详解mpaas离线包pushWindow方法的两个参数defaultTitle和readTitle在iOS客户端代码执行流程以及自定义导航条之后的适配方法（一）

在支付宝h5官方文档上，有这么两个参数

// 打开淘宝首页，自动读取title，并且去除右边菜单
AlipayJSBridge.call('pushWindow', {
  url: 'https://m.taobao.com/',
  param: {
    readTitle: true,
    showOptionMenu: false
  }
});

名称	类型	描述	默认值	版本
defaultTitle	string	默认标题, 在页面第一次加载之前显示在标题栏上	‘’
readTitle	bool	是否读取网页标题显示在titleBar上	true

他们是控制标题的显示,但是自定义h5显示的vc和导航条之后这两个参数就失效了。

很容易找到了一个oc方法设置主副标题，使用真机版的二进制文件

void -[H5WebViewController setTitleViewTitle:]

void -[H5WebViewController setTitleViewTitle:](void * self, void * _cmd, void * arg2) {
    *(r31 + 0xffffffffffffffc0) = r24;
    *(0xffffffffffffffd0 + r31) = r23;
    r31 = r31 + 0xffffffffffffffc0;
    *(r31 + 0x10) = r22;
    *(0x20 + r31) = r21;
    *(r31 + 0x20) = r20;
    *(0x30 + r31) = r19;
    *(r31 + 0x30) = r29;
    *(0x40 + r31) = r30;
    r20 = self;
    r19 = [arg2 retain];
    r0 = [r20 viewControllerProxy];
    r0 = [r0 retain];
    r22 = r0;
    r0 = [r0 getExpando:@"readTitle"];
    r29 = r31 + 0x30;
    r0 = [r0 retain];
    r24 = [r0 boolValue];
    [r0 release];
    [r22 release];
    if ((r24 != 0x0) && ([r19 length] != 0x0)) {
            r0 = [r20 viewControllerProxy];
            r0 = [r0 retain];
            r20 = r0;
            r0 = [r0 navigationTitleView];
            r0 = [r0 retain];
            [r0 setMainTitle:r19 subtitle:zero_extend_64(0x0)];
            [r0 release];
            [r20 release];
    }
    [r19 release];
    return;
}

可以看到，真机比模拟器冗余了好多，这个方法就是判断 readTitle 是不是 yes，然后取title展示。

然后看看哪里调用了setTitleViewTitle，

打个断点吧

竟然是这么个调用方法，然后

0000000102cb8f98         dq         __ZL17_load_method_name+493152              ; @selector(setTitleViewTitle:), "setTitleViewTitle:", DATA XREF=

-[Plugin4HandleProxyRequest handleEvent:]+2992,

-[Plugin4HandleProxyRequest handleEvent:]+5164,

-[TAComponentWebview observeValueForKeyPath:ofObject:change:context:]+336

经验证是-[Plugin4HandleProxyRequest handleEvent:]这个里面调用的

void -[Plugin4HandleProxyRequest handleEvent:](void * self, void * _cmd, void * arg2) {
    var_-48 = self;
    r13 = [arg2 retain];
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    if ([@"proxy.request.start.handle" isEqualToString:rdx] == 0x0) goto loc_101785e7a;

loc_101785c53:
    rdx = [PSDProxyEvent class];
    r15 = [r13 isKindOfClass:rdx];
    [rbx release];
    if (r15 == 0x0) goto loc_101785e83;

loc_101785c90:
    rax = [r13 request];
    rax = [rax retain];
    var_-96 = rax;
    r12 = [[rax URL] retain];
    rax = [r13 request];
    rax = [rax retain];
    var_-56 = r13;
    rbx = [[rax mainDocumentURL] retain];
    var_-128 = [r12 isEqual:rbx];
    [rbx release];
    [rax release];
    [r12 release];
    [var_-96 release];
    rax = _H5ConfigServiceDict(@"h5_shouldRecordCookieUserConfig");
    rax = [rax retain];
    var_-72 = rax;
    var_-104 = [[rax objectForKey:@"shouldOpen"] retain];
    rbx = [[var_-56 request] retain];
    r13 = [[rbx URL] retain];
    [rbx release];
    var_-96 = [[r13 relativePath] retain];
    rbx = [[r13 host] retain];
    rax = [var_-56 request];
    rax = [rax retain];
    var_-136 = rax;
    r14 = [[rax mainDocumentURL] retain];
    rax = [r14 host];
    rax = [rax retain];
    var_-120 = rbx;
    rdi = rbx;
    var_-112 = rax;
    rdx = rax;
    rbx = _objc_msgSend;
    rax = [rdi isEqualToString:rdx];
    var_-64 = r13;
    if (rax == 0x0) goto loc_101786921;

