Android技术

《深入浅出 Android 源代码》读后感

Catalogue
  1. 1 Activity 的启动过程
  2. 2 ANR 机制
    1. 2.1 ANR 产生的原因
    2. 2.2 以 Service 的启动为例，分析 ANR 产生的过程

本篇记录了笔者在阅读《深入浅出 Android 源代码》这本书时认为比较重要的知识点，源码基于 Android 6.0 。

1 Activity 的启动过程

正如书中所说，从点击桌面图标开始分析 Activity 的启动过程，才能全面的掌握这一块的知识点。手机的桌面其实就是一个 Activity ，名称叫 Launcher。当点击 Launcher 中图标后，进入了 Launcher 类的 startActivitySafely 方法，最终该方法调用了 Instrumentation 的 execStartActivitysAsUser 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
frameworks/base/core/java/android/app/Instrumentation.java

public void execStartActivitiesAsUser(Context who, IBinder contextThread,
        IBinder token, Activity target, Intent[] intents, Bundle options,
        int userId) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    if (mActivityMonitors != null) {
        synchronized (mSync) {
            final int N = mActivityMonitors.size();
            for (int i=0; i<N; i++) {
                final ActivityMonitor am = mActivityMonitors.get(i);
                if (am.match(who, null, intents[0])) {
                    am.mHits++;
                    if (am.isBlocking()) {
                        return;
                    }
                    break;
                }
            }
        }
    }
    try {
        String[] resolvedTypes = new String[intents.length];
        for (int i=0; i<intents.length; i++) {
            intents[i].migrateExtraStreamToClipData();
            intents[i].prepareToLeaveProcess();
            resolvedTypes[i] = intents[i].resolveTypeIfNeeded(who.getContentResolver());
        }
        int result = ActivityManagerNative.getDefault()
            .startActivities(whoThread, who.getBasePackageName(), intents, resolvedTypes,
                    token, options, userId);
        checkStartActivityResult(result, intents[0]);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
}

ActivityManagerNative.getDefault()返回 AMS 的代理对象 ActivityManagerProxy，通过 Binder 驱动最终进入到了 AMS 的 startActivity 方法。

经过一系列的往下调用，流程来到了 ActivityStack 类的 resumeTopActivityInnerLocked 方法，

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
   private boolean resumeTopActivityInnerLocked(ActivityRecord prev, Bundle options) {
	
///省略一波代码
	
       if (mResumedActivity != null) {
           if (DEBUG_STATES) Slog.d(TAG_STATES,
                   "resumeTopActivityLocked: Pausing " + mResumedActivity);
           pausing |= startPausingLocked(userLeaving, false, true, dontWaitForPause);
       }
       if (pausing) {
           if (DEBUG_SWITCH || DEBUG_STATES) Slog.v(TAG_STATES,
                   "resumeTopActivityLocked: Skip resume: need to start pausing");
           // At this point we want to put the upcoming activity's process
           // at the top of the LRU list, since we know we will be needing it
           // very soon and it would be a waste to let it get killed if it
           // happens to be sitting towards the end.
           if (next.app != null && next.app.thread != null) {
               mService.updateLruProcessLocked(next.app, true, null);
           }
           if (DEBUG_STACK) mStackSupervisor.validateTopActivitiesLocked();
           return true;
       }
///省略一波代码
	
mStackSupervisor.startSpecificActivityLocked(next, true, true);

    }

此时，mResumedActivity 就是 Launcher ， mResumedActivity 不为 null，于是调用 startPausingLocked 方法，之后通过应用进程的 ApplicationThread 将流程回到应用进程，最后来到了 ActivityThread 的 handlePauseActivity 类。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
frameworks/base/core/java/android/app/ActivityThread.java

private void handlePauseActivity(IBinder token, boolean finished,
        boolean userLeaving, int configChanges, boolean dontReport) {
    ActivityClientRecord r = mActivities.get(token);
    if (r != null) {
        //Slog.v(TAG, "userLeaving=" + userLeaving + " handling pause of " + r);
        if (userLeaving) {
            performUserLeavingActivity(r);
        }

        r.activity.mConfigChangeFlags |= configChanges;
        performPauseActivity(token, finished, r.isPreHoneycomb());

