详解mpaas离线包pushWindow方法的两个参数defaultTitle和readTitle在iOS客户端代码执行流程以及自定义导航条之后的适配方法（二）

从阿里云官网获取代码示例，只看h5容器的： 示例链接

h5像下面这样，两个参数都不设置，代码默认读取网页的title。

            <button class="jsapiButton" onclick="jsapi_call('pushWindow', {url:window.location.href,
                param: {
                username: 'xxxxx',
                password: 'aaaaaa',
<!--                readTitle: false,-->
<!--                defaultTitle: '你'-->
                },
                passData: {
                username: 'xxxxx',
                password: 'aaaaaa',
                }
                })">pushWindow 自定义参数</button>
            

在 MPH5Demo_pod`-[NBNavigationTitleView setMainTitle:]: 处设置断点

可以看到初始化h5页面和页面加载完成后各调用一次

第一次明显的create和init操作。

先从简单的看，看第二次赋值. 把模拟器app直接拖进hopper

-[UIWebView(NBLifecycle) webViewDidFinishLoad:]

void -[UIWebView webViewDidFinishLoad:](void * self, void * _cmd, void * arg2) {
    r13 = self;
    rbx = [arg2 retain];
    if ([r13 shouldSkipHandleLoad] != 0x0) {
            [r13 setShouldSkipHandleLoad:0x0];
    }
    else {
            var_38 = rbx;
            rbx = [[r13 webPageProfile] retain];
            rdx = 0x2;
            r15 = [rbx setState:rdx];
            [rbx release];
            if (r15 != 0x0) {
                    r15 = [[NSDate date] retain];
                    rbx = [[r13 webPageProfile] retain];
                    [rbx setCompleteDate:r15];
                    [rbx release];
                    [r15 release];
                    r12 = [[r13 webPageProfile] retain];
                    r15 = [[r12 completeDate] retain];
                    rbx = [[r13 webPageProfile] retain];
                    [rbx setDidFinishedLoadDate:r15];
                    [rbx release];
                    [r15 release];
                    [r12 release];
                    objc_initWeak(&var_30, r13);
                    *(&var_40 + 0xffffffffffffffe0) = __NSConcreteStackBlock;
                    *(&var_40 + 0xffffffffffffffe8) = 0xc2000000;
                    *(&var_40 + 0xfffffffffffffff0) = ___47-[UIWebView(NBLifecycle) webViewDidFinishLoad:]_block_invoke;
                    *(&var_40 + 0xfffffffffffffff8) = ___block_descriptor_tmp.288;
                    objc_copyWeak(&var_40, &var_30);
                    rcx = &var_60;
                    [r13 evaluateJavaScript:@"document.title" completionHandler:rcx];
                    r12 = [[r13 request] retain];
                    r15 = [[r13 webPageProfile] retain];
                    [r15 setFinalRequest:r12];
                    [r15 release];
                    [r12 release];
                    r12 = [[r13 request] retain];
                    rbx = [[r13 webPageProfile] retain];
                    [rbx setRequest:r12];
                    [rbx release];
                    [r12 release];
                    r12 = [[r13 pageDelegate] retain];
                    rbx = [[r13 webPageProfile] retain];
                    rdx = rbx;
                    [r12 contentViewPageComplete:rdx];
                    [rbx release];
                    [r12 release];
                    objc_destroyWeak(&var_40);
                    objc_destroyWeak(&var_30);
            }
            rbx = [[r13 assignedDelegate] retain];
            rdx = @selector(webViewDidFinishLoad:);
            r15 = _objc_msgSend;
            r14 = [rbx respondsToSelector:rdx, rcx];
            [rbx release];
            rbx = var_38;
            if (r14 != 0x0) {
                    r14 = [(r15)(r13, @selector(assignedDelegate), rdx) retain];
                    (r15)(r14, @selector(webViewDidFinishLoad:), rbx);
                    [r14 release];
            }
    }
    [rbx release];
    return;
}

看到里面多次调用了 -[UIWebView webPageProfile] 它是后加的属性@"kWebView_WebPageProfile"

-[UIWebView(NBLifecycle) webViewDidFinishLoad:]打断点

 po [self webPageProfile]