loc_101785e3f:
    rax = var_-96;
    if (rax == 0x0) goto loc_101786cd3;

loc_101785e4c:
    rdx = @"/xalipaynebulabridge/xalipaynebulabridge.js";
    r15 = [rax hasPrefix:rdx];
    r13 = var_-120;
    rbx = var_-112;
    goto loc_101786f2e;

loc_101786f2e:
    [rbx release];
    [r14 release];
    [var_-136 release];
    [r13 release];
    r13 = var_-56;
    if (r15 != 0x0) {
            rdx = r13;
            [var_-48 responseH5JSBridgeWithEvent:rdx];
    }
    goto loc_101786f6a;

loc_101786f6a:
    if (var_-128 != 0x0) {
            r14 = [[r13 request] retain];
            r15 = [[var_-48 redirect2ErrorPageIfURLIsHTTPAlipayScheme:r14] retain];
            rdx = r15;
            [r13 setRequest:rdx];
            [r15 release];
            [r14 release];
    }
    r14 = [[r13 request] retain];
    r15 = [[r13 context] retain];
    rbx = [[r15 currentViewController] retain];
    [var_-48 resetUAWithRequest:r14 vc:rbx];
    [rbx release];
    [r15 release];
    [r14 release];
    [var_-96 release];
    [var_-64 release];
    [var_-104 release];
    [var_-72 release];
    goto loc_101787051;

loc_101787051:
    r13 = var_-56;
    goto loc_1017872aa;

loc_1017872aa:
    [r13 release];
    return;

loc_101786cd3:
    [var_-112 release];
    [r14 release];
    [var_-136 release];
    [var_-120 release];
    r13 = var_-56;
    goto loc_101786f6a;

loc_101786921:
    r12 = [(rbx)(r13, @selector(host), rdx) retain];
    rdx = @"xalipaynebula";
    rax = (rbx)(r12, @selector(isEqualToString:), rdx);
    r15 = 0x0;
    if (var_-96 != 0x0) {
            rbx = var_-112;
            if (rax != 0x0) {
                    rdx = @"/xalipaynebulabridge/xalipaynebulabridge.js";
                    r15 = [var_-96 hasPrefix:rdx];
            }
    }
    else {
            rbx = var_-112;
    }
    [r12 release];
    r13 = var_-120;
    goto loc_101786f2e;

loc_101785e83:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    if ([@"proxy.request.start.dest" isEqualToString:rdx] == 0x0) goto loc_1017861c8;

loc_101785eaf:
    rdx = [PSDProxyEvent class];
    r15 = [r13 isKindOfClass:rdx];
    [rbx release];
    if (r15 == 0x0) goto loc_1017861d1;