        // Make sure any pending writes are now committed.
        if (r.isPreHoneycomb()) {
            QueuedWork.waitToFinish();
        }

        // Tell the activity manager we have paused.
        if (!dontReport) {
            try {
                ActivityManagerNative.getDefault().activityPaused(token);
            } catch (RemoteException ex) {
            }
        }
        mSomeActivitiesChanged = true;
    }
}

通过调用 performPauseActivity 后，程序真正进入了 Launcher 的 onPause 方法。

之后 ActivityManagerNative.getDefault().activityPaused(token) 再次将流程转到了 AMS ，通过一些系列调用，到了 ActivityStack 的 completePauseLocked 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
frameworks/base/core/java/android/app/ActivityStack.java

private void completePauseLocked(boolean resumeNext) {
    ActivityRecord prev = mPausingActivity;
    if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "Complete pause: " + prev);

    if (prev != null) {
        prev.state = ActivityState.PAUSED;
        if (prev.finishing) {
            if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "Executing finish of activity: " + prev);
            prev = finishCurrentActivityLocked(prev, FINISH_AFTER_VISIBLE, false);
        } else if (prev.app != null) {
            if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "Enqueueing pending stop: " + prev);
            if (mStackSupervisor.mWaitingVisibleActivities.remove(prev)) {
                if (DEBUG_SWITCH || DEBUG_PAUSE) Slog.v(TAG_PAUSE,
                        "Complete pause, no longer waiting: " + prev);
            }
            if (prev.configDestroy) {
                // The previous is being paused because the configuration
                // is changing, which means it is actually stopping...
                // To juggle the fact that we are also starting a new
                // instance right now, we need to first completely stop
                // the current instance before starting the new one.
                if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "Destroying after pause: " + prev);
                destroyActivityLocked(prev, true, "pause-config");
            } else if (!hasVisibleBehindActivity() || mService.isSleepingOrShuttingDown()) {
                // If we were visible then resumeTopActivities will release resources before
                // stopping.
                mStackSupervisor.mStoppingActivities.add(prev);
                if (mStackSupervisor.mStoppingActivities.size() > 3 ||
                        prev.frontOfTask && mTaskHistory.size() <= 1) {
                    // If we already have a few activities waiting to stop,
                    // then give up on things going idle and start clearing
                    // them out. Or if r is the last of activity of the last task the stack
                    // will be empty and must be cleared immediately.
                    if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "To many pending stops, forcing idle");
                    mStackSupervisor.scheduleIdleLocked();
                } else {
                    mStackSupervisor.checkReadyForSleepLocked();
                }
            }
        } else {
            if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "App died during pause, not stopping: " + prev);
            prev = null;
        }
        // It is possible the activity was freezing the screen before it was paused.
        // In that case go ahead and remove the freeze this activity has on the screen
        // since it is no longer visible.
        prev.stopFreezingScreenLocked(true /*force*/);
        mPausingActivity = null;
    }

    if (resumeNext) {
        final ActivityStack topStack = mStackSupervisor.getFocusedStack();
        if (!mService.isSleepingOrShuttingDown()) {
            mStackSupervisor.resumeTopActivitiesLocked(topStack, prev, null);
        } else {
            mStackSupervisor.checkReadyForSleepLocked();
            ActivityRecord top = topStack.topRunningActivityLocked(null);
            if (top == null || (prev != null && top != prev)) {
                // If there are no more activities available to run,
                // do resume anyway to start something.  Also if the top
                // activity on the stack is not the just paused activity,
                // we need to go ahead and resume it to ensure we complete
                // an in-flight app switch.
                mStackSupervisor.resumeTopActivitiesLocked(topStack, null, null);
            }
        }
    }

    if (prev != null) {
        prev.resumeKeyDispatchingLocked();

        if (prev.app != null && prev.cpuTimeAtResume > 0
                && mService.mBatteryStatsService.isOnBattery()) {
            long diff = mService.mProcessCpuTracker.getCpuTimeForPid(prev.app.pid)
                    - prev.cpuTimeAtResume;
            if (diff > 0) {
                BatteryStatsImpl bsi = mService.mBatteryStatsService.getActiveStatistics();
                synchronized (bsi) {
                    BatteryStatsImpl.Uid.Proc ps =
                            bsi.getProcessStatsLocked(prev.info.applicationInfo.uid,
                                    prev.info.packageName);
                    if (ps != null) {
                        ps.addForegroundTimeLocked(diff);
                    }
                }
            }
        }
        prev.cpuTimeAtResume = 0; // reset it
    }

