android anr 源码分析,ANR源码分析之InputDispatcher Timeout

在上篇文章中，介绍ANR产生的原因、ANR的分类以及ANR问题的分析。本篇文章接下来将从源码的角度来分析ANR产生的过程，首先介绍InputDispatcher Timeout产生的过程。在ANR产生时，最终都会调用到appNotResponding()方法，该方法在Android 7.0以前定义在ActivityManagerService.java类中，在Android 7.0中定义在AppErrors.java类中，本文将以Android 7.0源码来分析ANR的产生过程。首先来分析appNotResponding()方法，在该方法中将记录一些ANR的信息到event、system、trace日志文件中，并发送应用未响应Dialog给系统显示。ANR日志分析将在下一个小节中描述，appNotResponding()在frameworks/base/services/core/java/com/android/server/am/AppErrors.java文件中实现：

/*

* 该函数的主要作用是记录发生ANR的信息到日志文件中，包括event日志、system日志以及trace日志中，

* 同时在应用显示一个ANR Dialog通知应用发生了ANR

*/

final void appNotResponding(ProcessRecord app, ActivityRecord activity,

ActivityRecord parent, boolean aboveSystem, final String annotation) {

//保存最近执行的进程号

ArrayList firstPids = new ArrayList(5);

SparseArray lastPids = new SparseArray(20);

...........

//记录发生ANR的时间

long anrTime = SystemClock.uptimeMillis();

if (ActivityManagerService.MONITOR_CPU_USAGE) {

//第一次更新CPU的状态

mService.updateCpuStatsNow();

}

// Unless configured otherwise, swallow ANRs in background processes & kill the process.

boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),

Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;

boolean isSilentANR;

//在system日志中，打印ANR发生的原因

synchronized (mService) {

.........

app.notResponding = true;

//1.记录ANR日志到event日志中

EventLog.writeEvent(EventLogTags.AM_ANR, app.userId, app.pid,

app.processName, app.info.flags, annotation);

// 将应用pid添加到firstPids集合中

firstPids.add(app.pid);

isSilentANR = !showBackground && !app.isInterestingToUserLocked() && app.pid != MY_PID;

if (!isSilentANR) {

int parentPid = app.pid;

if (parent != null && parent.app != null && parent.app.pid > 0) {

parentPid = parent.app.pid;

}

if (parentPid != app.pid) firstPids.add(parentPid);//添加父进程的pid到firstPids集合中

if (MY_PID != app.pid && MY_PID != parentPid) firstPids.add(MY_PID);//再将当前应用的pid添加到firstPids集合中

//将最近使用的进程pid添加到firstPids和lastPids集合中

for (int i = mService.mLruProcesses.size() - 1; i >= 0; i--) {

ProcessRecord r = mService.mLruProcesses.get(i);

if (r != null && r.thread != null) {

int pid = r.pid;

if (pid > 0 && pid != app.pid && pid != parentPid && pid != MY_PID) {

if (r.persistent) {

firstPids.add(pid);

if (DEBUG_ANR) Slog.i(TAG, "Adding persistent proc: " + r);

} else {

lastPids.put(pid, Boolean.TRUE);

if (DEBUG_ANR) Slog.i(TAG, "Adding ANR proc: " + r);

}

}

}

}

}

}

// 2.记录ANR信息到system日志中

StringBuilder info = new StringBuilder();

info.setLength(0);

info.append("ANR in ").append(app.processName);

if (activity != null && activity.shortComponentName != null) {

info.append(" (").append(activity.shortComponentName).append(")");

}

info.append("\n");

info.append("PID: ").append(app.pid).append("\n");

if (annotation != null) {

info.append("Reason: ").append(annotation).append("\n");

}

if (parent != null && parent != activity) {

info.append("Parent: ").append(parent.shortComponentName).append("\n");

}

ProcessCpuTracker processCpuTracker = new ProcessCpuTracker(true);

String[] nativeProcs = NATIVE_STACKS_OF_INTEREST;

// 3.记录ANR信息到trace日志文件中

File tracesFile = null;

if (isSilentANR) {

tracesFile = mService.dumpStackTraces(true, firstPids, null, lastPids,

null);

} else {

//调用AMS的dumpStackTraces记录ANR日志到trace文件中

tracesFile = mService.dumpStackTraces(true, firstPids, processCpuTracker, lastPids,

nativeProcs);

