汇总：记录线上崩溃的问题

前言

记录线上崩溃问题，持续记录...

DigitsKeyListener导致7.x.x以下手机崩溃

设备列表

修复方式：

修复方式

Fragment 构造方法私有化导致崩溃

Fragment导致崩溃 修复方式

原因分析

FragmentActivity#onSaveInstanceState

protected void onSaveInstanceState(@NonNull Bundle outState) {
    super.onSaveInstanceState(outState);
    markFragmentsCreated();
    mFragmentLifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_STOP);
    // 进行Fragment状态保存 拿到Parcelable对象
    Parcelable p = mFragments.saveAllState();
    if (p != null) {
         // 存入
        outState.putParcelable(FRAGMENTS_TAG, p);
    }
    // 省略部分保存Key Value
}

FragmentActivity#onCreate(@Nullable Bundle savedInstanceState)

 @Override
 protected void onCreate(@Nullable Bundle savedInstanceState) {
    if (savedInstanceState != null) {
        Parcelable p = savedInstanceState.getParcelable(FRAGMENTS_TAG);
        // 恢复部分数据
        mFragments.restoreSaveState(p);
    }
    // 省略部分代码....
}

FragmentManagerImpl#

void restoreSaveState(Parcelable state) {
    for (FragmentState fs : fms.mActive) {
        if (fs != null) {
            // 创建一个新的Fragment对象
            Fragment f = fs.instantiate(mHost.getContext().getClassLoader(),
                    getFragmentFactory());
            f.mFragmentManager = this;
            if (DEBUG) Log.v(TAG, "restoreSaveState: active (" + f.mWho + "): " + f);
            mActive.put(f.mWho, f);
            // Now that the fragment is instantiated (or came from being
            // retained above), clear mInstance in case we end up re-restoring
            // from this FragmentState again.
            fs.mInstance = null;
        }
    }
}

FragmentState#instantiate()

public Fragment instantiate(@NonNull ClassLoader classLoader,
        @NonNull FragmentFactory factory) {
    if (mInstance == null) {
        if (mArguments != null) {
            mArguments.setClassLoader(classLoader);
        }
        // FragmentFactory 所谓的工厂进行创建对象
        mInstance = factory.instantiate(classLoader, mClassName);
        mInstance.setArguments(mArguments);
        if (mSavedFragmentState != null) {
            mSavedFragmentState.setClassLoader(classLoader);
            mInstance.mSavedFragmentState = mSavedFragmentState;
        } else {
            mInstance.mSavedFragmentState = new Bundle();
        }
    }
    return mInstance;
}

FragmentFactory创建对象

@NonNull
public Fragment instantiate(@NonNull ClassLoader classLoader, @NonNull String className) {
    try {
        // 反射创建对象
        Class<? extends Fragment> cls = loadFragmentClass(classLoader, className);
        return cls.getConstructor().newInstance();
    } catch (java.lang.InstantiationException e) {
        throw new Fragment.InstantiationException("Unable to instantiate fragment " + className
                + ": make sure class name exists, is public, and has an"
                + " empty constructor that is public", e);
    } catch (IllegalAccessException e) {
        throw new Fragment.InstantiationException("Unable to instantiate fragment " + className
                + ": make sure class name exists, is public, and has an"
                + " empty constructor that is public", e);
    } catch (NoSuchMethodException e) {
        throw new Fragment.InstantiationException("Unable to instantiate fragment " + className
                + ": could not find Fragment constructor", e);
    } catch (InvocationTargetException e) {
        throw new Fragment.InstantiationException("Unable to instantiate fragment " + className
                + ": calling Fragment constructor caused an exception", e);
    }
}

因此在Fragment中是不允许存在私有构造方法的否则导致在恢复状态的时候Fragment创建失败。

部分机型导致TimeOut异常

java.util.concurrent.TimeoutException: android.content.res.AssetManager$AssetInputStream.finalize() timed out after 10 seconds
 at android.content.res.AssetManager$AssetInputStream.close(AssetManager.java:812)
 at android.content.res.AssetManager$AssetInputStream.finalize(AssetManager.java:845)
 at java.lang.Daemons$FinalizerDaemon.doFinalize(Daemons.java:202)
 at java.lang.Daemons$FinalizerDaemon.run(Daemons.java:185)
 at java.lang.Thread.run(Thread.java:833)

