Android ANR处理流程

发表于 | 分类于 | 阅读次数

ANR即Application Not Responding, 应用无响应：当应用在某一个时间内无法及时响应用户请求时，系统会弹出一个对话框，告知用户应用无法响应。此时，用户可以选择关闭应用。对于Android应用来说，有一个UI线程(主线程）专门负责与用户交互，如果在此线程中进行耗时的操作，比如读取磁盘数据、从网络下载资源等IO操作，通常会导致UI线程阻塞，从而无法及时处理用户的输入请求，发生ANR。

Android是通过AMS跟WMS来监控应用响应状态的，一般有如下两种ANR情况：

  • 应用在给定时间内没有对用户输入(按键或者触屏操作）做出响应，通常是5s;
  • 广播接收者(BroadcastReceiver)没有在10s内处理完成；

对于输入无响应的情况，native监控到输入无响应时，则告知WMS，最后由WMS发送消息告诉AMS，某个应用发送了ANR，最后AMS会弹出Application Not Responding的对话框，请求用户关闭应用；对于广播无响应的情况是由AMS负责处理的，AMS对于每个发送出去给广播接收者的广播都有一个10s的定时，如果广播接收者在10s内尚未处理完，则视为无响应，因此也会弹出Application Not Responding。

首先来看下第一种情况。

输入无响应

输入无响应是指用户长时间（5s内）无法响应用户的输入操作，如触摸，按键等，此时AMS会弹出对话框提示用户应用出现ANR(Application Not Responding)。

Android由InputManagerService（IMS）负责处理用户的输入事件，IMS会将输入转交给对应的应用窗口，最后由应用本身做出相应的操作；在native层，IMS有一个对应的InputManager来管理来自Kernel的输入事件（有关Android输入系统，请参考罗升阳Android应用程序键盘消息处理机制分析），InputReader负责读取输入事件，而InputDispatcher则负责将读取的事件分发出去。这里，就来看下InputDispatcher是如何检测应用输入无响应以及将其分发出去的。

以下是输入ANR处理流程图(图片来自http://gityuan.com/images/input/input_reader_seq.jpg)：

native的InputManager初始化时启动一个InputDispatcherThread用于输入事件的分发:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

InputManager::InputManager(
        const sp<EventHubInterface>& eventHub,
        const sp<InputReaderPolicyInterface>& readerPolicy,
        const sp<InputDispatcherPolicyInterface>& dispatcherPolicy) {
    mDispatcher = new InputDispatcher(dispatcherPolicy);
    mReader = new InputReader(eventHub, readerPolicy, mDispatcher);
    initialize();
}
....
void InputManager::initialize() {
    mReaderThread = new InputReaderThread(mReader);
    mDispatcherThread = new InputDispatcherThread(mDispatcher);
}

status_t InputManager::start() {
    // 分发线程
    status_t result = mDispatcherThread->run("InputDispatcher", PRIORITY_URGENT_DISPLAY);
    // 读线程
    result = mReaderThread->run("InputReader", PRIORITY_URGENT_DISPLAY);
    

    return OK;
}

InputDispatcherThread启动时，进入一个线程循环：

1
2
3
4
5
6
7
8
9
10

InputDispatcherThread::InputDispatcherThread(const sp<InputDispatcherInterface>& dispatcher) :
        Thread(/*canCallJava*/ true), mDispatcher(dispatcher) {
}

//启动后，进入线程循环
bool InputDispatcherThread::threadLoop() {
    mDispatcher->dispatchOnce();
    return true;
}

InputDispatcher开始事件处理：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

void InputDispatcher::dispatchOnce() {
    nsecs_t nextWakeupTime = LONG_LONG_MAX;
    { // acquire lock
        AutoMutex _l(mLock);
        mDispatcherIsAliveCondition.broadcast();
        
        // 指令请求队列为空，则开始分发输入事件
        if (!haveCommandsLocked()) {
            dispatchOnceInnerLocked(&nextWakeupTime);
        }

        // Run all pending commands if there are any.
        if (runCommandsLockedInterruptible()) {
            nextWakeupTime = LONG_LONG_MIN;
        }
    } // release lock

    // Wait for callback or timeout or wake.  (make sure we round up, not down)
    nsecs_t currentTime = now();
    int timeoutMillis = toMillisecondTimeoutDelay(currentTime, nextWakeupTime);
    // 查看线程消息队列是否有新的消息
    mLooper->pollOnce(timeoutMillis);
}