}

String cpuInfo = null;

if (ActivityManagerService.MONITOR_CPU_USAGE) {

//第二次更新CPU的状态

mService.updateCpuStatsNow();

synchronized (mService.mProcessCpuTracker) {

//记录第一次CPU的信息

cpuInfo = mService.mProcessCpuTracker.printCurrentState(anrTime);

}

info.append(processCpuTracker.printCurrentLoad());

info.append(cpuInfo);

}

//记录第二次CPU的信息

info.append(processCpuTracker.printCurrentState(anrTime));

//记录ANR信息到system日志中

Slog.e(TAG, info.toString());

if (tracesFile == null) {

// There is no trace file, so dump (only) the alleged culprit's threads to the log

//如果没有生成trace文件，则发送SIGNAL_QUIT信号

Process.sendSignal(app.pid, Process.SIGNAL_QUIT);

}

//将ANR信息写入到DropBox中

mService.addErrorToDropBox("anr", app, app.processName, activity, parent, annotation,

cpuInfo, tracesFile, null);

........

synchronized (mService) {

........

//设置应用未相应状态，并寻找错误的接收器

makeAppNotRespondingLocked(app,

activity != null ? activity.shortComponentName : null,

annotation != null ? "ANR " + annotation : "ANR",

info.toString());

// 4.通知系统显示应用未响应的Dialog

Message msg = Message.obtain();

HashMap map = new HashMap();

msg.what = ActivityManagerService.SHOW_NOT_RESPONDING_UI_MSG;

msg.obj = map;

msg.arg1 = aboveSystem ? 1 : 0;

map.put("app", app);

if (activity != null) {

map.put("activity", activity);

}

mService.mUiHandler.sendMessage(msg);

}

}

从上面可以看到appNotResponding()方法主要做了4件事情：

1.记录ANR信息到event日志中；

2.记录ANR信息到system日志中，里面包含了ANR发生时的CPU状态信息；

3.记录ANR信息到trace日志中，里面包含了最近运行进程的方法调用堆栈信息；

4.通知系统显示应用未响应的Dialog；

在上面介绍的4种ANR类型，都会最终调用到appNotResponding()方法，接下来分别介绍这4种ANR是如何产生的，以及如何最终调用到AppErrors的appNotResponding()方法。

一、 InputDispatcher Timeout

当输入事件例如触摸、点击事件，在5s内没有响应的话，则会产生一个ANR消息。InputDispatcher Timeout的整体流程如下：

应用接收到输入事件时，会向系统注册该输入事件对应的输入通道、输入窗口等信息，InputDispatcher会监听这些注册的输入事件。当输入事件执行完成了，就会向系统发送处理完成finish消息。如果在5s内，没有收到输入事件结束finish消息，则InputDispatcher发送ANR通知。InputDispatcher注册输入通道信息的函数如下：

frameworks/native/services/inputflinger/InputDispatcher.cpp

/*

* 注册输入通道，并监听该输入通道对应的Socket fd。

*/

status_t InputDispatcher::registerInputChannel(const sp& inputChannel,

const sp& inputWindowHandle, bool monitor) {

{ // acquire lock

AutoMutex _l(mLock);

...

//创建连接

sp connection = new Connection(inputChannel, inputWindowHandle, monitor);

//返回连接的fd

int fd = inputChannel->getFd();

//添加连接到集合中

mConnectionsByFd.add(fd, connection);

if (monitor) {

mMonitoringChannels.push(inputChannel);

}

//将fd添加到mLooper中，监听该fd对应的输入事件

mLooper->addFd(fd, 0, ALOOPER_EVENT_INPUT, handleReceiveCallback, this);

} // release lock

// Wake the looper because some connections have changed.

//唤醒mLooper处理，连接已经改变了

mLooper->wake();

return OK;

}

mLooper是Native Looper，在/system/core/libutils/Looper.cpp文件中实现，主要的作用是将输入请求添加到请求队列中。

int Looper::addFd(int fd, int ident, int events, const sp& callback, void* data) {

.......

{ // acquire lock

AutoMutex _l(mLock);

Request request;

request.fd = fd;

request.ident = ident;

request.events = events;

request.seq = mNextRequestSeq++;

request.callback = callback;

request.data = data;

if (mNextRequestSeq == -1) mNextRequestSeq = 0; // reserve sequence number -1

struct epoll_event eventItem;

request.initEventItem(&eventItem);

ssize_t requestIndex = mRequests.indexOfKey(fd);

//如果是首次添加

if (requestIndex < 0) {

int epollResult = epoll_ctl(mEpollFd, EPOLL_CTL_ADD, fd, & eventItem);

........