loc_101785eec:
    r15 = [[r13 request] retain];
    rax = [r15 URL];
    rax = [rax retain];
    rcx = _objc_msgSend;
    rbx = [[rax absoluteString] retain];
    var_-72 = [_H5String(rbx, @"") retain];
    [rbx release];
    [rax release];
    [r15 release];
    rax = [r13 request];
    rax = [rax retain];
    r14 = [[rax URL] retain];
    r12 = [[r13 request] retain];
    rbx = [[r12 mainDocumentURL] retain];
    r15 = r13;
    r13 = [r14 isEqual:rbx];
    [rbx release];
    [r12 release];
    [r14 release];
    [rax release];
    if (r13 != 0x0) {
            r13 = r15;
            r14 = [[r13 request] retain];
            r12 = [[r14 HTTPMethod] retain];
            if ([r12 isEqualToString:@"GET"] != 0x0) {
                    r15 = [var_-72 length];
                    [r12 release];
                    [r14 release];
                    if (r15 != 0x0) {
                            var_-56 = r13;
                            r14 = var_-48;
                            r13 = [[r14 dateToLongString] retain];
                            if ([r13 length] != 0x0) {
                                    rcx = var_-72;
                                    r8 = r13;
                                    rax = [NSString stringWithFormat:@"%@&ts=%@", rcx, r8];
                                    rax = [rax retain];
                                    var_-48 = rax;
                                    rdx = rax;
                                    r15 = [[r14 signContent:rdx] retain];
                                    if ([r15 length] != 0x0) {
                                            r14 = [[var_-56 request] retain];
                                            rdx = [NSMutableURLRequest class];
                                            r12 = [r14 isKindOfClass:rdx, rcx, r8];
                                            [r14 release];
                                            if (r12 != 0x0) {
                                                    r12 = [[var_-56 request] retain];
                                                    [r12 setValue:r15 forHTTPHeaderField:@"sign"];
                                                    rcx = @"ts";
                                                    var_-64 = r12;
                                                    [r12 setValue:r13 forHTTPHeaderField:rcx];
                                            }
                                            else {
                                                    var_-64 = 0x0;
                                            }
                                    }
                                    else {
                                            var_-64 = 0x0;
                                    }
                                    [r15 release];
                                    [var_-48 release];
                            }
                            else {
                                    var_-64 = 0x0;
                            }
                            [r13 release];
                            r13 = var_-56;
                    }
                    else {
                            var_-64 = 0x0;
                    }
            }
            else {
                    [r12 release];
                    [r14 release];
                    var_-64 = 0x0;
            }
    }
    else {
            var_-64 = 0x0;
            r13 = r15;
    }
    var_-48 = [[APLanguageSetting currentLanguage] retain];
    r14 = [[H5Configs sharedConfigs] retain];
    r12 = [[r14 networkParams] retain];
    [r14 release];
    r14 = [[var_-48 name] retain];
    var_-104 = r12;
    rdx = r14;
    var_-96 = [[r12 objectForKey:rdx] retain];
    [r14 release];
    r12 = [[var_-48 name] retain];
    rsi = @selector(length);
    r15 = _objc_msgSend;
    if (_objc_msgSend(r12, rsi) == 0x0) goto loc_101787273;

loc_101787182:
    rsi = @selector(length);
    if (_objc_msgSend(var_-96, rsi) == 0x0) goto loc_101787273;

loc_101787198:
    r14 = [(r15)(r13, @selector(request)) retain];
    rax = (r15)(@class(NSMutableURLRequest), @selector(class));
    rsi = @selector(isKindOfClass:);
    rdx = rax;
    rax = (r15)(r14, rsi, rdx);
    var_-56 = r13;
    [r14 release];
    [r12 release];
    if (rax == 0x0) goto loc_101787285;

loc_1017871f8:
    r14 = [(r15)(var_-56, @selector(request), rdx) retain];
    [var_-64 release];
    r13 = [(r15)(var_-48, @selector(name), rdx) retain];
    r12 = [(r15)(var_-104, @selector(objectForKey:), r13) retain];
    rsi = @selector(setValue:forHTTPHeaderField:);
    rcx = @"Accept-Language";
    rdx = r12;
    (r15)(r14, rsi, rdx, rcx);
    [r12 release];
    [r13 release];
    r13 = var_-56;
    goto loc_10178728d;

loc_10178728d:
    [var_-96 release];
    [var_-104 release];
    [var_-48 release];
    [var_-72 release];
    [r14 release];
    goto loc_1017872aa;

loc_101787285:
    r13 = var_-56;
    goto loc_101787289;

loc_101787289:
    r14 = var_-64;
    goto loc_10178728d;

loc_101787273:
    [r12 release];
    goto loc_101787289;

loc_1017861d1:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    if ([@"proxy.request.data.finish" isEqualToString:rdx] == 0x0) goto loc_1017862d9;

loc_1017861fd:
    rdx = [PSDProxyEvent class];
    r15 = [r13 isKindOfClass:rdx];
    [rbx release];
    if (r15 == 0x0) goto loc_1017862e2;

loc_10178623a:
    rax = [r13 response];
    rax = [rax retain];
    r15 = [[rax URL] retain];
    rbx = [[r15 absoluteString] retain];
    r12 = [var_-48 shouldUseJSCInjectJSWithUrl:rbx];
    [rbx release];
    [r15 release];
    [rax release];
    r13 = r13;
    if (r12 == 0x0) {
            [var_-48 insertJs:r13];
    }
    goto loc_1017872aa;