    // Notfiy when the task stack has changed
    mService.notifyTaskStackChangedLocked();
}

mStackSupervisor.scheduleIdleLocked() 最终执行了 Launcher 的 onPause 方法。

mStackSupervisor.resumeTopActivitiesLocked 一路调用，再次来到了 ActivityStack 的 resumeTopActivityInnerLocked 方法，该方法调用了 ActivityStackSupervisor 类的 startSpecificActivityLocked 方法，此时正式开始了新 Activity 的生命周期过程。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
frameworks/base/core/java/android/app/ActivityStackSupervisor.java

void startSpecificActivityLocked(ActivityRecord r,
        boolean andResume, boolean checkConfig) {
    // Is this activity's application already running?
    ProcessRecord app = mService.getProcessRecordLocked(r.processName,
            r.info.applicationInfo.uid, true);

    r.task.stack.setLaunchTime(r);

    if (app != null && app.thread != null) {
        try {
            if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                    || !"android".equals(r.info.packageName)) {
                // Don't add this if it is a platform component that is marked
                // to run in multiple processes, because this is actually
                // part of the framework so doesn't make sense to track as a
                // separate apk in the process.
                app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode,
                        mService.mProcessStats);
            }
            realStartActivityLocked(r, app, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            Slog.w(TAG, "Exception when starting activity "
                    + r.intent.getComponent().flattenToShortString(), e);
        }

        // If a dead object exception was thrown -- fall through to
        // restart the application.
    }

    mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
            "activity", r.intent.getComponent(), false, false, true);
}

如果 app 不为 null ,就代表将要启动的 Activity 的进程已经启动(在已启动 APP 中启动Activity 就会走 app 不为 null 的逻辑)，显然这里 app 为 null，于是调用了 AMS 的 startProcessLocked 方法启动新的应用进程。startProcessLocked 通过 Socekt 通知 Zygote 进程创建新的进程，之后进入了 ActivityThread 的 main 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
//frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
    SamplingProfilerIntegration.start();

    // CloseGuard defaults to true and can be quite spammy.  We
    // disable it here, but selectively enable it later (via
    // StrictMode) on debug builds, but using DropBox, not logs.
    CloseGuard.setEnabled(false);

    Environment.initForCurrentUser();

    // Set the reporter for event logging in libcore
    EventLogger.setReporter(new EventLoggingReporter());

    AndroidKeyStoreProvider.install();

    // Make sure TrustedCertificateStore looks in the right place for CA certificates
    final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
    TrustedCertificateStore.setDefaultUserDirectory(configDir);

    Process.setArgV0("<pre-initialized>");

    Looper.prepareMainLooper();

    ActivityThread thread = new ActivityThread();
    thread.attach(false);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

    if (false) {
        Looper.myLooper().setMessageLogging(new
                LogPrinter(Log.DEBUG, "ActivityThread"));
    }

    // End of event ActivityThreadMain.
    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

main 方法作为新 app 的入口，主要做了三件事。一是创建了应用程序进程的主线程消息队列和消息循环，让这个线程一直 loop。而是创建一个 ActivityThread 对象。三是 ActivityThread 的 attach() 方法，下面就来看看这个方法。

1
2
3
4
5
6
7
8
9
10
11
private void attach(boolean system) {
        ...

        final IActivityManager mgr = ActivityManagerNative.getDefault();
        try {
            mgr.attachApplication(mAppThread);
        } catch (RemoteException ex) {
            // Ignore
        }
        ...
}

mAppThread 是当前进程的一个 Binder 对象，之后会传递给 AMS ，AMS之后就是通过该对象与 ActivityThread 通信的。

mgr.attachApplication 会经过 Binder 驱动最终调用到 AMS 的 attachApplication 方法。

AMS 的 attachApplication 方法会调用到 AMS 的 attachApplicationLocked 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid) {

    ...

