【野fd问题】野fd导致system_server发生crash问题

1、问题描述

不同类型测试均发生system_server native crash问题。

2、问题分析

log如下：

pid: 3421, tid: 3515, name:PowerManagerSer  >>>system_server <<< signal 6 (SIGABRT), code -6 (SI_TKILL),fault addr -------- Abort message:'BitTube::recvObjects(count=256, size=104), res=18 (partial events werereceived!)'    rax 0000000000000000  rbx00007d0735ac94f8  rcx00007d074d9bfe97  rdx 0000000000000006    rsi 0000000000000dbb  rdi0000000000000d5d    r8  0000000000000030  r9 0000000000000069  r10 0000000000000008  r11 0000000000000202    r12 0000000000000dbb  r130000000000000006  r140000000000000000  r15 00007d072c28e640    cs  0000000000000033  ss 000000000000002b    rip 00007d074d9bfe97  rbp000000000000000b  rsp00007d0735ac7cc8  eflags 0000000000000202   backtrace:    #00 pc 000000000008ee97 /system/lib64/libc.so (tgkill+7)    #01 pc 000000000008b8b2 /system/lib64/libc.so (pthread_kill+66)    #02 pc 00000000000302d1 /system/lib64/libc.so (raise+17)    #03 pc 00000000000286be /system/lib64/libc.so (abort+78)    #04 pc 0000000000010f4f /system/lib64/libcutils.so (__android_log_assert+287)    #05 pc 0000000000064008 /system/lib64/libgui.so(_ZN7android7BitTube11recvObjectsERKNS_2spIS0_EEPvmm+264)    #06 pc 00000000000856c6 /system/lib64/libgui.so(_ZN7android16SensorEventQueue4readEP12ASensorEventm+54)    #07 pc 00000000001566e7 /system/lib64/libandroid_runtime.so    #08 pc 0000000000018b06 /system/lib64/libutils.so (_ZN7android6Looper9pollInnerEi+998)    #09 pc 000000000001865a /system/lib64/libutils.so (_ZN7android6Looper8pollOnceEiPiS1_PPv+42)    #10 pc 0000000000101126 /system/lib64/libandroid_runtime.so(_ZN7android18NativeMessageQueue8pollOnceEP7_JNIEnvP8_jobjecti+38)    #11 pc 0000000073fc48f8 /data/dalvik-cache/x86_64/system@framework@boot.oat (offset 0x2c0d000) 从调用栈分析是主动abort 168ssize_t BitTube::recvObjects(const sp<BitTube>& tube, 169        void* events, size_tcount, size_t objSize) 170{ 171    char* vaddr =reinterpret_cast<char*>(events); 172    ssize_t size = tube->read(vaddr,count*objSize);//size = 18，objSize = 104，count = 256，count*objSize =26k 173 174    // should never happenbecause of SOCK_SEQPACKET 175    LOG_ALWAYS_FATAL_IF((size >= 0)&& (size % static_cast<ssize_t>(objSize)),//--》