loc_1017862e2:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    if ([@"proxy.request.finish" isEqualToString:rdx] == 0x0) goto loc_1017863f6;

loc_10178630e:
    rdx = [PSDProxyEvent class];
    r15 = [r13 isKindOfClass:rdx];
    [rbx release];
    if (r15 == 0x0) goto loc_1017863ff;

loc_10178634b:
    rax = [r13 request];
    rax = [rax retain];
    var_-48 = rax;
    r15 = [[rax URL] retain];
    rbx = r13;
    r13 = [[r13 request] retain];
    r12 = [[r13 mainDocumentURL] retain];
    if ([r15 isEqual:r12, rcx] == 0x0) goto loc_101786b61;

loc_1017863c8:
    [r12 release];
    [r13 release];
    [r15 release];
    [var_-48 release];
    r13 = rbx;
    r14 = [[r13 context] retain];
    r15 = [[r14 currentViewController] retain];
    rbx = [@(YES) retain];
    [r15 setExpando:@"kExpandPropertyKey_MainDocRequestFinish" withValue:rbx];
    [rbx release];
    [r15 release];
    [r14 release];
    goto loc_1017872aa;

loc_101786b61:
    var_-96 = r15;
    var_-56 = rbx;
    rax = [rbx request];
    rax = [rax retain];
    var_-72 = rax;
    rsi = @selector(URL);
    rax = _objc_msgSend(rax, rsi);
    rax = [rax retain];
    if (rax == 0x0) goto loc_10178705a;

loc_101786ba7:
    var_-104 = rax;
    rax = [var_-56 request];
    rax = [rax retain];
    r14 = [[rax URL] retain];
    rbx = [objc_getAssociatedObject(r14, @"KPSDMainUrlFallback") retain];
    [rbx release];
    [r14 release];
    [rax release];
    [var_-104 release];
    [var_-72 release];
    [r12 release];
    [r13 release];
    [var_-96 release];
    [var_-48 release];
    r13 = var_-56;
    if (rbx != 0x0) {
            r14 = [[r13 context] retain];
            r15 = [[r14 currentViewController] retain];
            rbx = [@(YES) retain];
            [r15 setExpando:@"kExpandPropertyKey_MainDocRequestFinish" withValue:rbx];
            [rbx release];
            [r15 release];
            [r14 release];
    }
    goto loc_1017872aa;

loc_10178705a:
    [var_-72 release];
    [r12 release];
    [r13 release];
    [var_-96 release];
    rdi = var_-48;
    goto loc_101786f0f;

loc_101786f0f:
    [rdi release];
    goto loc_101787051;

loc_1017863ff:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    r14 = @selector(isEqualToString:);
    r15 = [@"view.inject.js" isEqualToString:rdx];
    [rbx release];
    if (r15 == 0x0) goto loc_101786642;