    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
        }
    }

    ...

    if (!didSomething) {
        //调用处理内存管理。不是很理解里面的机制，暂时不分析。
        updateOomAdjLocked();
    }

    return true;
}

mStackSupervisor.attachApplicationLocked(app) 最终会通过 Binder 驱动执行到 ActivityThread 的 scheduleLaunchActivity 方法，最终调用了 handleLaunchActivity 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
frameworks/base/core/java/android/app/ActivityThread.java

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    
    ...        

    Activity a = performLaunchActivity(r, customIntent);

    if (a != null) {
        r.createdConfig = new Configuration(mConfiguration);
        Bundle oldState = r.state;
        handleResumeActivity(r.token, false, r.isForward,
                !r.activity.mFinished && !r.startsNotResumed);
    
    ...

}

performLaunchActivity 调用后会进入 Activity 的 onCreate 方法。

handleResumeActivity 调用后会进入 Activity 的 onStart 和 onResume 方法。

首先来看下 performLaunchActivity 方法的实现。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
frameworks/base/core/java/android/app/ActivityThread.java

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // System.out.println("##### [" + System.currentTimeMillis() + "] ActivityThread.performLaunchActivity(" + r + ")");

    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }

    ComponentName component = r.intent.getComponent();
    if (component == null) {
        component = r.intent.resolveActivity(
            mInitialApplication.getPackageManager());
        r.intent.setComponent(component);
    }

    if (r.activityInfo.targetActivity != null) {
        component = new ComponentName(r.activityInfo.packageName,
                r.activityInfo.targetActivity);
    }

    Activity activity = null;
    try {
        java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
        StrictMode.incrementExpectedActivityCount(activity.getClass());
        r.intent.setExtrasClassLoader(cl);
        r.intent.prepareToEnterProcess();
        if (r.state != null) {
            r.state.setClassLoader(cl);
        }
    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to instantiate activity " + component
                + ": " + e.toString(), e);
        }
    }

    try {
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);

        if (localLOGV) Slog.v(TAG, "Performing launch of " + r);
        if (localLOGV) Slog.v(
                TAG, r + ": app=" + app
                + ", appName=" + app.getPackageName()
                + ", pkg=" + r.packageInfo.getPackageName()
                + ", comp=" + r.intent.getComponent().toShortString()
                + ", dir=" + r.packageInfo.getAppDir());

        if (activity != null) {
            Context appContext = createBaseContextForActivity(r, activity);
            CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
            Configuration config = new Configuration(mCompatConfiguration);
            if (DEBUG_CONFIGURATION) Slog.v(TAG, "Launching activity "
                    + r.activityInfo.name + " with config " + config);
            activity.attach(appContext, this, getInstrumentation(), r.token,
                    r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor);

            if (customIntent != null) {
                activity.mIntent = customIntent;
            }
            r.lastNonConfigurationInstances = null;
            activity.mStartedActivity = false;
            int theme = r.activityInfo.getThemeResource();
            if (theme != 0) {
                activity.setTheme(theme);
            }

            activity.mCalled = false;
            if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }
            if (!activity.mCalled) {
                throw new SuperNotCalledException(
                    "Activity " + r.intent.getComponent().toShortString() +
                    " did not call through to super.onCreate()");
            }
            r.activity = activity;
            r.stopped = true;
            if (!r.activity.mFinished) {
                activity.performStart();
                r.stopped = false;
            }
            if (!r.activity.mFinished) {
                if (r.isPersistable()) {
                    if (r.state != null || r.persistentState != null) {
                        mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state,
                                r.persistentState);
                    }
                } else if (r.state != null) {
                    mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state);
                }
            }
            if (!r.activity.mFinished) {
                activity.mCalled = false;
                if (r.isPersistable()) {
                    mInstrumentation.callActivityOnPostCreate(activity, r.state,
                            r.persistentState);
                } else {
                    mInstrumentation.callActivityOnPostCreate(activity, r.state);
                }
                if (!activity.mCalled) {
                    throw new SuperNotCalledException(
                        "Activity " + r.intent.getComponent().toShortString() +
                        " did not call through to super.onPostCreate()");
                }
            }
        }
        r.paused = true;

        mActivities.put(r.token, r);

