ScriptingCore::getInstance()->executeFunctionWithOwner EXC_BAD_ACCESS(code = 1, address = 0x4)

my question is that i use objc*+ to request to my server and download something, whatever the result is, success or failed, i need to turn back the result to javascript. To do this, i add a C*+ class as a media to interact with javascript. Following is my code:
//IAPCC.mm
void IAPCC::requestProducts(){
[[HMIAPHelper sharedInstance]requestProductsWithCompletionHandler:^(BOOL success, NSArray products) {
if (success) {
_products = [NSMutableArray array];
for (IAPProduct product in products) {
[_products addObject:product];
}
IAPBinding::sharedInstance()->isSucceed = true;
NSLog(@“isSucceed = d", IAPBinding::sharedInstance()->isSucceed);

IAPBinding::sharedInstance()->RequestProductSucceed();
}else{
}
}];
}
This function is to request to the server, if succeed, i will invoke RequestProductSucceed() in IAPBinding class
//IAPBinding.cpp
void IAPBinding::RequestProductSucceed(){//成功从服务器下载plist文件
printf(“RequestProductSucceed!\n”);
Message *msg = new Message();
msg->what = WS_MSG_REQUESTSUCCEED;
_helper->sendMessageToUIThread(msg);
}
At first I thought the bug is caused by different thread, so when the request is succeed, i push the msg to the queue, and i check the update function, if the queue isn’t null, so i invoke js function in IAPBinding.cpp, as following:
//
void ThreadHelper::update(float dt){
Message *msg = NULL;
pthread_mutex_lock(&_UIMessageQueueMutex);
if (0 == _UIMessageQueue->size())
{
pthread_mutex_unlock(&_UIMessageQueueMutex);
return;
}
msg = *(_UIMessageQueue->begin());
printf(“msg->what(update) = d\n”, msg->what);
_UIMessageQueue->pop_front();
pthread_mutex_unlock(xx_UIMessageQueueMutex);
if (*binding){
*binding -> onUIThreadReceiveMessage(msg);
}
CC_SAFE_DELETE(msg);
}
void IAPBinding::onUIThreadReceiveMessage(Message* msg){
switch (msg->what) {
case WS_MSG_REQUESTSUCCEED:{
displayProduct();
}
break;
case WS_MSG_REQUESTFAILED:
break;
default:
break;
}
}
void IAPBinding::displayProduct(){
js_proxy_t* p = jsb_get_native_proxy(this);
jsval retval;
ScriptingCore::getInstance()->executeFunctionWithOwner(OBJECT_TO_JSVAL(p->obj),”callback", 0, NULL, &retval);
}

There is the bug , and i don’t know why, because when i invoke the displayProduct() funtion in js directly, it’s OK! I hope someone can help me to solve this, Thanks!

ps: I have a menu item in js, when i tapped that menu, js invoke the above function requestProducts() in IAPCC.mm through IAPBinding.cpp.