<NBLogPagePerformance: 0x7f9c9b499820>

webViewDidFinishLoad方法主要：

1.设置了一些判断标记，

2.获取网页title，

3.调用代理（assignedDelegate）的webViewDidFinishLoad:方法。

然后到-[PSDJsBridge webViewDidFinishLoad:] 

void -[PSDJsBridge webViewDidFinishLoad:](void * self, void * _cmd, void * arg2) {
    r13 = self;
    r14 = [arg2 retain];
    rbx = [[r13 webViewDelegate] retain];
    r15 = [rbx respondsToSelector:@selector(webViewDidFinishLoad:)];
    [rbx release];
    if (r15 != 0x0) {
            rbx = [[r13 webViewDelegate] retain];
            [rbx webViewDidFinishLoad:r14];
            [rbx release];
    }
    [r13 loadFinished];
    [r14 release];
    return;
}

继续向上调用webViewDelegate的webViewDidFinishLoad:

void -[PSDView webViewDidFinishLoad:](void * self, void * _cmd, void * arg2) {
    var_38 = [arg2 retain];
    [self injectJS];
    rbx = [[self page] retain];
    r12 = [[PSDPageEvent loadCompleteEvent] retain];
    [rbx dispatchEvent:r12];
    [r12 release];
    [rbx release];
    r15 = [[arg2 request] retain];
    [var_38 release];
    rbx = [[PSDNavigationEvent completeEvent:r15] retain];
    [self dispatchEvent:rbx];
    [rbx release];
    [r15 release];
    return;
}

1.js注入

2.(lldb) po [self page]

<PSDPage: 0x6000032ba4c0>

继承于PSDKernel，核心事件分发-[PSDKernel dispatchEvent:]

bool -[PSDKernel dispatchEvent:](void * self, void * _cmd, void * arg2) {
    rbx = self;
    r12 = [arg2 retain];
    if (r12 == 0x0) goto loc_1006a454b;

loc_1006a4256:
    var_E0 = r12;
    [r12 setTarget:rbx];
    r14 = [[NSMutableArray array] retain];
    rax = [rbx retain];
    var_C0 = rax;
    if (rax != 0x0) {
            rbx = var_C0;
            do {
                    [r14 insertObject:rbx atIndex:0x0];
                    r13 = [[rbx parentEventTarget] retain];
                    [rbx release];
                    rbx = r13;
            } while (r13 != 0x0);
    }
    r12 = var_E0;
    [r12 setEventPhase:0x0];
    rbx = [[PSDContext contextWithEvent:r12 eventTargetList:r14] retain];
    [r12 setContext:rbx];
    [rbx release];
    *(int128_t *)(&var_140 + 0x30) = intrinsic_movaps(*(int128_t *)(&var_140 + 0x30), 0x0);
    *(int128_t *)(&var_140 + 0x20) = intrinsic_movaps(*(int128_t *)(&var_140 + 0x20), 0x0);
    *(int128_t *)(&var_140 + 0x10) = intrinsic_movaps(*(int128_t *)(&var_140 + 0x10), 0x0);
    var_140 = intrinsic_movaps(var_140, 0x0);
    rax = [r14 retain];
    var_B8 = rax;
    rax = [rax countByEnumeratingWithState:&var_140 objects:&var_B0 count:0x10];
    var_E8 = rax;
    rbx = _objc_msgSend;
    r15 = var_C0;
    if (rax == 0x0) goto loc_1006a4500;

loc_1006a43b2:
    var_100 = **(&var_140 + 0x10);
    goto loc_1006a43c7;

loc_1006a43c7:
    r14 = 0x0;
    goto loc_1006a4410;

loc_1006a4410:
    if (*var_130 != var_100) {
            objc_enumerationMutation(var_B8);
    }
    r13 = *(var_138 + r14 * 0x8);
    rdx = r13;
    (rbx)(r12, @selector(setCurrentTarget:), rdx);
    r12 = [(rbx)(r13, @selector(captureEventListenersDict)) retain];
    r15 = rbx;
    rbx = (rbx)(r12, @selector(count));
    rdi = r12;
    r12 = var_E0;
    [rdi release];
    COND = rbx == 0x0;
    rbx = r15;
    r15 = var_C0;
    if (COND) goto loc_1006a44b0;