    } catch (SuperNotCalledException e) {
        throw e;

    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to start activity " + component
                + ": " + e.toString(), e);
        }
    }

    return activity;
}

该方法首先通过反射创建 Activity 对象，之后通过 activity 的 attach 方法做了很多 View 相关的初始化工作，之后调用 mInstrumentation.callActivityOnPostCreate(activity, r.state); 就会进入 Activity 的 onCreate 方法。

接下来看下 handleResumeActivity 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
final void handleResumeActivity(IBinder token,
        boolean clearHide, boolean isForward, boolean reallyResume) {
    ...

    ActivityClientRecord r = performResumeActivity(token, clearHide);

    ...

    Looper.myQueue().addIdleHandler(new Idler());

    ...

}

调用 performResumeActivity 后进入 Activity 的 onStart 和 onResume 方法，这里就不再分析了，这个过程和进入 onCreate 方法类似。

调用 Looper.myQueue().addIdleHandler(new Idler()) 语句后，进入 AMS activityIdle 方法，之后再次回到应用进程中执行了上个 Activity 的 onStop 方法。

至此，Activity 的启动过程就分析完毕。

最后，推荐阅读以下这篇文章了解一下 ActivityRecord、ActivityClientRecord、Activity 三者之前的关系。

2 ANR 机制

2.1 ANR 产生的原因

只有当应用程序的UI线程响应超时才会引起ANR，超时产生原因一般有两种。

  1. 当前的事件没有机会得到处理，例如UI线程正在响应另一个事件，当前事件由于某种原因被阻塞了。
  2. 当前的事件正在处理，但是由于耗时太长没能及时完成。

根据ANR产生的原因不同，超时事件也不尽相同，从本质上将，产生ANR的原因有三种，大致可以对应到android中四大组件中的三个（Activity/View，BroadcastReceiver和Service）。

1
KeyDispatchTimeout

最常见的一种类型，原因就是View的点击事件或者触摸事件在特定的时间（5s）内无法得到响应。

1
BroadcastTimeout

原因是BroadcastReceiver的onReceive()函数运行在主线程中，在特定的时间（10s）内无法完成处理。

1
ServiceTimeout

比较少出现的一种类型，原因是Service的各个生命周期函数在特定时间（20s）内无法完成处理。

该模块更多知识请看 这篇文章。

2.2 以 Service 的启动为例，分析 ANR 产生的过程

当我们调用 startService 方法后，最终会来到 ActiveServices 的 realStartServiceLocked 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
 frameworks/base/core/java/android/server/am/ActiveServices.java

 private final void realStartServiceLocked(ServiceRecord r,
            ProcessRecord app, boolean execInFg) throws RemoteException {
        ...

        bumpServiceExecutingLocked(r, execInFg, "create");
        //该方法就是 ANR 记录器，到底特定时间就会触发 ANR 操作。
		...

        app.thread.scheduleCreateService(r, r.serviceInfo,
mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
                    app.repProcState);
     	//通过 Binder 驱动调用到 AMS 的 scheduleCreateService 方法。

        ...