//将请求添加到请求队列中

mRequests.add(fd, request);

} else {//非首次添加

int epollResult = epoll_ctl(mEpollFd, EPOLL_CTL_MOD, fd, & eventItem);

.....

//更新请求

mRequests.replaceValueAt(requestIndex, request);

}

} // release lock

return 1;

}

当开始处理请求队列中的输入事件请求时，会回调该输入事件注册的回调函数handleReceiveCallback。

/*

* 输入事件的回调函数

*/

int InputDispatcher::handleReceiveCallback(int fd, int events, void* data) {

InputDispatcher* d = static_cast(data);

{ // acquire lock

AutoMutex _l(d->mLock);

ssize_t connectionIndex = d->mConnectionsByFd.indexOfKey(fd);

....

bool notify;

sp connection = d->mConnectionsByFd.valueAt(connectionIndex);

if (!(events & (ALOOPER_EVENT_ERROR | ALOOPER_EVENT_HANGUP))) {

......

nsecs_t currentTime = now();

bool gotOne = false;

status_t status;

//死循环，等待输入事件finish信号

for (;;) {

uint32_t seq;

bool handled;

//等待输入事件finish信号

status = connection->inputPublisher.receiveFinishedSignal(&seq, &handled);

if (status) {

break;

}

//结束当前输入事件分发过程

d->finishDispatchCycleLocked(currentTime, connection, seq, handled);

gotOne = true;

}

if (gotOne) {

d->runCommandsLockedInterruptible();

if (status == WOULD_BLOCK) {

return 1;

}

}

......

} else {

........

}

// Unregister the channel.

d->unregisterInputChannelLocked(connection->inputChannel, notify);

return 0; // remove the callback

} // release lock

}

当开始处理输入事件后，会循环等待输入事件finish信号。如果接收到输入事件的finish信号后，则结束当前事件的分发过程。如果在5s内，还未收到输入事件的finish信号，则会调用InputDispatcher的handleTargetsNotReadyLocked()方法，发送ANR通知。

1.handleTargetsNotReadyLocked方法(

InputDispatcher.cpp

)

handleTargetsNotReadyLocked方法主要的工作是获取超时时间，然后设置输入事件等待的原因，等待开始的时间、等待的超时时间。如果当前时间大于等待的超时时间，则说明发生了超时，调用onANRLocked发送ANR通知。

int32_t InputDispatcher::handleTargetsNotReadyLocked(nsecs_t currentTime,

const EventEntry* entry,

const sp& applicationHandle,

const sp& windowHandle,

nsecs_t* nextWakeupTime, const char* reason) {

if (applicationHandle == NULL && windowHandle == NULL) {

........

} else {

if (mInputTargetWaitCause != INPUT_TARGET_WAIT_CAUSE_APPLICATION_NOT_READY) {

.......

nsecs_t timeout;

//获取超时时间

if (windowHandle != NULL) {

timeout = windowHandle->getDispatchingTimeout(DEFAULT_INPUT_DISPATCHING_TIMEOUT);

} else if (applicationHandle != NULL) {

timeout = applicationHandle->getDispatchingTimeout(

DEFAULT_INPUT_DISPATCHING_TIMEOUT);

} else {

timeout = DEFAULT_INPUT_DISPATCHING_TIMEOUT;

}

//设置等待的原因，等待开始的时间，等待超时的时间

mInputTargetWaitCause = INPUT_TARGET_WAIT_CAUSE_APPLICATION_NOT_READY;

mInputTargetWaitStartTime = currentTime;

mInputTargetWaitTimeoutTime = currentTime + timeout;

mInputTargetWaitTimeoutExpired = false;

mInputTargetWaitApplicationHandle.clear();

if (windowHandle != NULL) {

mInputTargetWaitApplicationHandle = windowHandle->inputApplicationHandle;

}

if (mInputTargetWaitApplicationHandle == NULL && applicationHandle != NULL) {

mInputTargetWaitApplicationHandle = applicationHandle;

}

}

}

if (mInputTargetWaitTimeoutExpired) {

return INPUT_EVENT_INJECTION_TIMED_OUT;

}

//当前时间超过设定的超时时间

if (currentTime >= mInputTargetWaitTimeoutTime) {

onANRLocked(currentTime, applicationHandle, windowHandle,

entry->eventTime, mInputTargetWaitStartTime, reason);

*nextWakeupTime = LONG_LONG_MIN;

return INPUT_EVENT_INJECTION_PENDING;

} else {

........

