Open Radar

 
Summary:
UIWebView crashes when browsing sfgate.com within a few page loads <10, usually 2-3. It can crash on the main page, or an article on that site.
See crash log attached.

Steps to Reproduce:
1. download a simple UIWebView example app, this one will do: https://github.com/msencenb/UIWebView-Example
2. make sure Info.plist has
<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>
3. for this example change the default loaded page (the example from step 1 has google.com as the default url:
- (void)viewDidLoad
{
    NSURL *url = [NSURL URLWithString:@"http://www.sfgate.com"];
    NSURLRequest *request = [NSURLRequest requestWithURL:url];
    [webView loadRequest:request];
    [super viewDidLoad];
}
4. run the app, click on links from sfgate.com for articles, within a few clicks the crash will occur

Expected Results:
I expect no crash

Actual Results:
Crashes. All UIWebView-based browsers will crash also (Dolphin, Puffin, Maxthon, Adblock Plus, etc.)

Version:
iOS 9.1

Configuration:
Multiple devices (iPhone 5+6, iPad Air)

Crash log:
Thread : Crashed: com.apple.main-thread
0  JavaScriptCore                 0x186a5a710 WTFCrash + 72
1  JavaScriptCore                 0x186a5a708 WTFCrash + 64
2  WebCore                        0x18797f32c WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion const*) + 2244
3  WebCore                        0x187986604 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 596
4  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
5  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
6  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
7  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
8  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
9  WebCore                        0x187986dd0 WebCore::Style::resolveTree(WebCore::Element&, WebCore::RenderStyle&, WebCore::RenderTreePosition&, WebCore::Style::Change) + 2592
10 WebCore                        0x18798639c WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) + 364
11 WebCore                        0x18705e634 WebCore::Document::recalcStyle(WebCore::Style::Change) + 268
12 WebCore                        0x186d63894 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() + 60
13 WebKitLegacy                   0x187ca28a0 LayerFlushController::flushLayers() + 52
14 WebCore                        0x18769fa4c WebCore::LayerFlushScheduler::layerFlushCallback() + 44
15 WebKitLegacy                   0x187d2ce78 WebViewLayerFlushScheduler::layerFlushCallback() + 36
16 CoreFoundation                 0x183260588 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32
17 CoreFoundation                 0x18325e32c __CFRunLoopDoObservers + 372
18 CoreFoundation                 0x18325e75c __CFRunLoopRun + 928
19 CoreFoundation                 0x18318d680 CFRunLoopRunSpecific + 384
20 GraphicsServices               0x18469c088 GSEventRunModal + 180
21 UIKit                          0x188004d90 UIApplicationMain + 204
22 Client                         0x1000833a8 main (main.swift:26)
23 libdispatch.dylib              0x182d2e8b8 (Missing)