Android SystemServer ANR总结

在Android 中SystemServer的ANR多发现于Monkey测试中，用户的操作引发SystemServer ANR的概率反而不高。

SystemServer的进程名system_server

 在抓取的ANR log，SystemServer的ANR log

----- pid 2803 at 2018-01-01 00:04:51 -----
Cmd line: system_server
Build fingerprint: '.......'
ABI: 'arm64'
Build type: optimized
Zygote loaded classes=11522 post zygote classes=2718
Intern table: 80959 strong; 1881 weak
JNI: CheckJNI is off; globals=1279 (plus 86 weak)
Libraries: /system/lib64/libandroid.so /system/lib64/libandroid_servers.so /system/lib64/libcar-framework-service-jni.so /system/lib64/libcompiler_rt.so /system/lib64/libjavacrypto.so /system/lib64/libjnigraphics.so /system/lib64/libsoundpool.so /system/lib64/libwebviewchromium_loader.so /system/lib64/libwifi-service.so libjavacore.so libopenjdk.so (11)
Heap: 17% free, 26MB/32MB; 246617 objects
Dumping cumulative Gc timings
Start Dumping histograms for 60 iterations for concurrent copying
ProcessMarkStack:	Sum: 6.549s 99% C.I. 3.860ms-346.240ms Avg: 109.158ms Max: 351.348ms
ScanImmuneSpaces:	Sum: 1.205s 99% C.I. 6.715ms-66.560ms Avg: 20.095ms Max: 72.473ms
VisitConcurrentRoots:	Sum: 503.876ms 99% C.I. 3.081ms-25.760ms Avg: 8.397ms Max: 28.199ms
ClearFromSpace:	Sum: 265.638ms 99% C.I. 0.302ms-32.880ms Avg: 4.427ms Max: 40.210ms
FlipOtherThreads:	Sum: 195.863ms 99% C.I. 0.386ms-13.100ms Avg: 3.264ms Max: 13.818ms
EnqueueFinalizerReferences:	Sum: 142.947ms 99% C.I. 0.053ms-44.640ms Avg: 2.382ms Max: 47.237ms
ForwardSoftReferences:	Sum: 77.755ms 99% C.I. 0.037ms-6.140ms Avg: 1.295ms Max: 6.740ms
ProcessReferences:	Sum: 74.814ms 99% C.I. 0.869us-6239.999us Avg: 623.450us Max: 7135us
SweepSystemWeaks:	Sum: 64.778ms 99% C.I. 0.087ms-7.970ms Avg: 1.079ms Max: 9.443ms
GrayAllDirtyImmuneObjects:	Sum: 62.935ms 99% C.I. 0.293ms-11.580ms Avg: 1.048ms Max: 13.009ms
MarkingPhase:	Sum: 56.659ms 99% C.I. 26us-14600us Avg: 944.316us Max: 17576us
EmptyRBMarkBitStack:	Sum: 55.581ms 99% C.I. 46us-12600us Avg: 926.350us Max: 15517us

思路：

        发生ANR，两个关键节点，一个是AMS log打印的点，一个是/data/anr目录下anr文件写入的点，通过这两个节点可以知道发生了anr。

App的anr发生节点是AppErrors(frameworks/base/services/core/java/com/android/server/am)

AppErrors:appNotResponding(....)能够知道anr发生的app包名和pid

SystemServer的ANR发生的节点在Watchdog:run()函数中

如果是SystemServer的anr，会执行这段函数

                    } else if (waitState == WAITED_HALF) {
                        if (!waitedHalf) {
                            // We've waited half the deadlock-detection interval.  Pull a stack
                            // trace and wait another half.
                            ArrayList<Integer> pids = new ArrayList<Integer>();
                            pids.add(Process.myPid());
                            ActivityManagerService.dumpStackTraces(true, pids, null, null,
                                getInterestingNativePids());
                            waitedHalf = true;
                        }
                        continue;
                    }

而app则不会执行这段。

ActivityManagerService.dumpStackTraces（...）函数就是向/data/anr目录下写anr_文件的地方。

SystemServer ANR会在函数最后kill

                Process.killProcess(Process.myPid());
                System.exit(10);

Zygote会重启。

重启会发生这种log

01-01 00:03:00.495 I/ServiceManager( 2276): service 'usagestats' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'netpolicy' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'webviewupdate' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'binder_calls_stats' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'sec_key_att_app_id_provider' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'scheduling_policy' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'telephony.registry' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'account' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'content' died
01-01 00:03:00.495 I/ServiceManager( 2276): service 'settings' died

这个打印的节点是
service_manager.c的svcinfo_death(....)函数打印
/frameworks/native/cmds/servicemanager/service_manager.c