loc_1006a4491:
    if ((rbx)(r12, @selector(isStoped), rdx) != 0x0) goto loc_1006a450f;

loc_1006a44a1:
    (rbx)(r13, @selector(fireEvent:), r12);
    goto loc_1006a44b0;

loc_1006a44b0:
    if (r13 == r15) goto loc_1006a450f;

loc_1006a44b5:
    r14 = r14 + 0x1;
    if (r14 < var_E8) goto loc_1006a4410;

loc_1006a44cc:
    rax = (rbx)(var_B8, @selector(countByEnumeratingWithState:objects:count:), &var_140, &var_B0, 0x10);
    var_E8 = rax;
    if (rax != 0x0) goto loc_1006a43c7;

loc_1006a4500:
    [var_B8 release];
    goto loc_1006a4523;

loc_1006a4523:
    rax = [r12 currentTarget];
    rax = [rax retain];
    if (rax == r15) goto loc_1006a454f;

loc_1006a4540:
    [rax release];
    goto loc_1006a4571;

loc_1006a4571:
    rbx = 0x0;
    goto loc_1006a4573;

loc_1006a4573:
    [var_B8 release];
    goto loc_1006a4580;

loc_1006a4580:
    [r12 release];
    if (*___stack_chk_guard == *___stack_chk_guard) {
            rax = rbx ^ 0x1;
    }
    else {
            rax = __stack_chk_fail();
    }
    return rax;

loc_1006a454f:
    r14 = rbx;
    rbx = [r12 isStoped];
    [r15 release];
    if (rbx == 0x0) goto loc_1006a45b4;
    goto loc_1006a4571;

loc_1006a45b4:
    rbx = r14;
    (rbx)(r12, @selector(setEventPhase:), 0x1);
    (rbx)(r15, @selector(fireEvent:), r12);
    if ((rbx)(r12, @selector(bubbles)) == 0x0) goto loc_1006a46fb;

loc_1006a45e7:
    (rbx)(r12, @selector(setEventPhase:), 0x2);
    rax = (rbx)(var_B8, @selector(count), 0x2);
    rcx = rax;
    rax = rax + 0xfffffffffffffffe;
    if (rax < 0x0) goto loc_1006a46fb;

loc_1006a4611:
    rcx = rcx - 0x1;
    goto loc_1006a4645;

loc_1006a4645:
    rcx = rcx - 0x1;
    var_C0 = rcx;
    r14 = [(rbx)(var_B8, @selector(objectAtIndexedSubscript:), rcx, rcx) retain];
    rdx = r14;
    (rbx)(r12, @selector(setCurrentTarget:), rdx, rcx);
    r12 = [(rbx)(r14, @selector(normalEventListenersDict)) retain];
    r15 = (rbx)(r12, @selector(count));
    rdi = r12;
    r12 = var_E0;
    [rdi release];
    if (r15 == 0x0) goto loc_1006a46d3;

loc_1006a46b4:
    if ((rbx)(r12, @selector(isStoped), rdx, rcx) != 0x0) goto loc_1006a46f2;

loc_1006a46c4:
    (rbx)(r14, @selector(fireEvent:), r12);
    goto loc_1006a46d3;

loc_1006a46d3:
    [r14 release];
    rcx = var_C0;
    if (rcx > 0x0) goto loc_1006a4645;

loc_1006a46fb:
    rbx = [r12 isCancelled];
    goto loc_1006a4573;

loc_1006a46f2:
    [r14 release];
    goto loc_1006a46fb;

loc_1006a450f:
    [var_B8 release];
    goto loc_1006a4523;

loc_1006a454b:
    rbx = 0x0;
    goto loc_1006a4580;
}

r12是传入的参数

(lldb) register read r12

     r12 = 0x0000600003dccc40

(lldb) po 0x0000600003dccc40

PSDNavigationEvent-navigation.complete

(lldb) po [0x0000600003dccc40 class]

PSDNavigationEvent

创建的事件[PSDContext contextWithEvent:r12 eventTargetList:r14]看看是什么

(lldb) register read r15

     r15 = 0x000060000189c0f0

(lldb) po 0x000060000189c0f0

<__NSArrayM 0x60000189c0f0>(

<PSDService: 0x6000035aadf0>,

<PSDSession: 0x6000032b9200>,

<PSDScene: 0x6000032b9560>,

<PSDView: 0x600003ddb250>

)

