跑monkey过程中，出现systemserver重启现象

08-27 18:36:58.131318   900   921 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: ActivityManager
08-27 18:36:58.131318   900   921 E AndroidRuntime: java.lang.IllegalArgumentException: No display found with id: -1
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStackSupervisor.getDisplayOverrideConfiguration(ActivityStackSupervisor.java:477)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStackSupervisor.ensureVisibilityAndConfig(ActivityStackSupervisor.java:1670)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStack.finishCurrentActivityLocked(ActivityStack.java:3941)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStack.completePauseLocked(ActivityStack.java:1602)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStack.activityPausedLocked(ActivityStack.java:1568)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.am.ActivityStack$ActivityStackHandler.handleMessage(ActivityStack.java:399)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:106)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:193)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at android.os.HandlerThread.run(HandlerThread.java:65)
08-27 18:36:58.131318   900   921 E AndroidRuntime: 	at com.android.server.ServiceThread.run(ServiceThread.java:44)

sys log中可以看到要执行finish org.chromium.chrome.browser.firstrun.FirstRunActivity时在paused阶段发现它对应的displayid为INVALID_DISPLAY

通过以上mobilelog可知com.android.chrome被killing了，这里会先执行removeTask的流程把displayId 设置为了INVALID_DISPLAY即 -1
接着继续执行finishCurrentActivityLocked的ensureVisibilityAndConfig().

08-27 18:17:57.409427   900  3567 W ActivityManager: Force-killing crashed app com.android.chrome at watcher's request
08-27 18:17:57.425458   900  3567 W ActivityManager:   Force finishing activity com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity
08-27 18:17:57.459139   900 25330 W DropBoxManagerService: Dropping: system_app_crash (1525 > 0 bytes)
08-27 18:17:57.471247   900  1322 I WindowManager: WIN DEATH: Window{90b4c99 u0 com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity}
08-27 18:17:57.497804   900   921 W ActivityManager: Failed to set scheduling policy, thread does not exist:
08-27 18:17:57.497804   900   921 W ActivityManager: java.lang.IllegalArgumentException: Given thread 25326 does not exist
08-27 18:17:57.514717   900  4284 I ActivityManager: Process com.android.chrome (pid 24971) has died: vis  +99TOP
08-27 18:36:57.451874   900   900 W ActivityManager: Failed to set scheduling policy, thread does not exist:
08-27 18:36:57.451874   900   900 W ActivityManager: java.lang.IllegalArgumentException: Given thread 15698 does not exist
08-27 18:36:57.906290   900   921 W ActivityManager: Activity pause timeout for ActivityRecord{34c13ff u0 com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity t540 f}

event log中

08-27 18:36:57.255642 14205 14205 I am_on_create_called: [0,org.chromium.chrome.browser.firstrun.FirstRunActivity,performCreate]
08-27 18:36:57.260193 14205 14205 I am_on_start_called: [0,org.chromium.chrome.browser.firstrun.FirstRunActivity,handleStartActivity]
08-27 18:36:57.262499 14205 14205 I am_on_resume_called: [0,org.chromium.chrome.browser.firstrun.FirstRunActivity,RESUME_ACTIVITY]
08-27 18:36:57.362941   900   913 I am_crash: [14205,0,com.android.chrome,-1597260091,java.io.FileNotFoundException,/data/user/0/com.android.chrome/app_chrome/paks/en-GB.pak@1481298e.tmp (No space left on device),FileOutputStream.java,-2]
08-27 18:36:57.394676   900   913 I am_finish_activity: [0,55317503,540,com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity,force-crash]
08-27 18:36:57.402853   900   913 I am_focused_stack: [0,265,521,finishActivity adjustFocus adjustFocusToNextFocusableStack]
08-27 18:36:57.404310   900   913 I am_pause_activity: [0,55317503,com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity,userLeaving=false]

具体处理流程跟踪如下

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()
08-27 18:36:57.382979   900   913 W ActivityManager: Force-killing crashed app com.android.chrome at watcher's request

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()
08-27 18:36:57.385981   900   913 W ActivityManager:   Force finishing activity com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()
08-27 18:36:57.394676   900   913 I am_finish_activity: [0,55317503,540,com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity,force-crash]

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->adjustFocusedActivityStack()-->adjustFocusToNextFocusableStack()
//这里focus切换到了265 android ui, FirstRunActivity521丢失focus
08-27 18:36:57.402853   900   913 I am_focused_stack: [0,265,521,finishActivity adjustFocus adjustFocusToNextFocusableStack]
//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()
08-27 18:36:57.404310   900   913 I am_pause_activity: [0,55317503,com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity,userLeaving=false]

08-27 18:36:57.474179   493   493 I Zygote  : Process 14205 exited due to signal (9)

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()-->schedulePauseTimeout()-->handleMessage(PAUSE_TIMEOUT_MSG)
08-27 18:36:57.906290   900   921 W ActivityManager: Activity pause timeout for ActivityRecord{34c13ff u0 com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity t540 f}

//completePauseLocked()中执行了prev.setState(PAUSED, "completePausedLocked");

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()-->schedulePauseTimeout()-->handleMessage(PAUSE_TIMEOUT_MSG)-->completePauseLocked()-->finishCurrentActivityLocked()--->destroyActivityLocked(x,x,x)
08-27 18:36:57.906986   900   921 I am_destroy_activity: [0,55317503,540,com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity,finish-imm:completedPausedLocked]
!!!!!!!!!!!!!!!!!
//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()-->schedulePauseTimeout()-->handleMessage(PAUSE_TIMEOUT_MSG)-->completePauseLocked()-->finishCurrentActivityLocked()--->destroyActivityLocked(x,x,x)-->removeActivityFromHistoryLocked()-->r.removeWindowContainer();
//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()-->schedulePauseTimeout()-->handleMessage(PAUSE_TIMEOUT_MSG)-->completePauseLocked()-->finishCurrentActivityLocked()--->destroyActivityLocked(x,x,x)-->removeActivityFromHistoryLocked()-->removeTask()-->removeActivitiesFromLRUListLocked()-->remove()-->removeFromDisplay()

