https://blog.csdn.net/a396604593/article/details/105771093
ErrorLog:
04-26 18:20:16.112 12201 12201 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-26 18:20:16.112 12201 12201 F DEBUG : Build fingerprint:
'htc/ocmdugl_00401/htc_ocmdugl:9/PQ2A.190205.003/1076299.1:user/release-keys'
04-26 18:20:16.113 12201 12201 F DEBUG : Revision: '0'
04-26 18:20:16.113 12201 12201 F DEBUG : ABI: 'arm64'
04-26 18:20:16.113 12201 12201 F DEBUG : pid: 1773, tid: 7880, name: Binder:1773_20 >>> system_server <<<
04-26 18:20:16.113 12201 12201 F DEBUG : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
04-26 18:20:16.113 12201 12201 F DEBUG : Abort message: 'java_vm_ext.cc:676] JNI ERROR (app bug): global reference table
overflow (max=51200)global reference table dump:'
1、百度搜索global reference table overflow (max=51200)
JNI层coding经常会遇到ReferenceTable overflow(引用表溢出造成的崩溃)问题,特别是当jni函数被反复调用上千上万次的时候。
2、log中搜索java_vm_ext.cc:676发现
48560 of com.android.server.am.PendingIntentRecord (48560 unique instances)
max=51200,而PendingIntentRecord就有 48560个。
这时如果能抓取system_server的hprof文件进行查看,会很方便的看出哪个对象导致的内存溢出。
3、如果没有hprof文件,只看log文件。
从上述log中得到pid: 1773, tid: 7880, name: Binder:1773_20,在log中
搜索Binder:1773_20:
…
04-26 18:20:15.119 1773 7880 F system_server: runtime.cc:558] "Binder:1773_20" prio=5 tid=135 Runnable
…
查看log发现
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at android.os.Parcel.nativeWriteStrongBinder(Native method)
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at ndroid.os.Parcel.writeStrongBinder(Parcel.java:737)
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at android.app.IActivityManager$Stub.onTransact$getIntentSender$(IActivityManager.java:10438)
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:775)
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:3435)
04-26 18:20:15.121 1773 7880 F system_server: runtime.cc:558] at android.os.Binder.execTransact(Binder.java:740)
发现bind相关操作导致,这个是导致崩溃的最后一根稻草
4、搜索7880,
发现activityManager多次bindService、unbindService。
导致system_server的内存溢出。
源码分析:
JNI ERROR (app bug): global reference table overflow (max=51200)
全局引用表溢出,说明全局对象个数太多
报错的行数java_vm_ext.cc:676
相关代码:
jobject JavaVMExt::AddGlobalRef(Thread* self, ObjPtr<mirror::Object> obj) {
// Check for null after decoding the object to handle cleared weak globals.
if (obj == nullptr) {
return nullptr;
}
IndirectRef ref;
std::string error_msg;
{
WriterMutexLock mu(self, *Locks::jni_globals_lock_);
ref = globals_.Add(kIRTFirstSegment, obj, &error_msg);//error_msg的来源
}
if (UNLIKELY(ref == nullptr)) {
LOG(FATAL) << error_msg;//报错的行数
UNREACHABLE();
}
CheckGlobalRefAllocationTracking();
return reinterpret_cast<jobject>(ref);
}
可以看出是globals_.Add中出了问题
indirect_reference_table.cc#Add中
if (top_index == max_entries_) {//下标是否达到最大值
if (resizable_ == ResizableCapacity::kNo) {//是否可以调整表的容量
std::ostringstream oss;
oss << "JNI ERROR (app bug): " << kind_ << " table overflow "
<< "(max=" << max_entries_ << ")"
<< MutatorLockedDumpable<IndirectReferenceTable>(*this);
*error_msg = oss.str();
return nullptr;
}
其中max_entries_当前值定义为51200, java_vm_ext.cc中定义了最大值如下:
static constexpr size_t kGlobalsMax = 51200; // Arbitrary sanity check. (Must fit in 16 bits.)
每个Binder实体在jni层都会对应一个JavaBBinder实例.
bindServer时,为什么在art中会存在一个全局引用对象?
调用过程
<1>writeStrongBinder(IBinder val)
<2>android_os_Parcel_writeStrongBinder()
<3>ibinderForJavaObject(env, object)
<4> JavaBBinderHolder::get(env, obj)
<5> new JavaBBinder(env, obj);
<6> mObject(env->NewGlobalRef(object)
<7> JNI::NewGlobalRef()
<8> art::JavaVMExt::AddGlobalRef()
<9> art::IndirectReferenceTable::Add()
参考链接:
问题分析过程:
https://www.jianshu.com/p/bcc5462a78ce
https://blog.csdn.net/chi_wy/article/details/83104748
抓取hprof文件:
https://blog.csdn.net/happy_develop_/article/details/79099227
bindService启动Service与Binder服务实体的流程:android-N的
https://www.jianshu.com/p/9128f1b65586
jni文档:
https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html
————————————————
版权声明:本文为CSDN博主「纵容_伊人倩影」的原创文章,遵循CC 4.0 BY-SA版权协议,转载请附上原文出处链接及本声明。
原文链接:https://blog.csdn.net/a396604593/article/details/105771093