后面-[PSDKernel fireEvent:]

void -[PSDKernel fireEvent:](void * self, void * _cmd, void * arg2) {
    r14 = self;
    rbx = [arg2 retain];
    rax = [rbx eventPhase];
    if ((rax == 0x2) || (rax == 0x1)) goto loc_1006a4757;

loc_1006a4749:
    if (rax != 0x0) goto loc_1006a476a;

loc_1006a474e:
    rsi = @selector(handleCaptureEvent:);
    goto loc_1006a475e;

loc_1006a475e:
    _objc_msgSend(r14, rsi);
    goto loc_1006a476a;

loc_1006a476a:
    [rbx release];
    return;

loc_1006a4757:
    rsi = @selector(handleNormalEvent:);
    goto loc_1006a475e;
}

然后-[PSDKernel handleNormalEvent:]

void -[PSDKernel handleNormalEvent:](void * self, void * _cmd, void * arg2) {
    r15 = [arg2 retain];
    rbx = [[self normalEventListenersDict] retain];
    [self handleEvent:r15 evenListenersDict:rbx];
    [r15 release];
    [rbx release];
    return;
}

然后-[PSDKernel handleEvent:evenListenersDict:]

void -[PSDKernel handleEvent:evenListenersDict:](void * self, void * _cmd, void * arg2, void * arg3) {
    var_248 = [arg2 retain];
    r15 = [[arg3 retain] retain];
    objc_sync_enter(r15);
    r14 = [[r15 allKeys] retain];
    objc_sync_exit(r15);
    [r15 release];
    *(int128_t *)(&var_3D0 + 0x30) = intrinsic_movaps(*(int128_t *)(&var_3D0 + 0x30), 0x0);
    *(int128_t *)(&var_3D0 + 0x20) = intrinsic_movaps(*(int128_t *)(&var_3D0 + 0x20), 0x0);
    *(int128_t *)(&var_3D0 + 0x10) = intrinsic_movaps(*(int128_t *)(&var_3D0 + 0x10), 0x0);
    var_3D0 = intrinsic_movaps(var_3D0, 0x0);
    rax = [r14 retain];
    var_278 = rax;
    rax = [rax countByEnumeratingWithState:&var_3D0 objects:&var_B0 count:0x10];
    var_298 = rax;
    if (rax == 0x0) goto loc_1006a398b;

loc_1006a3195:
    var_2D0 = **(&var_3D0 + 0x10);
    rbx = _objc_msgSend;
    var_250 = r15;
    goto loc_1006a31b8;

loc_1006a31b8:
    r12 = 0x0;
    goto loc_1006a322b;

loc_1006a322b:
    if (*var_3C0 != var_2D0) {
            objc_enumerationMutation(var_278);
    }
    r14 = *(var_3C8 + r12 * 0x8);
    if ((rbx)(@"*.*", @selector(isEqualToString:), r14) == 0x0) goto loc_1006a344a;

loc_1006a3270:
    var_258 = r12;
    r15 = [r15 retain];
    objc_sync_enter(r15);
    r13 = rbx;
    rbx = [(rbx)(r15, @selector(objectForKey:), r14) retain];
    r14 = [(r13)(@class(NSArray), @selector(arrayWithArray:), rbx) retain];
    [rbx release];
    objc_sync_exit(r15);
    [r15 release];
    var_360 = intrinsic_movaps(var_360, 0x0);
    var_370 = intrinsic_movaps(var_370, 0x0);
    var_380 = intrinsic_movaps(var_380, 0x0);
    var_390 = intrinsic_movaps(var_390, 0x0);
    r15 = [r14 retain];
    rax = (r13)(r15, @selector(countByEnumeratingWithState:objects:count:), &var_390, &var_130, 0x10);
    var_240 = rax;
    rbx = r13;
    if (rax == 0x0) goto loc_1006a38f6;

loc_1006a3345:
    var_270 = *var_380;
    var_238 = r15;
    goto loc_1006a335d;