//onRemovedFromDisplay()
08-27 18:36:57.940855   900   921 V WindowManager: Removing focused app token:AppWindowToken{775b015 token=Token{bb665cc ActivityRecord{34c13ff u0 com.android.chrome/org.chromium.chrome.browser.firstrun.FirstRunActivity t540}}} mIsExiting=

08-27 18:36:57.966817   900   921 I am_remove_task: [540,521]

08-27 18:36:58.180758   900   921 W ActivityManager: Force-killing crashed app null at watcher's request

//handleApplicationCrash-->handleApplicationCrashInner()-->crashApplicationInner()-->handleAppCrashInActivityController()-->makeAppCrashingLocked()-->handleAppCrashLocked()-->finishTopCrashedActivitiesLocked()-->finishTopCrashedActivityLocked()-->finishActivityLocked()-->startPausingLocked()-->schedulePauseTimeout()-->handleMessage(PAUSE_TIMEOUT_MSG)-->completePauseLocked()-->finishCurrentActivityLocked()-->ensureVisibilityAndConfig()-->getDisplayOverrideConfiguration()
08-27 18:36:58.164256   900   921 I am_crash: [900,0,system_server,-1,java.lang.IllegalArgumentException,No display found with id: -1,ActivityStackSupervisor.java,477]

根据以上原因分析： google原生bug
执行finishCurrentActivityLocked时先执行了destroyActivityLocked()，后再执行ensureVisibilityAndConfig()，具体代码如下：

3914          final boolean finishingActivityInNonFocusedStack
3915                  = r.getStack() != mStackSupervisor.getFocusedStack()
3916                  && prevState == PAUSED && mode == FINISH_AFTER_VISIBLE;

3918          if (mode == FINISH_IMMEDIATELY
3919                  || (prevState == PAUSED
3920                      && (mode == FINISH_AFTER_PAUSE || inPinnedWindowingMode()))
3921                  || finishingActivityInNonFocusedStack
3922                  || prevState == STOPPING
3923                  || prevState == STOPPED
3924                  || prevState == ActivityState.INITIALIZING) {
3925              r.makeFinishingLocked();
3926           boolean activityRemoved = destroyActivityLocked(r, true, "finish-imm:" + reason);
3927

3928              if (finishingActivityInNonFocusedStack) {
3929                  // Finishing activity that was in paused state and it was in not currently focused
3930                  // stack, need to make something visible in its place.
3931             mStackSupervisor.ensureVisibilityAndConfig(next, mDisplayId,
3932                     false /* markFrozenIfConfigChanged /, true / deferResume */);

3933              }

1，跟踪destroyActivityLocked的调用流程：
destroyActivityLocked(x,y,z) --> removeActivityFromHistoryLocked() --> removeTask() --> removeActivitiesFromLRUListLocked() --> remove() --> removeFromDisplay()
最终执行了如下代码

721      private void removeFromDisplay() {
722          final ActivityDisplay display = getDisplay();
723          if (display != null) {
724              display.removeChild(this);
725          }
726          mDisplayId = INVALID_DISPLAY;

727      }

2，跟踪ensureVisibilityAndConfig的执行：
ensureVisibilityAndConfig() -->getDisplayOverrideConfiguration()
最终出错代码：

467    Configuration getDisplayOverrideConfiguration(int displayId) {
468        final ActivityDisplay activityDisplay = getActivityDisplayOrCreateLocked(displayId);
469        if (activityDisplay == null) {
470            throw new IllegalArgumentException("No display found with id: " + displayId);
471        }
472
473        return activityDisplay.getOverrideConfiguration();
474    }

原因分析：google原生bug， handleappcrash流程中先执行了removetask 及removewindow的操作会把ActivityDisplay 的displayid置为invalid_display (-1)， 之后要去设置view的visible状态要用到对应的displayid去获取ActivityDisplay对象时发生JE 
修改方案：如果执行了activitydisplay的remove操作会把windowcontroller置为null，这里要设置view的visible状态时检查对应的windowcontroller是否存在 。

在ActivityStack.java中

3914          final boolean finishingActivityInNonFocusedStack
3915                  = r.getStack() != mStackSupervisor.getFocusedStack()
3916                  && prevState == PAUSED && mode == FINISH_AFTER_VISIBLE;

3918          if (mode == FINISH_IMMEDIATELY
3919                  || (prevState == PAUSED
3920                      && (mode == FINISH_AFTER_PAUSE || inPinnedWindowingMode()))
3921                  || finishingActivityInNonFocusedStack
3922                  || prevState == STOPPING
3923                  || prevState == STOPPED
3924                  || prevState == ActivityState.INITIALIZING) {
3925              r.makeFinishingLocked();
3926           boolean activityRemoved = destroyActivityLocked(r, true, "finish-imm:" + reason);
3927

3928              ///if (finishingActivityInNonFocusedStack) {
                  //添加mWindowContainerController != null
                  if (finishingActivityInNonFocusedStack && mWindowContainerController != null) {
3929                  // Finishing activity that was in paused state and it was in not currently focused
3930                  // stack, need to make something visible in its place.
3931             mStackSupervisor.ensureVisibilityAndConfig(next, mDisplayId,
3932                     false /* markFrozenIfConfigChanged /, true / deferResume */);

3933              }