monkey测试 --kill-process-after-error参数原理解析；android不弹ANR弹窗；ANR时进程被杀重启

背景

项目中跑monkey发现anr分析log时，发现进程出现anr时，进程直接被杀掉了，因为需要在anr时抓取内存信息，结果因为进程重启导致抓到的内存信息并不是出问题时的信息。因此研究了一波Android出现anr时的处理逻辑。这里基于mtk平台，部分源码可能有差异。

Android ANR触发流程

一、ANR后触发dump等操作的代码
frameworks/base/services/core/java/com/android/server/am/AppErrors.java
接口为appNotResponding()

    final void appNotResponding(ProcessRecord app, ActivityRecord activity,
            ActivityRecord parent, boolean aboveSystem, final String annotation) {
        ArrayList<Integer> firstPids = new ArrayList<Integer>(5);
        SparseArray<Boolean> lastPids = new SparseArray<Boolean>(20);
Slog.d("testview", "=================================== appNotResponding " + (mService.mController == null ? "controller is null" : "controller not null"));

        if (mService.mController != null) {
            try {
                // 0 == continue, -1 = kill process immediately
                int res = mService.mController.appEarlyNotResponding(
                        app.processName, app.pid, annotation);
Slog.d("testview", "=================================== appNotResponding res is " + res);
                if (res < 0 && app.pid != MY_PID) {
                    app.kill("anr", true);
Slog.d("testview", "=================================== app.kill"); 
                }
            } catch (RemoteException e) {
                mService.mController = null;
                Watchdog.getInstance().setActivityController(null);
            }
        }
        ......
Slog.d("testview", "=================================== startAnrDump");
        /// M: ANR Debug Mechanism
        if (mService.mAnrManager.startAnrDump(mService, app, activity, parent, aboveSystem,
                annotation, showBackground)) {
       
Slog.d("testview", "=================================== startAnrDump finished"); 
           return;
        }


Slog.d("testview", "=================================== next"); 
        if (mService.mController != null) {
            try {
                // 0 == show dialog, 1 = keep waiting, -1 = kill process immediately
                int res = mService.mController.appNotResponding(
                        app.processName, app.pid, info.toString());
                if (res != 0) {
                    if (res < 0 && app.pid != MY_PID) {
                        app.kill("anr", true);
Slog.d("testview", "=================================== res < 0 && app.kill"); 
                    } else {
                        synchronized (mService) {
                            mService.mServices.scheduleServiceTimeoutLocked(app);
                        }
                    }
                    return;
                }
            } catch (RemoteException e) {
                mService.mController = null;
                Watchdog.getInstance().setActivityController(null);
            }
        }

        synchronized (mService) {
            ......
            // Bring up the infamous App Not Responding dialog
            Message msg = Message.obtain();
            msg.what = ActivityManagerService.SHOW_NOT_RESPONDING_UI_MSG;
            msg.obj = new AppNotRespondingDialog.Data(app, activity, aboveSystem);

            mService.mUiHandler.sendMessage(msg);
        }
    }

此块代码有四个重要逻辑：
1、根据mService.mController.appEarlyNotResponding返回的值，确定要不要杀掉进程
2、mService.mAnrManager.startAnrDump， dump相关信息
3、根据mService.mController.appNotResponding返回的值，确定要不要杀掉进程
4、mService.mUiHandler.sendMessage(msg)发送handler弹出ANR弹窗
二、调用AppErrors.appNotResponding()的地方

1、BroadcastQueue.java广播超时调用
2、ContentProviderClient.java内容提供者超时调用
3、ActiveServices.java服务超时调用
4、ActivityThread.java input响应超时调用
有兴趣可以执行根据路径研究源码

增加日志排查进程被杀原因

一、如上代码增加的日志，发现跑monkey时，弹出ANR弹窗的日志没打印
代码路径
frameworks/base/services/core/java/com/android/server/am/AppErrors.java
接口为handleShowAnrUi()，是从AMS中调用的ActivityManagerService.SHOW_NOT_RESPONDING_UI_MSG

    void handleShowAnrUi(Message msg) {
                Slog.d("testview", "========================= appErrors handleShowAnrUi");
        Dialog dialogToShow = null;
        synchronized (mService) {
            AppNotRespondingDialog.Data data = (AppNotRespondingDialog.Data) msg.obj;
            final ProcessRecord proc = data.proc;
            if (proc == null) {
                Slog.e(TAG, "handleShowAnrUi: proc is null");
                return;
            }
            if (proc.anrDialog != null) {
                Slog.e(TAG, "App already has anr dialog: " + proc);
                MetricsLogger.action(mContext, MetricsProto.MetricsEvent.ACTION_APP_ANR,
                        AppNotRespondingDialog.ALREADY_SHOWING);
                return;
            }