loc_1006a335d:
    r12 = 0x0;
    goto loc_1006a3383;

loc_1006a3383:
    if (*var_380 != var_270) {
            objc_enumerationMutation(var_238);
    }
    r14 = *(var_388 + r12 * 0x8);
    r13 = var_248;
    if ((rbx)(r13, @selector(isStoped)) != 0x0) goto loc_1006a38ef;

loc_1006a33c4:
    rbx = [(rbx)(r14, @selector(weakObjectValue)) retain];
    [rbx handleEvent:r13];
    rdi = rbx;
    rbx = _objc_msgSend;
    [rdi release];
    r12 = r12 + 0x1;
    if (r12 < var_240) goto loc_1006a3383;

loc_1006a340e:
    rbx = _objc_msgSend;
    r15 = var_238;
    rax = [r15 countByEnumeratingWithState:&var_390 objects:&var_130 count:0x10];
    var_240 = rax;
    if (rax != 0x0) goto loc_1006a335d;

loc_1006a38f6:
    [r15 release];
    [r15 release];
    r15 = var_250;
    goto loc_1006a3940;

loc_1006a3940:
    r12 = var_258;
    goto loc_1006a3947;

loc_1006a3947:
    r12 = r12 + 0x1;
    if (r12 < var_298) goto loc_1006a322b;

loc_1006a3957:
    rax = (rbx)(var_278, @selector(countByEnumeratingWithState:objects:count:), &var_3D0, &var_B0, 0x10);
    var_298 = rax;
    if (rax != 0x0) goto loc_1006a31b8;

loc_1006a398b:
    [var_278 release];
    [var_278 release];
    [r15 release];
    [var_248 release];
    if (*___stack_chk_guard != *___stack_chk_guard) {
            __stack_chk_fail();
    }
    return;

loc_1006a38ef:
    r15 = var_238;
    goto loc_1006a38f6;

loc_1006a344a:
    if ((rbx)(r14, @selector(hasSuffix:), @".*") == 0x0) goto loc_1006a36c7;

loc_1006a3465:
    var_258 = r12;
    rdx = (rbx)(r14, @selector(length), @".*") + 0xfffffffffffffffe;
    r13 = [(rbx)(r14, @selector(substringToIndex:), rdx) retain];
    rbx = [(rbx)(var_248, @selector(eventType), rdx) retain];
    rcx = 0x1;
    rsi = @selector(rangeOfString:options:);
    rdx = r13;
    r15 = _objc_msgSend(rbx, rsi);
    rdi = rbx;
    rbx = _objc_msgSend;
    [rdi release];
    COND = r15 != 0x0;
    r15 = var_250;
    if (COND) goto loc_1006a393a;

loc_1006a34ed:
    var_2A8 = r13;
    r15 = [r15 retain];
    objc_sync_enter(r15);
    rbx = [[r15 objectForKey:r14, 0x1] retain];
    r14 = [[NSArray arrayWithArray:rbx, 0x1] retain];
    [rbx release];
    objc_sync_exit(r15);
    [r15 release];
    var_320 = intrinsic_movaps(var_320, 0x0);
    var_330 = intrinsic_movaps(var_330, 0x0);
    var_340 = intrinsic_movaps(var_340, 0x0);
    var_350 = intrinsic_movaps(var_350, 0x0);
    r15 = [r14 retain];
    rsi = @selector(countByEnumeratingWithState:objects:count:);
    rdx = &var_350;
    rcx = &var_1B0;
    rax = _objc_msgSend(r15, rsi, rdx, rcx, 0x10);
    var_240 = rax;
    rbx = _objc_msgSend;
    if (rax == 0x0) goto loc_1006a3919;

loc_1006a35c2:
    var_270 = *var_340;
    var_238 = r15;
    goto loc_1006a35da;

loc_1006a35da:
    r15 = 0x0;
    goto loc_1006a3600;

loc_1006a3600:
    rcx = var_270;
    if (*var_340 != rcx) {
            objc_enumerationMutation(var_238);
    }
    r14 = *(var_348 + r15 * 0x8);
    r13 = var_248;
    rsi = @selector(isStoped);
    if ((rbx)(r13, rsi) != 0x0) goto loc_1006a3912;