解决办法以及原理分析

private void fixTimeOutException() {
    if (BuildConfig.DEBUG || Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
        return; 
    }
    try {
        final Class<?> clazz = Class.forName("java.lang.Daemons$FinalizerWatchdogDaemon");
        final Method method = clazz.getSuperclass().getDeclaredMethod("stop");
        method.setAccessible(true);
        final Field field = clazz.getDeclaredField("INSTANCE");
        field.setAccessible(true);
        method.invoke(field.get(null));
        UmengUtils.UmEvent(mApplication.getApplicationContext(), "fix_oppo_success");
    } catch (Exception e1) {
        try {
            UmengUtils.UmEvent(mApplication.getApplicationContext(), "fix_oppo_failed");
        } catch (Exception e2) {
            Logger.e(TAG, e1.getMessage());
            Logger.e(TAG, e2.getMessage());
        }
    }
}

Android9.0 启动Activity时，导致的ActivityRecord not found异常。

java.lang.IllegalArgumentException: reportSizeConfigurations: ActivityRecord not found for: Token{dd2d7e2 ActivityRecord{b2548ad u0 com.ehai/cn.jpush.android.service.JNotifyActivity t-1 f}}
    at android.os.Parcel.createException(Parcel.java:1957)
    at android.os.Parcel.readException(Parcel.java:1921)
    at android.os.Parcel.readException(Parcel.java:1871)
    at android.app.IActivityManager$Stub$Proxy.reportSizeConfigurations(IActivityManager.java:8737)
    at android.app.ActivityThread.reportSizeConfigurations(ActivityThread.java:3670)
    at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3625)
    at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:86)
    at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:108)
    at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:68)
    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2199)
    at android.os.Handler.dispatchMessage(Handler.java:112)
    at android.os.Looper.loop(Looper.java:216)
    at android.app.ActivityThread.main(ActivityThread.java:7625)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:524)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:987)
Caused by: android.os.RemoteException: Remote stack trace:
    at com.android.server.am.ActivityManagerService.reportSizeConfigurations(Landroid/os/IBinder;[I[I[I)V(libmapleservices.so:5919109)
    at android.app.IActivityManager$Stub.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmapleframework.so:4765897)
    at com.android.server.am.ActivityManagerService.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmapleservices.so:5931469)
    at com.android.server.am.HwActivityManagerService.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmaplehwServices.so:3387765)
    at android.os.Binder.execTransact(IJJI)Z(libmapleframework.so:6090741)
android.os.RemoteException: Remote stack trace:
    at com.android.server.am.ActivityManagerService.reportSizeConfigurations(Landroid/os/IBinder;[I[I[I)V(libmapleservices.so:5919109)
    at android.app.IActivityManager$Stub.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmapleframework.so:4765897)
    at com.android.server.am.ActivityManagerService.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmapleservices.so:5931469)
    at com.android.server.am.HwActivityManagerService.onTransact(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z(libmaplehwServices.so:3387765)
    at android.os.Binder.execTransact(IJJI)Z(libmapleframework.so:6090741)

究其原因

先找一下抛出异常的具体位置。我们知道启动Activity时，会通过IPC binder机制，通知AMS我要启动Activity了，最终会告知ActivityThread这个类进行回调Activity的各个生命周期的处理。

@Override
public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
    //... 省略部分代码
    final Activity a = performLaunchActivity(r, customIntent);
    if (a != null) {
        r.createdConfig = new Configuration(mConfiguration);
        // 嗯嗯.... 这里就是问题入口拉
        reportSizeConfigurations(r);
        if (!r.activity.mFinished && pendingActions != null) {
            pendingActions.setOldState(r.state);
            pendingActions.setRestoreInstanceState(true);
            pendingActions.setCallOnPostCreate(true);
        }
    } else {
        // If there was an error, for any reason, tell the activity manager to stop us.
        try {
            ActivityTaskManager.getService()
                    .finishActivity(r.token, Activity.RESULT_CANCELED, null,
                            Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
    }
    return a;
}

看下reportSizeConfigurations()这个方法。

private void reportSizeConfigurations(ActivityClientRecord r) {
    // 这里通知了ActivityTaskManagerService去获取ActivityRecord
    try {
        ActivityTaskManager.getService().reportSizeConfigurations(r.token,
                horizontal.copyKeys(), vertical.copyKeys(), smallest.copyKeys());
    } catch (RemoteException ex) {
        throw ex.rethrowFromSystemServer();
    }
}

ActivityTaskManagerService#reportSizeConfigurations()

