x18c6a4e38 <+396>: ldr x0, [x20, #0x98]
0x18c6a4e3c <+400>: cbnz x0, 0x18c6a4d64 ; <+184>
0x18c6a4e40 <+404>: str xzr, [x20, #0xa0]
0x18c6a4e44 <+408>: orr w0, wzr, #0x1
0x18c6a4e48 <+412>: cbz w22, 0x18c6a4e58 ; <+428>
0x18c6a4e4c <+416>: ldr x8, [x19, #0x10]
0x18c6a4e50 <+420>: add w22, w22, #0x1 ; =0x1
0x18c6a4e54 <+424>: cbnz x8, 0x18c6a4d78 ; <+204>
0x18c6a4e58 <+428>: ldp x29, x30, [sp, #0x30]
0x18c6a4e5c <+432>: ldp x20, x19, [sp, #0x20]
0x18c6a4e60 <+436>: ldp x22, x21, [sp, #0x10]
0x18c6a4e64 <+440>: ldp x24, x23, [sp], #0x40
0x18c6a4e68 <+444>: ret
经常性崩溃，已经遇到好几次了