loc_1006a3641:
    rbx = [(rbx)(r14, @selector(weakObjectValue)) retain];
    rdx = r13;
    [rbx handleEvent:rdx];
    rdi = rbx;
    rbx = _objc_msgSend;
    [rdi release];
    r15 = r15 + 0x1;
    if (r15 < var_240) goto loc_1006a3600;

loc_1006a368b:
    rbx = _objc_msgSend;
    r15 = var_238;
    rsi = @selector(countByEnumeratingWithState:objects:count:);
    rdx = &var_350;
    rcx = &var_1B0;
    rax = _objc_msgSend(r15, rsi, rdx, rcx, 0x10);
    var_240 = rax;
    if (rax != 0x0) goto loc_1006a35da;

loc_1006a3919:
    [r15 release];
    [r15 release];
    r15 = var_250;
    r13 = var_2A8;
    goto loc_1006a393a;

loc_1006a393a:
    [r13 release];
    goto loc_1006a3940;

loc_1006a3912:
    r15 = var_238;
    goto loc_1006a3919;

loc_1006a36c7:
    rbx = [(rbx)(var_248, @selector(eventType), @".*") retain];
    r15 = [rbx isEqualToString:r14];
    rdi = rbx;
    rbx = _objc_msgSend;
    [rdi release];
    COND = r15 == 0x0;
    r15 = var_250;
    if (COND) goto loc_1006a3947;

loc_1006a3718:
    var_258 = r12;
    r15 = [r15 retain];
    objc_sync_enter(r15);
    rbx = [[r15 objectForKey:r14] retain];
    r14 = [[NSArray arrayWithArray:rbx] retain];
    [rbx release];
    objc_sync_exit(r15);
    [r15 release];
    var_2E0 = intrinsic_movaps(var_2E0, 0x0);
    var_2F0 = intrinsic_movaps(var_2F0, 0x0);
    var_300 = intrinsic_movaps(var_300, 0x0);
    var_310 = intrinsic_movaps(var_310, 0x0);
    r15 = [r14 retain];
    rax = [r15 countByEnumeratingWithState:&var_310 objects:&var_230 count:0x10];
    var_240 = rax;
    rbx = _objc_msgSend;
    if (rax == 0x0) goto loc_1006a38f6;

loc_1006a37ed:
    var_270 = *var_300;
    var_238 = r15;
    goto loc_1006a3805;

loc_1006a3805:
    r12 = 0x0;
    goto loc_1006a382b;

loc_1006a382b:
    if (*var_300 != var_270) {
            objc_enumerationMutation(var_238);
    }
    r14 = *(var_308 + r12 * 0x8);
    r13 = var_248;
    if ((rbx)(r13, @selector(isStoped)) != 0x0) goto loc_1006a38ef;

loc_1006a386c:
    rbx = [(rbx)(r14, @selector(weakObjectValue)) retain];
    [rbx handleEvent:r13];
    rdi = rbx;
    rbx = _objc_msgSend;
    [rdi release];
    r12 = r12 + 0x1;
    if (r12 < var_240) goto loc_1006a382b;

loc_1006a38b6:
    rbx = _objc_msgSend;
    r15 = var_238;
    rax = [r15 countByEnumeratingWithState:&var_310 objects:&var_230 count:0x10];
    var_240 = rax;
    if (rax != 0x0) goto loc_1006a3805;
}