loc_10178643b:
    var_-56 = r13;
    rax = [r13 target];
    rax = [rax retain];
    r12 = &var_-232;
    *r12 = 0x0;
    *(r12 + 0x8) = r12;
    *(r12 + 0x10) = 0x3032000000;
    r15 = rax;
    xmm0 = zero_extend_64(___Block_byref_object_dispose_);
    xmm1 = intrinsic_punpcklqdq(zero_extend_64(___Block_byref_object_copy_), xmm0);
    var_-96 = intrinsic_movdqa(var_-96, xmm1);
    *(int128_t *)(r12 + 0x18) = intrinsic_movdqu(*(int128_t *)(r12 + 0x18), xmm1);
    [@"" retain];
    *(r12 + 0x28) = @"";
    if ([r15 isKindOfClass:[r15 class]] != 0x0) {
            r14 = &var_-184;
            *r14 = 0x0;
            *(r14 + 0x8) = r14;
            *(r14 + 0x10) = 0x3032000000;
            *(int128_t *)(r14 + 0x18) = intrinsic_movdqu(*(int128_t *)(r14 + 0x18), intrinsic_movdqa(xmm0, var_-96));
            [@"" retain];
            *(r14 + 0x28) = @"";
            rbx = [[r15 contentView] retain];
            r13 = [rbx isKindOfClass:[UIWebView class]];
            [rbx release];
            if (r13 != 0x0) {
                    rax = [r15 contentView];
                    rax = [rax retain];
                    var_-312 = __NSConcreteStackBlock;
                    *(&var_-312 + 0x8) = 0xc2000000;
                    *(&var_-312 + 0x10) = ___41-[Plugin4HandleProxyRequest handleEvent:]_block_invoke;
                    *(&var_-312 + 0x18) = ___block_descriptor_tmp;
                    *(&var_-312 + 0x20) = r14;
                    [rax evaluateJavaScript:@"document.title" completionHandler:rcx];
                    [rax release];
                    rax = [r15 contentView];
                    rax = [rax retain];
                    var_-272 = __NSConcreteStackBlock;
                    *(&var_-272 + 0x8) = 0xc2000000;
                    *(&var_-272 + 0x10) = ___41-[Plugin4HandleProxyRequest handleEvent:]_block_invoke.643;
                    *(&var_-272 + 0x18) = ___block_descriptor_tmp.646;
                    *(&var_-272 + 0x20) = r12;
                    [rax evaluateJavaScript:@"document.location.href" completionHandler:rcx];
                    [rax release];
            }
            else {
                    r13 = [[r15 contentView] retain];
                    rbx = [r13 isKindOfClass:[WKWebView class]];
                    [r13 release];
                    if (rbx != 0x0) {
                            objc_storeStrong(var_-176 + 0x28, @"");
                            rbx = [[r15 createParam] retain];
                            *(var_-224 + 0x28) = [[rbx url] retain];
                            [*(var_-224 + 0x28) release];
                            [rbx release];
                    }
            }
            if ([var_-48 shouldUseJSCInjectJSWithUrl:*(var_-224 + 0x28)] != 0x0) {
                    r14 = [[var_-56 target] retain];
                    rbx = [[r14 contentView] retain];
                    r13 = [[rbx psdViewController] retain];
                    [rbx release];
                    if ([r13 respondsToSelector:@selector(setTitleViewTitle:)] != 0x0) {
                            [r13 performSelectorOnMainThread:@selector(setTitleViewTitle:) withObject:*(var_-176 + 0x28) waitUntilDone:0x0];
                    }
                    [var_-56 preventDefault];
                    [var_-56 stopPropagation];
                    [r13 release];
                    [r14 release];
            }
            _Block_object_dispose(&var_-184, 0x8);
            [*(&var_-184 + 0x28) release];
    }
    rsi = 0x8;
    _Block_object_dispose(&var_-232, rsi);
    [*(&var_-232 + 0x28) release];
    rdi = r15;
    goto loc_101786f0f;

loc_101786642:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    r15 = _objc_msgSend(@"page.load.domready", r14, rdx);
    [rbx release];
    if (r15 == 0x0) goto loc_101786998;

loc_10178667f:
    rbx = [[r13 target] retain];
    rdx = [PSDPage class];
    if ([rbx isKindOfClass:rdx] != 0x0) {
            var_-56 = r13;
            var_-96 = rbx;
            r13 = [[rbx parentKernelObject] retain];
            rbx = [[r13 parentKernelObject] retain];
            [r13 release];
            rdx = [PSDScene class];
            if ([rbx isKindOfClass:rdx] != 0x0) {
                    var_-72 = rbx;
                    r13 = [[rbx viewController] retain];
                    rbx = [[r13 psdContentView] retain];
                    [r13 release];
                    rdx = [WKWebView class];
                    if ([rbx isKindOfClass:rdx] != 0x0) {
                            var_-64 = rbx;
                            rbx = [rbx retain];
                            var_-104 = [[rbx title] retain];
                            var_-128 = rbx;
                            r15 = [[rbx URL] retain];
                            rbx = [[r15 absoluteString] retain];
                            rsi = @selector(shouldUseJSCInjectJSWithUrl:);
                            rdx = rbx;
                            r13 = _objc_msgSend(var_-48, rsi, rdx);
                            r14 = _objc_msgSend;
                            [rbx release];
                            [r15 release];
                            if (r13 != 0x0) {
                                    rax = (r14)(var_-72, @selector(viewController), rdx);
                                    rax = [rax retain];
                                    var_-48 = rax;
                                    rdx = @selector(setTitleViewTitle:);
                                    rbx = r14;
                                    if ((r14)(rax, @selector(respondsToSelector:), rdx) != 0x0) {
                                            rdx = @selector(setTitleViewTitle:);
                                            rcx = var_-104;
                                            [var_-48 performSelectorOnMainThread:rdx withObject:rcx waitUntilDone:0x0];
                                    }
                                    r14 = rbx;
                                    r13 = [(r14)(var_-96, @selector(bridge), rdx, rcx, 0x0) retain];
                                    r15 = [(r14)(var_-72, @selector(viewController), rdx, rcx, 0x0) retain];
                                    rbx = [(r14)(@class(H5FilePreloadManager), @selector(jsDynamicInjectToJSCWithVc:url:), r15, 0x0, 0x0) retain];
                                    rsi = @selector(loadJS:);
                                    rdx = rbx;
                                    (r14)(r13, rsi, rdx, 0x0, 0x0);
                                    [rbx release];
                                    [r15 release];
                                    [r13 release];
                                    [var_-48 release];
                            }
                            [var_-104 release];
                            [var_-128 release];
                            rbx = var_-64;
                    }
                    [rbx release];
                    rbx = var_-72;
            }
            [rbx release];
            r13 = var_-56;
            rbx = var_-96;
    }
    rdi = rbx;
    goto loc_101786b56;