根据输入事件的类型将事件分发出去，按键输入事件类型是TYPE_KEY，触屏输入事件TYPE_MOTION，这里假定应用处理的是一个按键事件:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


void InputDispatcher::dispatchOnceInnerLocked(nsecs_t* nextWakeupTime) {
    ...
    switch (mPendingEvent->type) {
        ....
        // 按键事件
        case EventEntry::TYPE_KEY: {
            ...
            //分发按键事件
            done = dispatchKeyLocked(currentTime, typedEntry, &dropReason, nextWakeupTime);
            break;
        }
        // 触屏事件
        case EventEntry::TYPE_MOTION: {
            ....
            done = dispatchMotionLocked(currentTime, typedEntry,
                    &dropReason, nextWakeupTime);
            break;
        }
    
    }

}

分发键盘事件之前，首先需要找到当前响应输入的焦点窗口：

1
2
3
4
5
6
7
8
9
10
11
12
13
14


bool InputDispatcher::dispatchKeyLocked(nsecs_t currentTime, KeyEntry* entry,
        DropReason* dropReason, nsecs_t* nextWakeupTime) {
    ....
    // 找到当前输入焦点窗口
    Vector<InputTarget> inputTargets;
    int32_t injectionResult = findFocusedWindowTargetsLocked(currentTime,
            entry, inputTargets, nextWakeupTime);
    ....
    // Dispatch the key.
    dispatchEventLocked(currentTime, entry, inputTargets);
    return true;
}

在查找目标焦点窗口之前，会检查是否有应用程序的窗口处于无响应状态：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

int32_t InputDispatcher::findFocusedWindowTargetsLocked(nsecs_t currentTime,
        EventEntry* entry, Vector<InputTarget>& inputTargets, nsecs_t* nextWakeupTime) {
    ....
    // Check whether the window is ready for more input
    reason = checkWindowReadyForMoreInputLocked(currentTime,
            focusedWindowHandle, entry, "focused");
    // 输入无响应
    if (!reason.isEmpty()) {
        injectionResult = handleTargetsNotReadyLocked(currentTime, entry,
                //mFocusedApplicationHandle, mFocusedWindowHandle, nextWakeupTime, reason.string());
                mFocusedApplicationHandle, focusedWindowHandle, nextWakeupTime, reason.string());
        goto Unresponsive;
    }

    // Done.
    Failed:
    Unresponsive:
        nsecs_t timeSpentWaitingForApplication = getTimeSpentWaitingForApplicationLocked(currentTime);
        updateDispatchStatisticsLocked(currentTime, entry,
                injectionResult, timeSpentWaitingForApplication);
        return injectionResult;
}

如果发现焦点窗口无法对用户事件作出响应，并且超过了给定的时间(Android设定的超时为5s)，则

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

int32_t InputDispatcher::handleTargetsNotReadyLocked(nsecs_t currentTime,
        const EventEntry* entry,
        const sp<InputApplicationHandle>& applicationHandle,
        const sp<InputWindowHandle>& windowHandle,
        nsecs_t* nextWakeupTime, const char* reason) {
        ....
        //应用无响应超时
        if (currentTime >= mInputTargetWaitTimeoutTime) {
            onANRLocked(currentTime, applicationHandle, windowHandle,
                    entry->eventTime, mInputTargetWaitStartTime, reason);
            *nextWakeupTime = LONG_LONG_MIN;
            return INPUT_EVENT_INJECTION_PENDING;
        } else {
            // Force poll loop to wake up when timeout is due.
            if (mInputTargetWaitTimeoutTime < *nextWakeupTime) {
                *nextWakeupTime = mInputTargetWaitTimeoutTime;
            }
            return INPUT_EVENT_INJECTION_PENDING;
        }
}

将ANR事件以CommandEntry的形式加入到命令队列中，等到下一次输入处理周期时在处理，处理时会调用函数doNotifyANRLockedInterruptible(见dispatchOnce()）:

1
2
3
4
5
6
7
8
9
10
11
12
13

void InputDispatcher::onANRLocked(
        nsecs_t currentTime, const sp<InputApplicationHandle>& applicationHandle,
        const sp<InputWindowHandle>& windowHandle,
        nsecs_t eventTime, nsecs_t waitStartTime, const char* reason) {
    ...
    // 将ANR事件添加到命令队列
    CommandEntry* commandEntry = postCommandLocked(
            & InputDispatcher::doNotifyANRLockedInterruptible);
    commandEntry->inputApplicationHandle = applicationHandle;
    commandEntry->inputWindowHandle = windowHandle;
    commandEntry->reason = reason;
}