            Intent intent = new Intent("android.intent.action.ANR");
            if (!mService.mProcessesReady) {
                intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
                        | Intent.FLAG_RECEIVER_FOREGROUND);
            }
            mService.broadcastIntentLocked(null, null, intent,
                    null, null, 0, null, null, null, AppOpsManager.OP_NONE,
                    null, false, false, MY_PID, Process.SYSTEM_UID, 0 /* TODO: Verify */);

            boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),
                    Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;
            if (mService.canShowErrorDialogs() || showBackground) {
                dialogToShow = new AppNotRespondingDialog(mService, mContext, data);
                proc.anrDialog = dialogToShow;
            } else {
                MetricsLogger.action(mContext, MetricsProto.MetricsEvent.ACTION_APP_ANR,
                        AppNotRespondingDialog.CANT_SHOW);
                // Just kill the app if there is no dialog to be shown.
                mService.killAppAtUsersRequest(proc, null);
            }
        }
        // If we've created a crash dialog, show it without the lock held
        if (dialogToShow != null) {
            dialogToShow.show();
        }
    }

二、可以看到唯一怀疑点就是mService.mController.appNotResponding，如果有兴趣研究mController是什么的可以从上边的代码路径中去研究。

查找Monkey源码中是否自定义了controller

一、发现monkey的源码类Monkey.java自定义了controller

    private class ActivityController extends IActivityController.Stub {
        public boolean activityStarting(Intent intent, String pkg) {
            boolean allow = checkEnteringPackage(pkg) || (DEBUG_ALLOW_ANY_STARTS != 0);
            if (mVerbose > 0) {
                // StrictMode's disk checks end up catching this on
                // userdebug/eng builds due to PrintStream going to a
                // FileOutputStream in the end (perhaps only when
                // redirected to a file?)  So we allow disk writes
                // around this region for the monkey to minimize
                // harmless dropbox uploads from monkeys.
                StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
                System.out.println("    // " + (allow ? "Allowing" : "Rejecting") + " start of "
                        + intent + " in package " + pkg);
                StrictMode.setThreadPolicy(savedPolicy);
            }
            currentPackage = pkg;
            currentIntent = intent;
            return allow;
        }

        public boolean activityResuming(String pkg) {
            StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
            System.out.println("    // activityResuming(" + pkg + ")");
            boolean allow = checkEnteringPackage(pkg) || (DEBUG_ALLOW_ANY_RESTARTS != 0);
            if (!allow) {
                if (mVerbose > 0) {
                    System.out.println("    // " + (allow ? "Allowing" : "Rejecting")
                            + " resume of package " + pkg);
                }
            }
            currentPackage = pkg;
            StrictMode.setThreadPolicy(savedPolicy);
            return allow;
        }

        public boolean appCrashed(String processName, int pid,
                String shortMsg, String longMsg,
                long timeMillis, String stackTrace) {
            StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
            System.err.println("// CRASH: " + processName + " (pid " + pid + ")");
            System.err.println("// Short Msg: " + shortMsg);
            System.err.println("// Long Msg: " + longMsg);
            System.err.println("// Build Label: " + Build.FINGERPRINT);
            System.err.println("// Build Changelist: " + Build.VERSION.INCREMENTAL);
            System.err.println("// Build Time: " + Build.TIME);
            System.err.println("// " + stackTrace.replace("\n", "\n// "));
            StrictMode.setThreadPolicy(savedPolicy);

            if (!mIgnoreCrashes || mRequestBugreport) {
                synchronized (Monkey.this) {
                    if (!mIgnoreCrashes) {
                        mAbort = true;
                    }
                    if (mRequestBugreport){
                        mRequestAppCrashBugreport = true;
                        mReportProcessName = processName;
                    }
                }
                return !mKillProcessAfterError;
            }
            return false;
        }

        public int appEarlyNotResponding(String processName, int pid, String annotation) {
            return 0;
        }

        public int appNotResponding(String processName, int pid, String processStats) {
            StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
            System.err.println("// NOT RESPONDING: " + processName + " (pid " + pid + ")");
            System.err.println(processStats);
            StrictMode.setThreadPolicy(savedPolicy);

            synchronized (Monkey.this) {
                mRequestAnrTraces = true;
                mRequestDumpsysMemInfo = true;
                mRequestProcRank = true;
                if (mRequestBugreport){
                  mRequestAnrBugreport = true;
                  mReportProcessName = processName;
                }
            }
            if (!mIgnoreTimeouts) {
                synchronized (Monkey.this) {
                    mAbort = true;
                }
            }
            return (mKillProcessAfterError) ? -1 : 1;
        }
    }

controller中对几个接口进行了定制，这里主要看appNotResponding
二、appNotResponding会根据mKillProcessAfterError返回是否-1，AppErrors.java如果mService.mController.appNotResponding返回的值为-1就会杀死进程，也不会弹出ANR弹窗，找到问题原因了。
三、mKillProcessAfterError如何被赋值的

    private boolean processOptions() {
        // quick (throwaway) check for unadorned command
        if (mArgs.length < 1) {
            showUsage();
            return false;
        }

        try {
            String opt;
            while ((opt = nextOption()) != null) {
                if (opt.equals("-s")) {
                    mSeed = nextOptionLong("Seed");
                } else if (opt.equals("--kill-process-after-error")) {
                    mKillProcessAfterError = true;
    ......

–kill-process-after-error参数会决定要不要杀死出错进程。后来找测试同学确定，他们的monkey测试确实加了这个参数。

结论

最终发现是测试同学误加参数导致，–kill-process-after-error参数会决定要不要杀死出错进程。
如果系统本身相对ANR异常处理，比如不弹出ANR弹窗，自定义实现Controller即可。