Bug系列----打电话过程中重启

log如下：

11:50:51.462   351   351 I rmt_storage: rmt_storage_rw_iovec_cb: /boot/modem_fs2: clnt_h=0x235: req_h=0x23e msg_id=3: R/W request received
 11:50:51.462   351   351 I rmt_storage: wakelock acquired: 1, error no: 42
 11:50:51.462   351   360 I rmt_storage: rmt_storage_client_thread: /boot/modem_fs2: clnt_h=0x235 Unblock worker thread (th_id: 548154295376)
 11:50:51.462   351   360 I rmt_storage: rmt_storage_client_thread: /boot/modem_fs2: clnt_h=0x235: req_h=0x23e msg_id=3: Bytes read = 512
 11:50:51.462 31255 31255 V BoostFramework: BoostFramework() : mPerf = com.qualcomm.qti.Performance@fba5151
 11:50:51.462   351   360 I rmt_storage: rmt_storage_client_thread: /boot/modem_fs2: clnt_h=0x235: req_h=0x23e msg_id=3: Send response: res=0 err=0
 11:50:51.462   351   360 I rmt_storage: rmt_storage_client_thread: /boot/modem_fs2: clnt_h=0x235 About to block rmt_storage client thread (th_id: 548154295376) wakelock released: 1, error no: 0
 11:50:51.462   351   360 I rmt_storage: 
 11:50:51.463 29130 30373 D Telecom : [TELECOM][[TELECOM][DTMF]]: onForegroundCallChanged(): old [77595510, DISCONNECTED, com.android.phone/com.android.services.telephony.TelephonyConnectionService, tel:***********, A, childs(0), has_parent(false), [[Capabilities: CAPABILITY_HOLD CAPABILITY_SUPPORT_HOLD CAPABILITY_MUTE]], false, ComponentInfo{com.android.phone/com.android.services.telephony.TelephonyConnectionService}, [356a192b7913b04c54574d18c28d46e6395428ab], UserHandle{0}], new null
 11:50:51.476 29321 29321 W AudioOut_2: type=1400 audit(0.0:308873): avc: denied { call } for scontext=u:r:mediaserver:s0 tcontext=u:r:audiod:s0 tclass=binder permissive=0
 11:50:51.463 29130 31562 D Telecom : [TELECOM][InCallTonePlayer]: run(toneId = 5)
 11:50:51.463 31255 31255 V BoostFramework: BoostFramework() : mPerf = com.qualcomm.qti.Performance@cc17db6
 11:50:51.463 29130 31562 D Telecom : [TELECOM][[TELECOM][InCallTonePlayer]]: run(): TONE_CDMA_DROP
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:387] Tried to mark 0xf8 not contained by any spaces
02-13 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:391] Field info:  holder=0x13f74bc0 holder is 

 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:391] 
 11:50:51.463 29130 30373 D Telecom : [TELECOM][[TELECOM][DTMF]]: endDtmfSession(): call [77595510, DISCONNECTED, com.android.phone/com.android.services.telephony.TelephonyConnectionService, tel:***********, A, childs(0), has_parent(false), [[Capabilities: CAPABILITY_HOLD CAPABILITY_SUPPORT_HOLD CAPABILITY_MUTE]], false, ComponentInfo{com.android.phone/com.android.services.telephony.TelephonyConnectionService}, [356a192b7913b04c54574d18c28d46e6395428ab], UserHandle{0}], mCall [77595510, DISCONNECTED, com.android.phone/com.android.services.telephony.TelephonyConnectionService, tel:***********, A, childs(0), has_parent(false), [[Capabilities: CAPABILITY_HOLD CAPABILITY_SUPPORT_HOLD CAPABILITY_MUTE]], false, ComponentInfo{com.android.phone/com.android.services.telephony.TelephonyConnectionService}, [356a192b7913b04c54574d18c28d46e6395428ab], UserHandle{0}]
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bc0: holder+0 = 713657e8
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bc4: holder+4 = 0
 11:50:51.463 29130 30373 D Telecom : [TELECOM][DtmfLocalTonePlayer]: stopping local tone.
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bc8: holder+8 = c
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bcc: holder+12 = 1363bfb0
 11:50:51.463 29130 30373 D Telecom : [TELECOM][DtmfLocalTonePlayer]: Posting delete.
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bd0: holder+16 = 0
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bd4: holder+20 = 0
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bd8: holder+24 = 0
 11:50:51.463 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bdc: holder+28 = 0
 11:50:51.463 29130 30373 D Telecom : [TELECOM][[TELECOM][DTMF]]: startDtmfSession(): call null => return
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74be0: holder+32 = 0
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74be4: holder+36 = 0
 11:50:51.464 29130 30373 D Telecom : [TELECOM][BluetoothPhoneService]: onForegroundCallChanged
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74be8: holder+40 = 0
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bec: holder+44 = 0
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bf0: holder+48 = 0
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bf4: holder+52 = 0
 11:50:51.464 29130 29140 F art     : art/runtime/gc/collector/mark_sweep.cc:415] 0x13f74bf8: holder+56 = f8
 11:50:51.464 29130 29140 F art     : art/runtime/utils.cc:180] 00008000-00019000 rw-s 00028000 00:0c 8521        

这台机器是android虚拟机重启，并不是完全重启。

问题发生在androidruntime的gc(垃圾回收)过程中

追了一下调用栈：没看过gc相关的调用过程，不晓得0xf8这个object对应的是什么。

inline void MarkSweep::MarkObject(Object* obj, Object* holder,MemberOffset offset) {

  if (obj != nullptr) {

    MarkObjectNonNull(obj,holder, offset);

  } else if (kCountMarkedObjects) {

    ++mark_null_count_;

 

02-13 11:50:51.463 29130 29140 F art     :art/runtime/gc/collector/mark_sweep.cc:387] Tried tomark0xf8 not contained by any spaces

02-13 11:50:51.463 29130 29140 F art     :art/runtime/gc/collector/mark_sweep.cc:391] Field info:  holder=0x13f74bc0holder is alive holder_size=60 holder_type=java.lang.Object[] offset=56field=nullptr field_type= first_ref_field_offset=8

 

 

void operator()(const Object* obj) const ALWAYS_INLINENO_THREAD_SAFETY_ANALYSIS {

    if (kProfileLargeObjects) {

      // TODO: Differentiate betweenmarking and testing somehow.

     ++mark_sweep_->large_object_test_;

     ++mark_sweep_->large_object_mark_;

    }

    space::LargeObjectSpace* large_object_space =mark_sweep_->GetHeap()->GetLargeObjectsSpace();

    if (UNLIKELY(obj == nullptr ||!IsAligned<kPageSize>(obj) ||

                (kIsDebugBuild && large_object_space != nullptr &&

                    !large_object_space->Contains(obj)))){

     LOG(INTERNAL_FATAL) << "Tried to mark " << obj <<" not contained by any spaces";

      if (holder_ != nullptr) {

        size_t holder_size =holder_->SizeOf();

        ArtField* field =holder_->FindFieldByOffset(offset_);

   …..

      }

     PrintFileToLog("/proc/self/maps", LogSeverity::INTERNAL_FATAL);

  …..

      }

      LOG(FATAL)<< "Can't mark invalid object";    //这里调用了系统的abort函数，应该就是这里最终导致的art重启。

}