}

}

2.onANRLocked方法

(InputDispatcher.cpp)

在onANRLocked()方法中，主要是记录ANR发生时的状态，并将ANR日志输出到main日志中。

void InputDispatcher::onANRLocked(

nsecs_t currentTime, const sp& applicationHandle,

const sp& windowHandle,

nsecs_t eventTime, nsecs_t waitStartTime, const char* reason) {

float dispatchLatency = (currentTime - eventTime) * 0.000001f;

float waitDuration = (currentTime - waitStartTime) * 0.000001f;

//在main日志中打印ANR信息

ALOGI("Application is not responding: %s. "

"It has been %0.1fms since event, %0.1fms since wait started. Reason: %s",

getApplicationWindowLabelLocked(applicationHandle, windowHandle).string(),

dispatchLatency, waitDuration, reason);

//记录ANR发生时的状态

time_t t = time(NULL);

struct tm tm;

localtime_r(&t, &tm);

char timestr[64];

strftime(timestr, sizeof(timestr), "%F %T", &tm);

mLastANRState.clear();

mLastANRState.append(INDENT "ANR:\n");

mLastANRState.appendFormat(INDENT2 "Time: %s\n", timestr);

mLastANRState.appendFormat(INDENT2 "Window: %s\n",

getApplicationWindowLabelLocked(applicationHandle, windowHandle).string());

mLastANRState.appendFormat(INDENT2 "DispatchLatency: %0.1fms\n", dispatchLatency);

mLastANRState.appendFormat(INDENT2 "WaitDuration: %0.1fms\n", waitDuration);

mLastANRState.appendFormat(INDENT2 "Reason: %s\n", reason);

dumpDispatchStateLocked(mLastANRState);

CommandEntry* commandEntry = postCommandLocked(

& InputDispatcher::doNotifyANRLockedInterruptible);

commandEntry->inputApplicationHandle = applicationHandle;

commandEntry->inputWindowHandle = windowHandle;

commandEntry->reason = reason;

}

3.doNotifyANRLockedInterruptible方法

(InputDispatcher.cpp)

doNotifyANRLockedInterruptible方法主要工作是从系统框架层获取新的timeout，并发送ANR消息到框架层，最后恢复输入事件状态，并用新的timeout开始下一个输入事件的超时处理。

void InputDispatcher::doNotifyANRLockedInterruptible(

CommandEntry* commandEntry) {

mLock.unlock();

//获取新的timeout，并通知应用ANR消息

nsecs_t newTimeout = mPolicy->notifyANR(

commandEntry->inputApplicationHandle, commandEntry->inputWindowHandle,

commandEntry->reason);

mLock.lock();

//恢复状态

resumeAfterTargetsNotReadyTimeoutLocked(newTimeout,

commandEntry->inputWindowHandle != NULL

? commandEntry->inputWindowHandle->getInputChannel() : NULL);

}

4.notifyANR方法

(InputManagerService.java)

在InputDispatcher.cpp中调用doNotifyANRLockedInterruptible()方法后，最终会调用到framework中的InputManagerService.java类中的notifyANR方法。notifyANR方法调用InputMonitor类中的notifyANR方法。

frameworks/services/core/java/com/android/server/input/InputManagerService.java

/*

* 本地方法回调,通知应用层输入事件分发发生了ANR

*/

private long notifyANR(InputApplicationHandle inputApplicationHandle,

InputWindowHandle inputWindowHandle, String reason) {

return mWindowManagerCallbacks.notifyANR(

inputApplicationHandle, inputWindowHandle, reason);

}

5.notifyANR方法(

InputMonitor.java

)

notifyANR方法返回一个超时时间，并通知窗口管理器，发生了ANR。

frameworks/services/core/java/com/android/server/wm/InputMonitor.java

/*

* 通知窗口管理器，应用没有响应。

* 返回一个新的超时时间，或者返回0来终止事件分发

*/

public long notifyANR(InputApplicationHandle inputApplicationHandle,

InputWindowHandle inputWindowHandle, String reason) {

AppWindowToken appWindowToken = null;

WindowState windowState = null;

boolean aboveSystem = false;

synchronized (mService.mWindowMap) {

if (inputWindowHandle != null) {

//获取Windowstate状态

windowState = (WindowState) inputWindowHandle.windowState;

if (windowState != null) {

appWindowToken = windowState.mAppToken;

}

}

if (appWindowToken == null && inputApplicationHandle != null) {

appWindowToken = (AppWindowToken)inputApplicationHandle.appWindowToken;