loc_101786b56:
    [rdi release];
    goto loc_1017872aa;

loc_101786998:
    rbx = [[r13 eventType] retain];
    rdx = rbx;
    r14 = _objc_msgSend(@"proxy.request.response.handle", r14, rdx);
    [rbx release];
    if (r14 == 0x0) goto loc_1017872aa;

loc_1017869d5:
    rax = [r13 retain];
    var_-48 = rax;
    rbx = [[rax response] retain];
    rdx = [NSHTTPURLResponse class];
    r15 = [rbx isKindOfClass:rdx];
    [rbx release];
    if (r15 != 0x0) {
            rax = [var_-48 response];
            rax = [rax retain];
            var_-96 = rax;
            r14 = [[rax allHeaderFields] retain];
            rbx = [[r14 objectForKey:@"Set-Cookie"] retain];
            [rbx release];
            if (rbx != 0x0) {
                    rbx = [[var_-48 context] retain];
                    rax = [rbx currentViewController];
                    rax = [rax retain];
                    var_-72 = r14;
                    r14 = rax;
                    rax = [r14 psdView];
                    rax = [rax retain];
                    [r14 release];
                    [rbx release];
                    rbx = [[var_-96 URL] retain];
                    r14 = var_-72;
                    [H5WKWebViewManager syncCookieWithHeaders:r14 psdView:rax responseUrl:rbx];
                    [rbx release];
                    r13 = r13;
                    [rax release];
            }
            [r14 release];
            [var_-96 release];
    }
    rdi = var_-48;
    goto loc_101786b56;

loc_1017863f6:
    [rbx release];
    goto loc_1017863ff;

loc_1017862d9:
    [rbx release];
    goto loc_1017862e2;

loc_1017861c8:
    [rbx release];
    goto loc_1017861d1;

loc_101785e7a:
    [rbx release];
    goto loc_101785e83;
}

这个方法真长，然后是bool -[Plugin4HandleProxyRequest shouldUseJSCInjectJSWithUrl:]判断后才走到

bool -[Plugin4HandleProxyRequest shouldUseJSCInjectJSWithUrl:](void * self, void * _cmd, void * arg2) {
    r15 = [arg2 retain];
    r12 = [[H5Configs sharedConfigs] retain];
    if ([r12 shouldUseJSCInjectJS] != 0x0) {
            rax = [NSURL URLWithFixedString:r15];
            rax = [rax retain];
            var_-56 = rax;
            rbx = [[rax host] retain];
            var_-48 = rbx;
            r14 = [[H5Configs sharedConfigs] retain];
            rax = [r14 useJSCInjectJSHostBlackList];
            rax = [rax retain];
            rbx = _H5RegexTest(rbx, rax) ^ 0x1;
            r15 = r15;
            r12 = r12;
            [rax release];
            [r14 release];
            [var_-48 release];
            [var_-56 release];
    }
    else {
            rbx = 0x0;
    }
    [r12 release];
    [r15 release];
    rax = rbx;
    return rax;
}