@Override
public void reportSizeConfigurations(IBinder token, int[] horizontalSizeConfiguration,
        int[] verticalSizeConfigurations, int[] smallestSizeConfigurations) {
    if (DEBUG_CONFIGURATION) Slog.v(TAG, "Report configuration: " + token + " "
            + horizontalSizeConfiguration + " " + verticalSizeConfigurations);
    synchronized (mGlobalLock) {
        ActivityRecord record = ActivityRecord.isInStackLocked(token);
        // 若ActivityRecord 为 null, 则throw出我们Bugly所记录的异常。
        if (record == null) {
            throw new IllegalArgumentException("reportSizeConfigurations: ActivityRecord not "
                    + "found for: " + token);
        }
        record.setSizeConfigurations(horizontalSizeConfiguration, verticalSizeConfigurations,
                smallestSizeConfigurations);
    }
}

static ActivityRecord isInStackLocked(IBinder token) {
    // 根据Token来获取ActivityRecord对象 
    final ActivityRecord r = ActivityRecord.forTokenLocked(token);
    return (r != null) ? r.getActivityStack().isInStackLocked(r) : null;
}

private static @Nullable ActivityRecord tokenToActivityRecordLocked(Token token) {
    if (token == null) {
        return null;
    }
    // 从弱引用中获取ActivityRecord
    ActivityRecord r = token.weakActivity.get();
    if (r == null || r.getActivityStack() == null) {
        return null;
    }
    return r;
}

// Token 继承了 Stub  我们知道Stub 是跨进程通信的，并且实现了IBinder接口。
static class Token extends IApplicationToken.Stub {
    // 弱引用 ActivityRecord
    private final WeakReference<ActivityRecord> weakActivity;
    private final String name;
    Token(ActivityRecord activity, Intent intent) {
        weakActivity = new WeakReference<>(activity);
        name = intent.getComponent().flattenToShortString();
    }
    private static @Nullable ActivityRecord tokenToActivityRecordLocked(Token token) {
        if (token == null) {
            return null;
        }
        ActivityRecord r = token.weakActivity.get();
        if (r == null || r.getActivityStack() == null) {
            return null;
        }
        return r;
    }
}

因此产生这个问题的原因就是再执行Activity启动的时候，根据Token 去获取ActivityRecord对象，但是这个对象为空，所以会抛出该异常。暂时该问题还不知道源头怎么解决，所以我的处理方式就是直接将reportSizeConfigurations()这个方法通过动态代理进行异常捕捉。

解决办法

private void fixReportSizeConfigurationsException() {
    if (Build.VERSION.SDK_INT != Build.VERSION_CODES.P) {
        return;
    }
    try {
        // 反射拿到ActivityManager
        Field activityManager = ActivityManager.class.getDeclaredField("IActivityManagerSingleton");
        activityManager.setAccessible(true);
        Object iActivityManagerSingleton = activityManager.get(null);
        if (iActivityManagerSingleton == null) {
            return;
        }
        Class<?> singletonCls = iActivityManagerSingleton.getClass().getSuperclass();
        if (singletonCls == null){
            return;
        }
        Field instance = singletonCls.getDeclaredField("mInstance");
        instance.setAccessible(true);
        Object iActivityManager = instance.get(iActivityManagerSingleton);
        @SuppressLint("PrivateApi")
        Class<?> iActivityManagerCls = Class.forName("android.app.IActivityManager");
        Class<?>[] classes = {iActivityManagerCls};
        Object iActivityManageProxy = Proxy.newProxyInstance(
                iActivityManagerCls.getClassLoader(),
                classes,
                new IActivityManagerProxy(iActivityManager));
        instance.set(iActivityManagerSingleton, iActivityManageProxy);
    } catch (NoSuchFieldException | IllegalAccessException | ClassNotFoundException e) {
        e.printStackTrace();
    }
}
/**
 * 动态代理处理 try catch  ATMS #ActivityTaskManager#reportSizeConfigurations()方法
 */
private static class IActivityManagerProxy implements InvocationHandler {
    private Object mIActivityManager;
    public IActivityManagerProxy(Object iActivityManager) {
        mIActivityManager = iActivityManager;
    }
    @Override
    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
        if ("reportSizeConfigurations".equals(method.getName())) {
            try {
                Log.w(TAG, "reportSizeConfigurations invoke execute ");
                return method.invoke(mIActivityManager, args);
            } catch (Exception e) {
                Log.w(TAG, "reportSizeConfigurations exception: " + e.getMessage());
                return null;
            }
        }
        return method.invoke(mIActivityManager, args);
    }
}