[iOS] Crash `EXC_BAD_ACCESS (code=1, address=0x0)` in `shouldOverrideUrlLoading` during multi-window navigation

[bossPsw]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

javascript action -> window.open('..........do')

step 1 : xcode 16 (ios 18 ok, ios 26 ok)
step 2 : xcode 26 (ios 18 bad_access, ios 26 ok)

InAppWebView.swift
@available(iOS 14.0, *)
public func evaluateJavaScript(_ javaScript: String, frame: WKFrameInfo? = nil, contentWorld: WKContentWorld, completionHandler: ((Result<Any, Error>) -> Void)? = nil) {
if let applePayAPIEnabled = settings?.applePayAPIEnabled, applePayAPIEnabled {
return
}
super.evaluateJavaScript(javaScript, in: frame, in: contentWorld, completionHandler: completionHandler) Thread 1: EXC_BAD_ACCESS (code=1, address=0x0)
}
@available(iOS 14.0, *)
public func injectDeferredObject(source: String, contentWorld: WKContentWorld, withWrapper jsWrapper: String?, completionHandler: ((Any?) -> Void)? = nil) {
var jsToInject = source
if let wrapper = jsWrapper {
let jsonData: Data? = try? JSONSerialization.data(withJSONObject: [source], options: [])
let sourceArrayString = String(data: jsonData!, encoding: .utf8)
let sourceString: String? = (sourceArrayString! as NSString).substring(with: NSRange(location: 1, length: (sourceArrayString?.count ?? 0) - 2))
jsToInject = String(format: wrapper, sourceString!)
}

    jsToInject = configuration.userContentController.generateCodeForScriptEvaluation(scriptMessageHandler: self, source: jsToInject, contentWorld: contentWorld)
    
    evaluateJavaScript(jsToInject, frame: nil, contentWorld: contentWorld) { (evalResult) in
        guard let completionHandler = completionHandler else {
            return
        }
        
        switch (evalResult) {
        case .success(let value):
            completionHandler(value)
            return
        case .failure(let error):
            let userInfo = (error as NSError).userInfo
            let errorMessage = userInfo["WKJavaScriptExceptionMessage"] ??
                               userInfo["NSLocalizedDescription"] as? String ??
                               error.localizedDescription
            self.channelDelegate?.onConsoleMessage(message: String(describing: errorMessage), messageLevel: 3)
            break
        }
        
        completionHandler(nil)
    }
}

Expected Behavior

app crash
Process 1336 resuming
Process 1336 stopped

• thread Screenshots/Images #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  frame #0: 0x0000000000000000
  error: memory read failed for 0x0
  Target 0: (Runner) stopped.

Steps with code example to reproduce

Steps with code example to reproduce

Future onCreateWindow(webController, createWindowAction) async {
debugPrint('${createWindowAction.request}');

String url = createWindowAction.request.url.toString();

if (Common.isContainLink(url)) {
  Common.lunchUrl(url);
  return false;
}

Navigator.of(context)
    .push<Map<String, String>?>(
  MaterialPageRoute(
    fullscreenDialog: true,
    builder: (_) => WindowPopup(
      createWindowAction: createWindowAction,
      request: createWindowAction.request,
    ),
  ),
)
    .then((result) async {
  if (result == null || result.isEmpty) {
    return;
  }

  await WidgetsBinding.instance.endOfFrame;
  if (!mounted) {
    return;
  }

  SchemeProcess.sendJavascript(
    result["callback"] ?? "",
    result,
    webController,
  );
});

return true;

}
Future<NavigationActionPolicy?> shouldOverrideUrlLoading(
InAppWebViewController webcontroller,
NavigationAction navigationAction) async {
debugPrint('shouldOverrideUrlLoading : ${navigationAction.request.url}');
// Common.setWebViewCookie(webcontroller);
final url = navigationAction.request.url.toString();
try {
if (url.contains(Config.scheme)) {
processingScheme(url, controller.webViewController!);
return NavigationActionPolicy.CANCEL;
}
if (Common.isContainLink(url)) {
await Common.lunchUrl(url);
return NavigationActionPolicy.CANCEL;
}
if (navigationAction.request.url!.hasScheme &&
navigationAction.request.url!.scheme.contains('http') == false) {
await Common.lunchUrl(url);
return NavigationActionPolicy.CANCEL;
}
} catch (e) {
debugPrint("팝업 shouldOverrideUrlLoading Error: $e");
}

return NavigationActionPolicy.ALLOW;

}

Stacktrace/Logs

Stacktrace/Logs

<Replace this line by pasting your stacktrace or logs here>

Flutter version

3.44.6

Operating System, Device-specific and/or Tool

ios 26 -

Plugin version

v6.2.0-beta3

Additional information

No response

Self grab

• I'm ready to work on this issue!