同时找到自动获取webview标题方法                   

[rax evaluateJavaScript:@"document.title" completionHandler:rcx];

执行顺序：页面加载完成主动设置title显示。

 param: {

                readTitle: false,

}

或者

 param: {

                readTitle: true,

}

都会到setTitleViewTitle方法。

param: {

                readTitle: true,

                defaultTitle: 'fff',                

                }

                param: {

                readTitle: false,

                defaultTitle: 'fff',

                }

也都没有影响

setTitleViewTitle传过来的值依然是网页的<title>

再看最开始的方法，这个似乎只读取了title，不会设置defaultTitle

void -[H5WebViewController setTitleViewTitle:](void * self, void * _cmd, void * arg2) {
    r12 = [arg2 retain];
    var_-48 = self;
    r13 = [[self viewControllerProxy] retain];
    rbx = [[r13 getExpando:@"readTitle"] retain];
    r15 = [rbx boolValue];
    [rbx release];
    rbx = r12;
    [r13 release];
    if ((r15 != 0x0) && ([rbx length] != 0x0)) {
            r15 = [[var_-48 viewControllerProxy] retain];
            r14 = [[r15 navigationTitleView] retain];
            [r14 setMainTitle:rbx subtitle:0x0];
            [r14 release];
            [r15 release];
    }
    [rbx release];
    return;
}

我们看demo工程，再看void -[H5NavigationTitleView setMainTitle:subtitle:]

void -[H5NavigationTitleView setMainTitle:subtitle:](void * self, void * _cmd, void * arg2, void * arg3) {
    r15 = self;
    r13 = [arg2 retain];
    var_-80 = r15;
    *(&var_-80 + 0x8) = _OBJC_CLASS_$_H5NavigationTitleView;
    rax = [arg3 retain];
    r14 = r13;
    var_-64 = rax;
    rcx = rax;
    [[&var_-80 super] setMainTitle:r14 subtitle:rcx];
    [r15 setTitleViewHidden:0x1];
    rdx = r14;
    r13 = [r15 canSetImageTitle:rdx];
    if (r13 == 0x0) {
            rbx = [[r15 mainTitleImageView] retain];
            [rbx removeFromSuperview];
            [rbx release];
            [r15 setMainTitleImageView:0x0, rcx];
    }
    if ([r15 shouldUseAUSearch] == 0x0) {
            [r15->_mainTitleSearchView removeFromSuperview];
            r15->_mainTitleSearchView = 0x0;
            [r15->_mainTitleSearchView release];
    }
    if ([r15 shouldUseAUSearch] == 0x0) goto loc_1016ee044;

loc_1016ee038:
    rsi = @selector(createAUSearchTitleView);
    goto loc_1016ee0eb;

loc_1016ee0eb:
    _objc_msgSend(r15, rsi);
    goto loc_1016ee0f4;

loc_1016ee0f4:
    NSLog(@"H5NavigationTitleView setMainTitle-subtitle %@ %@ %@", r15, r14, var_-64);
    _APLogToFile(@"H5NavigationTitleView", 0x4e20, @"H5NavigationTitleView setMainTitle-subtitle %@ %@ %@", r15, r14, var_-64);
    [var_-64 release];
    [r14 release];
    return;

loc_1016ee044:
    if (r13 != 0x0) goto loc_1016ee0f4;

loc_1016ee04d:
    [r15 setTitleViewHidden:0x0];
    rax = [r15 currentViewController];
    rax = [rax retain];
    r13 = [[rax options] retain];
    rbx = [[r13 segWidths] retain];
    var_-48 = [rbx count];
    [rbx release];
    [r13 release];
    [rax release];
    r14 = r14;
    if (var_-48 == 0x0) goto loc_1016ee0f4;

loc_1016ee0e4:
    rsi = @selector(createSegmentControl);
    goto loc_1016ee0eb;
}

    param: {

                readTitle: false,

                defaultTitle: 'fff',

                }

这样设置时，上面方法则会显示defaultTitle

看demo工程(重写后的工程里面不调用setMainTitle:subtitle)

可以看到默认标题在开始加载请求,会创建新的vc,的时候就确定了。

后面会走到setTitleViewTitle，但里面的readtitle已经取不到值了

未完 下篇待续