跟了一些上个方法传入的参数：

NBNavigationTitleViewEvent-scene.titleView.title.set

PSDPageEvent-page.load.complete

PSDNavigationEvent-navigation.complete

PSDSceneEvent-scene.appear.after

PSDMonitorEvent-monitor.log.before

PSDInvocationEvent-invocation.start

PSDInvocationEvent-invocation.invoke

NBLogPagePerformanceEvent-performance.domReady

上面这段好像就[rbx handleEvent:r13];有点用，是调用目标插件的

void -[NBPlugin4NavigationTitleView handleEvent:](void * self, void * _cmd, void * arg2) {
    r13 = self;
    r12 = [arg2 retain];
    var_80 = r13;
    *(&var_80 + 0x8) = _OBJC_CLASS_$_NBPlugin4NavigationTitleView;
    [[&var_80 super] handleEvent:r12];
    rbx = [[r12 eventType] retain];
    rdx = rbx;
    r14 = [@"scene.titleView.create.before" isEqualToString:rdx];
    [rbx release];
    if (r14 != 0x0) {
            var_38 = r12;
            r14 = [[r12 context] retain];
            rbx = [[r14 currentViewController] retain];
            [r14 release];
            var_40 = rbx;
            rbx = [[rbx navigationController] retain];
            r12 = _objc_msgSend;
            var_30 = r13;
            if (rbx != 0x0) {
                    r15 = [rbx retain];
            }
            else {
                    r14 = [_NBContextGet() retain];
                    r15 = [[r14 navigationController] retain];
                    [r14 release];
            }
            [rbx release];
            rbx = [(r12)(r15, @selector(navigationBar)) retain];
            r13 = var_38;
            rax = (r12)(r13, @selector(isCancelled));
            var_50 = r15;
            var_48 = rbx;
            if (rax != 0x0) {
                    r14 = r13;
                    r13 = [[r13 titleView] retain];
                    if (r13 != 0x0) {
                            rbx = [(r12)(r14, @selector(titleView)) retain];
                            r15 = (r12)(rbx, @selector(conformsToProtocol:), __objc_proto_NBNavigationTitleViewProtocol_protocol) ^ 0x1;
                            [rbx release];
                    }
                    else {
                            r15 = 0x0;
                    }
                    [r13 release];
                    rbx = [[r14 titleView] retain];
                    if (r15 != 0x0) {
                            rdx = __objc_proto_NBNavigationTitleViewProtocol_protocol;
                            r14 = [rbx conformsToProtocol:rdx];
                            [rbx release];
                            COND = r14 != 0x0;
                            r12 = _objc_msgSend;
                            r14 = var_30;
                            if (!COND) {
                                    rdx = cfstring__;
                                    rcx = "-[NBPlugin4NavigationTitleView handleEvent:]";
                                    [[[NSString stringWithFormat:rdx] retain] release];
                            }
                    }
                    else {
                            r14 = var_30;
                            rdx = rbx;
                            [r14 setNavigationTitleView:rdx];
                            [rbx release];
                            r12 = _objc_msgSend;
                    }
            }
            else {
                    if (rbx != 0x0) {
                            [&var_70 bounds];
                    }
                    else {
                            var_60 = intrinsic_movaps(var_60, 0x0);
                            var_70 = intrinsic_movaps(var_70, 0x0);
                    }
                    rcx = var_60;
                    r14 = var_30;
                    rsp = (rsp - 0x20) + 0x20;
                    rbx = [(r12)(r14, @selector(createNavigationTitleView:), var_70, rcx) retain];
                    (r12)(r14, @selector(setNavigationTitleView:), rbx);
                    [rbx release];
                    rbx = [(r12)(r14, @selector(navigationTitleView), rbx) retain];
                    rdx = rbx;
                    (r12)(r13, @selector(setTitleView:), rdx);
                    [rbx release];
            }
            rbx = [(r12)(r14, @selector(navigationTitleView), rdx, rcx, 0x38) retain];
            rdx = @selector(setDelegate:);
            r15 = (r12)(rbx, @selector(respondsToSelector:), rdx, rcx, 0x38);
            [rbx release];
            if (r15 != 0x0) {
                    rbx = [[r14 navigationTitleView] retain];
                    rdx = r14;
                    [rbx setDelegate:rdx];
                    [rbx release];
            }
            r13 = var_38;
            r14 = [[r13 titleView] retain];
            rbx = [[var_40 navigationItem] retain];
            [rbx setTitleView:r14];
            [rbx release];
            [r14 release];
            [var_48 release];
            [var_50 release];
            [var_40 release];
    }
    else {
            rbx = [[r12 eventType] retain];
            rdx = rbx;
            r14 = [@"scene.titleView.title.set" isEqualToString:rdx];
            [rbx release];
            if (r14 != 0x0) {
                    r13 = [[r13 navigationTitleView] retain];
                    r14 = [[r12 mainTitle] retain];
                    rbx = [[r12 subtitle] retain];
                    [r13 setMainTitle:r14 subtitle:rbx];
                    [rbx release];
                    [r14 release];
                    [r13 release];
                    r13 = r12;
            }
            else {
                    rbx = [[r12 eventType] retain];
                    rdx = rbx;
                    r14 = [@"page.load.start" isEqualToString:rdx];
                    [rbx release];
                    var_30 = r13;
                    if (r14 != 0x0) {
                            var_38 = r12;
                            rax = [r13 currentViewController];
                            rax = [rax retain];
                            var_40 = rax;
                            r12 = [[rax viewControllerProxy] retain];
                            rbx = [[r12 options] retain];
                            r13 = [rbx showTitleLoading];
                            [rbx release];
                            [r12 release];
                            if (r13 != 0x0) {
                                    rbx = [[var_30 navigationTitleView] retain];
                                    [rbx showTitleLoading];
                                    [rbx release];
                            }
                            [var_40 release];
                            r13 = var_38;
                    }
                    else {
                            rbx = [[r12 eventType] retain];
                            rdx = rbx;
                            if ([@"page.load.complete" isEqualToString:rdx] != 0x0) {
                                    [rbx release];
                                    r13 = r12;
                                    rbx = [[var_30 navigationTitleView] retain];
                                    [rbx hideTitleLoading];
                                    [rbx release];
                            }
                            else {
                                    r14 = [[r12 eventType] retain];
                                    rdx = r14;
                                    r13 = [@"page.load.error" isEqualToString:rdx];
                                    [r14 release];
                                    [rbx release];
                                    COND = r13 == 0x0;
                                    r13 = r12;
                                    if (!COND) {
                                            rbx = [[var_30 navigationTitleView] retain];
                                            [rbx hideTitleLoading];
                                            [rbx release];
                                    }
                            }
                    }
            }
    }
    [r13 release];
    return;
}