通过InputDispatcherPolicyInterface接口通知NativeInputMananger有ANR事件发生：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

void InputDispatcher::doNotifyANRLockedInterruptible(
        CommandEntry* commandEntry) {
    mLock.unlock();

    nsecs_t newTimeout = mPolicy->notifyANR(
            commandEntry->inputApplicationHandle, commandEntry->inputWindowHandle,
            commandEntry->reason);

    mLock.lock();

    resumeAfterTargetsNotReadyTimeoutLocked(newTimeout,
            commandEntry->inputWindowHandle != NULL
                    ? commandEntry->inputWindowHandle->getInputChannel() : NULL);
}

到这里，准备通知InputManagerService.java（IMS）ANR事件了，mServiceObj实际是一个Java类InputManagerService的一个全局引用，通过CallLongMethod来调用IMS中的notifyANR方法：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22


nsecs_t NativeInputManager::notifyANR(const sp<InputApplicationHandle>& inputApplicationHandle,
        const sp<InputWindowHandle>& inputWindowHandle, const String8& reason) {

    JNIEnv* env = jniEnv();

    jobject inputApplicationHandleObj =
            getInputApplicationHandleObjLocalRef(env, inputApplicationHandle);
    jobject inputWindowHandleObj =
            getInputWindowHandleObjLocalRef(env, inputWindowHandle);
    jstring reasonObj = env->NewStringUTF(reason.string());
     //调用IMS的notifyANR方法
    jlong newTimeout = env->CallLongMethod(mServiceObj,
                gServiceClassInfo.notifyANR, inputApplicationHandleObj, inputWindowHandleObj,
                reasonObj);

    env->DeleteLocalRef(reasonObj);
    env->DeleteLocalRef(inputWindowHandleObj);
    env->DeleteLocalRef(inputApplicationHandleObj);
    return newTimeout;
}

NativeInputManager位于com_android_server_input_InputManagerService.cpp,是InputManagerService.java对应的Native文件中的类，其负责初始化输入系统的native框架

IMS收到ANR事件后，通过一个回调接口WindowManagerCallbacks通知WMS(WindowManagerService)， WindowManagerCallbacks接口实际是一个InputMonitor.java对象，在SystemServer进程启动时，将WMS中的InputMonitor设置为IMS的回调:

1
2
3
4
5
6
7

private long notifyANR(InputApplicationHandle inputApplicationHandle,
        InputWindowHandle inputWindowHandle, String reason) {
    // mWindowMangerCallbacks是InputMonitor实现的回调接口
    return mWindowManagerCallbacks.notifyANR(
            inputApplicationHandle, inputWindowHandle, reason);
}

向AMS发起inputDispatchingTimedOut的Binder请求，告知其ANR事件：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

@Override
public long notifyANR(InputApplicationHandle inputApplicationHandle,
        InputWindowHandle inputWindowHandle, String reason) {
    ....
    if (appWindowToken != null && appWindowToken.appToken != null) {
    // 告知AMS有ANR事件
    } else if (windowState != null) {
        try {
            // Notify the activity manager about the timeout and let it decide whether
            // to abort dispatching or keep waiting.
            long timeout = ActivityManagerNative.getDefault().inputDispatchingTimedOut(
                    windowState.mSession.mPid, aboveSystem, reason);
            if (timeout >= 0) {
                // The activity manager declined to abort dispatching.
                // Wait a bit longer and timeout again later.
                return timeout * 1000000L; // nanoseconds
            }
        } catch (RemoteException ex) {
        }
    }
    return 0; // abort dispatching
}

AMS处理输入响应超时：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19


@Override
public long inputDispatchingTimedOut(int pid, final boolean aboveSystem, String reason) {