}

if (windowState != null) {

Slog.i(TAG_WM, "Input event dispatching timed out "

+ "sending to " + windowState.mAttrs.getTitle()

+ ". Reason: " + reason);

int systemAlertLayer = mService.mPolicy.windowTypeToLayerLw(

WindowManager.LayoutParams.TYPE_SYSTEM_ALERT);

//是否在系统窗口上显示

aboveSystem = windowState.mBaseLayer > systemAlertLayer;

} else if (appWindowToken != null) {

Slog.i(TAG_WM, "Input event dispatching timed out "

+ "sending to application " + appWindowToken.stringName

+ ". Reason: " + reason);

} else {

Slog.i(TAG_WM, "Input event dispatching timed out "

+ ". Reason: " + reason);

}

//保存ANR状态

mService.saveANRStateLocked(appWindowToken, windowState, reason);

}

if (appWindowToken != null && appWindowToken.appToken != null) {

try {

// Notify the activity manager about the timeout and let it decide whether

// to abort dispatching or keep waiting.

boolean abort = appWindowToken.appToken.keyDispatchingTimedOut(reason);

if (! abort) {

// The activity manager declined to abort dispatching.

// Wait a bit longer and timeout again later.

return appWindowToken.inputDispatchingTimeoutNanos;

}

} catch (RemoteException ex) {

}

} else if (windowState != null) {

try {

//通知Activity管理器超时时间，并让它决定是否终止事件处理还是继续等待

long timeout = ActivityManagerNative.getDefault().inputDispatchingTimedOut(

windowState.mSession.mPid, aboveSystem, reason);

if (timeout >= 0) {

//Activity管理器拒绝终止事件分发，再等待一个更长的超时时间

return timeout * 1000000L; // nanoseconds

}

} catch (RemoteException ex) {

}

}

//返回0表示终止事件的分发处理

return 0; // abort dispatching

}

6.

inputDispatchingTimedOut方法(ActivityManagerService.java)

inputDispatchingTimedOut主要是通过getInputDispatchingTimeoutLocked方法获取超时时间，然后通过inputDispatchingTimedOut方法通知AMS，输入事件分发超时了，发送ANR通知。

public long inputDispatchingTimedOut(int pid, final boolean aboveSystem, String reason) {

if (checkCallingPermission(android.Manifest.permission.FILTER_EVENTS)

!= PackageManager.PERMISSION_GRANTED) {

throw new SecurityException("Requires permission "

+ android.Manifest.permission.FILTER_EVENTS);

}

ProcessRecord proc;

long timeout;

synchronized (this) {

synchronized (mPidsSelfLocked) {

proc = mPidsSelfLocked.get(pid);

}

timeout = getInputDispatchingTimeoutLocked(proc);

}

if (!inputDispatchingTimedOut(proc, null, null, aboveSystem, reason)) {

return -1;

}

return timeout;

}

7.

getInputDispatchingTimeoutLocked方法(ActivityManagerService.java)

获取输入事件超时时间，这个时间在KEY_DISPATCHING_TIMEOUT中定义，为5s中。

public static long getInputDispatchingTimeoutLocked(ProcessRecord r) {

if (r != null && (r.instrumentationClass != null || r.usingWrapper)) {

return INSTRUMENTATION_KEY_DISPATCHING_TIMEOUT;

}

return KEY_DISPATCHING_TIMEOUT;

}

//key dispatching超时时间，为5s

static final int KEY_DISPATCHING_TIMEOUT = 5*1000;

8.

inputDispatchingTimedOut(

ActivityManagerService.java

)

发送ANR通知给AppErros类统一处理。AppErros在appNotResponding方法中统一处理ANR消息，在前面的小节中已经介绍了。

/*

* 处理输入事件分发超时

* 返回事件分发是否应该终止还是继续

*/

public boolean inputDispatchingTimedOut(final ProcessRecord proc,

final ActivityRecord activity, final ActivityRecord parent,

final boolean aboveSystem, String reason) {

.....

final String annotation;

if (reason == null) {

annotation = "Input dispatching timed out";

} else {

annotation = "Input dispatching timed out (" + reason + ")";

}

if (proc != null) {

......

mHandler.post(new Runnable() {

@Override

public void run() {

//通知AppErrors发生了ANR

mAppErrors.appNotResponding(proc, activity, parent, aboveSystem, annotation);

}

});

}

return true;

}

至此，已经介绍完了InputDispatcher Timeout产生的整个流程，可以看到InputDispatcher的超时时间为5s钟。接下来分析Broadcast Timeout产生的流程。