然后

void -[H5NavigationTitleView setMainTitle:subtitle:](void * self, void * _cmd, void * arg2, void * arg3) {
    r15 = self;
    r13 = [arg2 retain];
    var_50 = r15;
    *(&var_50 + 0x8) = _OBJC_CLASS_$_H5NavigationTitleView;
    rax = [arg3 retain];
    r14 = r13;
    var_40 = rax;
    rcx = rax;
    [[&var_50 super] setMainTitle:r14 subtitle:rcx];
    [r15 setTitleViewHidden:0x1];
    rdx = r14;
    r13 = [r15 canSetImageTitle:rdx];
    if (r13 == 0x0) {
            rbx = [[r15 mainTitleImageView] retain];
            [rbx removeFromSuperview];
            [rbx release];
            [r15 setMainTitleImageView:0x0, rcx];
    }
    if ([r15 shouldUseAUSearch] == 0x0) {
            [r15->_mainTitleSearchView removeFromSuperview];
            r15->_mainTitleSearchView = 0x0;
            [r15->_mainTitleSearchView release];
    }
    if ([r15 shouldUseAUSearch] == 0x0) goto loc_100563254;

loc_100563248:
    rsi = @selector(createAUSearchTitleView);
    goto loc_1005632fb;

loc_1005632fb:
    _objc_msgSend(r15, rsi);
    goto loc_100563304;

loc_100563304:
    NSLog(@"H5NavigationTitleView setMainTitle-subtitle %@ %@ %@", r15, r14, var_40);
    _APLogToFile();
    [var_40 release];
    [r14 release];
    return;

loc_100563254:
    if (r13 != 0x0) goto loc_100563304;

loc_10056325d:
    [r15 setTitleViewHidden:0x0];
    rax = [r15 currentViewController];
    rax = [rax retain];
    r13 = [[rax options] retain];
    rbx = [[r13 segWidths] retain];
    var_30 = [rbx count];
    [rbx release];
    [r13 release];
    [rax release];
    r14 = r14;
    if (var_30 == 0x0) goto loc_100563304;

loc_1005632f4:
    rsi = @selector(createSegmentControl);
    goto loc_1005632fb;
}

MPH5Demo_pod`-[H5NavigationTitleView setMainTitle:subtitle:]:下断点

(lldb) register read  r13

     r13 = 0x0000600000f45530

(lldb) po 0x0000600000f45530

H5向Native通信

(lldb) 

可以看到在上个方法中已经有MainTitle的值了

未完待续