    ProcessRecord proc;
    long timeout;
    synchronized (this) {
        synchronized (mPidsSelfLocked) {
            proc = mPidsSelfLocked.get(pid);
        }
        timeout = getInputDispatchingTimeoutLocked(proc);
    }
    if (!inputDispatchingTimedOut(proc, null, null, aboveSystem, reason)) {
        return -1;
    }

    return timeout;
}

发现有应用进程ANR，AMS向主线程发送一个可执行对象，执行ANR操作，最后AppErrors会向当前应用程序的UI线程发送一个ANR的对话框：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18


public boolean inputDispatchingTimedOut(final ProcessRecord proc,
        final ActivityRecord activity, final ActivityRecord parent,
        final boolean aboveSystem, String reason) {
    ....
    if (proc != null) {
        //
        mHandler.post(new Runnable() {
            @Override
            public void run() {
                mAppErrors.appNotResponding(proc, activity, parent, aboveSystem, annotation);
            }
        });
    }

    return true;
}

接下来，再来看下广播处理超时的情况。

广播处理超时

广播的运行机制很像“内容发布者-订阅者”这样的信息传递方式：新闻报纸就是典型的例子，订阅者首先得到新闻通讯社注册成为用户才能接收到报纸；而新闻媒体则负责将报纸发送给各个合法的注册者。与此类似，广播的发送者通过Context中的接口sendBroadcast(Intent)向系统发送广播；而接收者则需要通过Context中提供的接口registerReceiver来监听广播，对于有系统权限限制的广播，需要相应的用户权限才允许接收。

Android系统广播由AMS(ActivityManagerService)负责管理，AMS中有两个广播队列，一个是前台广播(Intent中对应的标志位FLAG_RECEIVER_FOREGROUND),具有在前台运行的优先级；一个是后台广播，不指定前台标志位的广播都默认为后台广播。对于前台广播，接收者如果在10s内为完成，则视为超时；后台广播如果接收后60s内为完成，则超时。此时，AMS会向当前UI线程发送一个ANR的对话框。

AMS中接收到广播后，将广播放入一个队列,根据广播接收者注册机制的不同，广播队列分为并行与串行两种处理方式，并行处理广播不用等待其他广播完成，主要用于处理用Context接口注册的广播接收者；串行方式则必须按照严格广播入队列的先后次序来处理.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

final int broadcastIntentLocked(ProcessRecord callerApp,
        String callerPackage, Intent intent, String resolvedType,
        IIntentReceiver resultTo, int resultCode, String resultData,
        Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions,
        boolean ordered, boolean sticky, int callingPid, int callingUid, int userId) {
    ....
    // 从Context中注册的广播接收
    int NR = registeredReceivers != null ? registeredReceivers.size() : 0;
    if (!ordered && NR > 0) {
        // If we are not serializing this broadcast, then send the
        // registered receivers separately so they don't wait for the
        // components to be launched.
        if (isCallerSystem) {
            checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid,
                    isProtectedBroadcast, registeredReceivers);
        }
        final BroadcastQueue queue = broadcastQueueForIntent(intent);
        BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                callerPackage, callingPid, callingUid, resolvedType, requiredPermissions,
                appOp, brOptions, registeredReceivers, resultTo, resultCode, resultData,
                resultExtras, ordered, sticky, false, userId);

        final boolean replaced = replacePending && queue.replaceParallelBroadcastLocked(r);
        // 放入广播队列，并开始处理广播
        if (!replaced) {
            queue.enqueueParallelBroadcastLocked(r);
            queue.scheduleBroadcastsLocked();
        }
        registeredReceivers = null;
        NR = 0;
    }

    // AndroidManifest.xml文件中声明的广播接收者
    if ((receivers != null && receivers.size() > 0)
            || resultTo != null) {
        BroadcastQueue queue = broadcastQueueForIntent(intent);
        BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
                callerPackage, callingPid, callingUid, resolvedType,
                requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode,

        boolean replaced = replacePending && queue.replaceOrderedBroadcastLocked(r);
        if (!replaced) {
            queue.enqueueOrderedBroadcastLocked(r);
            queue.scheduleBroadcastsLocked();
        }
    } else {
        ....
        }
    }

    return ActivityManager.BROADCAST_SUCCESS;
}

发送消息BROADCAST_INTENT_MSG请求处理广播：

1
2
3
4
5
6
7
8
9

public void scheduleBroadcastsLocked() {
    //当前有广播在处理，返回
    if (mBroadcastsScheduled) {
        return;
    }
    mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
    mBroadcastsScheduled = true;
}

Handler接受到消息，开始处理队列中的广播：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

private final class BroadcastHandler extends Handler {
    public 
        BroadcastHandler(Looper looper) {
        super(looper, null, true);
    }