    }

bumpServiceExecutingLocked 最终会调用 scheduleServiceTimeoutLocked 方法，我来看下 scheduleServiceTimeoutLocked 的实现。

1
2
3
4
5
6
7
8
9
10
11
12
void scheduleServiceTimeoutLocked(ProcessRecord proc) {
    if (proc.executingServices.size() == 0 || proc.thread == null) {
        return;
    }
    long now = SystemClock.uptimeMillis();
    Message msg = mAm.mHandler.obtainMessage(
            ActivityManagerService.SERVICE_TIMEOUT_MSG);
    msg.obj = proc;
    mAm.mHandler.sendMessageAtTime(msg,
            proc.execServicesFg ? (now+SERVICE_TIMEOUT) : (now+ SERVICE_BACKGROUND_TIMEOUT));
}

该方法会在超时时间到达后发送 ActivityManagerService.SERVICE_TIMEOUT_MSG 消息，AMS 受该消息后进入 MainHandler 的 SERVICE_TIMEOUT_MSG case。

1
2
3
4
5
6
7
8
9
10
case SERVICE_TIMEOUT_MSG: {
    if (mDidDexOpt) {
        mDidDexOpt = false;
        Message nmsg = mHandler.obtainMessage(SERVICE_TIMEOUT_MSG);
        nmsg.obj = msg.obj;
        mHandler.sendMessageDelayed(nmsg, ActiveServices.SERVICE_TIMEOUT);
        return;
    }
    mServices.serviceTimeout((ProcessRecord)msg.obj);
}

mServices.serviceTimeout 最终会通过 AMS 的 appNotResponding 方法发送 SHOW_NOT_RESPONDING_MSG 消息到 UiHandler 中弹出 ANR 弹窗。

由以上分析我们可以知道，要想避免 ANR 弹窗的出现，就必须抢在超时时间到达之前结束 mAm.mHandler.sendMessageAtTime 的发送，如何结束呢？

让我们回到 realStartServiceLocked 方法，执行 app.thread.scheduleCreateService 语句最终会将我们带到应用进程 ActivityThread 类的 handleCreateService 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
private void handleCreateService(CreateServiceData data) {
    ...

    LoadedApk packageInfo = getPackageInfoNoCheck(
            data.info.applicationInfo, data.compatInfo);
    Service service = null;
    try {
        java.lang.ClassLoader cl = packageInfo.getClassLoader();
        service = (Service) cl.loadClass(data.info.name).newInstance();
    } catch (Exception e) {
        if (!mInstrumentation.onException(service, e)) {
            throw new RuntimeException(
                "Unable to instantiate service " + data.info.name
                + ": " + e.toString(), e);
        }
    }

    try {

        ...

        service.onCreate();
        mServices.put(data.token, service);
        try {
            ActivityManagerNative.getDefault().serviceDoneExecuting(
                    data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
        } catch (RemoteException e) {
            // nothing to do.
        }
    } catch (Exception e) {
        if (!mInstrumentation.onException(service, e)) {
            throw new RuntimeException(
                "Unable to create service " + data.info.name
                + ": " + e.toString(), e);
        }
    }
}

代码首先通过反射创建了 Service 对象，之后 service.onCreate 方法调用，最后 ActivityManagerNative.getDefault().serviceDoneExecuting 语句会通过 Binder 驱动调用 AMS 的 serviceDoneExecuting 方法。

1
2
3
4
5
6
7
8
9
public void serviceDoneExecuting(IBinder token, int type, int startId, int res) {
    synchronized(this) {
        if (!(token instanceof ServiceRecord)) {
            Slog.e(TAG, "serviceDoneExecuting: Invalid service token=" + token);
            throw new IllegalArgumentException("Invalid service token");
        }
        mServices.serviceDoneExecutingLocked((ServiceRecord)token, type, startId, res);
    }
}

mServices.serviceDoneExecutingLocked 最终会调用到 ActiveServices 的 serviceDoneExecutingLocked 方法。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
private void serviceDoneExecutingLocked(ServiceRecord r, boolean inDestroying,
        boolean finishing) {
    ...

    if (r.executeNesting <= 0) {
        if (r.app != null) {
            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE,
                    "Nesting at 0 of " + r.shortName);
            r.app.execServicesFg = false;
            r.app.executingServices.remove(r);
            if (r.app.executingServices.size() == 0) {

                ...

                mAm.mHandler.removeMessages(ActivityManagerService.SERVICE_TIMEOUT_MSG, r.app);
            }

            ...
        }

        ...
    }
}

mAm.mHandler.removeMessages 语句移除了 ActivityManagerService.SERVICE_TIMEOUT_MSG 消息，之后 ANR 就不会被触发了。