    @Override
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BROADCAST_INTENT_MSG: {
                //处理广播
                processNextBroadcast(true);
            } break;
            // 广播超时消息
            case BROADCAST_TIMEOUT_MSG: {
                synchronized (mService) {
                    broadcastTimeoutLocked(true);
                }
            } break;
        }
    }
}

处理下一个广播，简单起见，这里只分析串行分发广播的方式：首先记录下广播分发的时间dispatchTime,接着设置广播超时时间；最后开始处理广播，将其发送给广播接收者：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

final void processNextBroadcast(boolean fromMsg) {
    synchronized(mService) {

        do {
            r = mOrderedBroadcasts.get(0);
            // 取消广播超时设置
            cancelBroadcastTimeoutLocked();

        } while (r == null);
        ...
        r.receiverTime = SystemClock.uptimeMillis();
        if (recIdx == 0) {
            // 广播分发时间
            r.dispatchTime = r.receiverTime;
            r.dispatchClockTime = System.currentTimeMillis();
        }
        if (! mPendingBroadcastTimeoutMessage) {
            long timeoutTime = r.receiverTime + mTimeoutPeriod;
            //设置广播超时消息
            setBroadcastTimeoutLocked(timeoutTime);
        }
        ....
        // Is this receiver's application already running?
        if (app != null && app.thread != null) {
            try {
                app.addPackage(info.activityInfo.packageName,
                        info.activityInfo.applicationInfo.versionCode, mService.mProcessStats);
                processCurBroadcastLocked(r, app);
                return;
            } catch (RemoteException e) {
            } catch (RuntimeException e) {
                logBroadcastReceiverDiscardLocked(r);
                finishReceiverLocked(r, r.resultCode, r.resultData,
                        r.resultExtras, r.resultAbort, false);
                scheduleBroadcastsLocked();
                // We need to reset the state if we failed to start the receiver.
                r.state = BroadcastRecord.IDLE;
                return;
            }
        }
     //广播接收者进程不存在，启动之
     if ((r.curApp=mService.startProcessLocked(targetProcess,
                        info.activityInfo.applicationInfo, true,
                        r.intent.getFlags() | Intent.FLAG_FROM_BACKGROUND,
                        "broadcast", r.curComponent,
                        (r.intent.getFlags()&Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0, false, false, false))
                                == null) {
                    //启动应用失败
                    finishReceiverLocked(r, r.resultCode, r.resultData,
                            r.resultExtras, r.resultAbort, false);
                    scheduleBroadcastsLocked();
                    r.state = BroadcastRecord.IDLE;
                    return;
                }
        }

如果广播处理在10s内未完成，则出发TIME_OUT的消息:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

final void broadcastTimeoutLocked(boolean fromMsg) {
    if (fromMsg) {
        mPendingBroadcastTimeoutMessage = false;
    }

    if (mOrderedBroadcasts.size() == 0) {
        return;
    }

    long now = SystemClock.uptimeMillis();
    BroadcastRecord r = mOrderedBroadcasts.get(0);

    if (fromMsg) {
        long timeoutTime = r.receiverTime + mTimeoutPeriod;
        if (timeoutTime > now) {
            // 处理成功，重新设置TIMEOUT时间，返回
            setBroadcastTimeoutLocked(timeoutTime);
            return;
        }
    }
    ....
    r.receiverTime = now;
    r.anrCount++;

    ProcessRecord app = null;
    String anrMessage = null;

    Object curReceiver = r.receivers.get(r.nextReceiver-1);
    r.delivery[r.nextReceiver-1] = BroadcastRecord.DELIVERY_TIMEOUT;
    if (curReceiver instanceof BroadcastFilter) {
        BroadcastFilter bf = (BroadcastFilter)curReceiver;
        if (bf.receiverList.pid != 0
                && bf.receiverList.pid != ActivityManagerService.MY_PID) {
            synchronized (mService.mPidsSelfLocked) {
                app = mService.mPidsSelfLocked.get(
                        bf.receiverList.pid);
            }
        }
    } else {
        app = r.curApp;
    }

    // Move on to the next receiver.
    finishReceiverLocked(r, r.resultCode, r.resultData,
            r.resultExtras, r.resultAbort, false);
    scheduleBroadcastsLocked();
    // 向超时应用发送ANR消息
    if (anrMessage != null) {
        mHandler.post(new AppNotResponding(app, anrMessage));
    }
}