javaObjectForIBinder查看

在应用中多次调用serviveManage.getService(String name)  方法并不会一直造成BinderProxy对象的创建，因为底层会复用proxy对象，

我们可以通过dumpsys meminfo <PID> 来进行查看binder对象的信息。

proxy对象的获取和复用，其实是javaObjectForIBinder里实现的

 

javaObjectForIBinder

vi frameworks/base/core/jni/android_util_Binder.cpp

 

jobject javaObjectForIBinder(JNIEnv* env, const sp<IBinder>& val)

{

    if (val == NULL) return NULL;

// val为sp<JavaBBinder>类型时

    if (val->checkSubclass(&gBinderOffsets)) {

        // One of our own!

         //注意，这里是.get方法，是sp的get方法，返回JavaBBinder*指针，再调用object()，得到addService操作时添加的服务对象，并返回该对象

        jobject object = static_cast<JavaBBinder*>(val.get())->object();

        LOGDEATH("objectForBinder %p: it's our own %p!\n", val.get(), object);

        return object;

    }

    // For the rest of the function we will hold this lock, to serialize

    // looking/creation/destruction of Java proxies for native Binder proxies.

    AutoMutex _l(mProxyLock);

    // Someone else's...  do we know about it?

    jobject object = (jobject)val->findObject(&gBinderProxyOffsets);

    if (object != NULL) {

        jobject res = jniGetReferent(env, object);

        if (res != NULL) {

            ALOGV("objectForBinder %p: found existing %p!\n", val.get(), res);

            return res;

        }

        LOGDEATH("Proxy object %p of IBinder %p no longer in working set!!!", object, val.get());

        android_atomic_dec(&gNumProxyRefs);

        val->detachObject(&gBinderProxyOffsets);

        env->DeleteGlobalRef(object);

    }

//创建BinderProxy对象

    object = env->NewObject(gBinderProxyOffsets.mClass, gBinderProxyOffsets.mConstructor);

    if (object != NULL) {

        LOGDEATH("objectForBinder %p: created new proxy %p !\n", val.get(), object);

        // The proxy holds a reference to the native object.

//进行相互关联操作

        env->SetLongField(object, gBinderProxyOffsets.mObject, (jlong)val.get());

        val->incStrong((void*)javaObjectForIBinder);

        // The native object needs to hold a weak reference back to the

        // proxy, so we can retrieve the same proxy if it is still active.

        jobject refObject = env->NewGlobalRef(

                env->GetObjectField(object, gBinderProxyOffsets.mSelf));

        val->attachObject(&gBinderProxyOffsets, refObject,

                jnienv_to_javavm(env), proxy_cleanup);

        // Also remember the death recipients registered on this proxy

        sp<DeathRecipientList> drl = new DeathRecipientList;

        drl->incStrong((void*)javaObjectForIBinder);

        env->SetLongField(object, gBinderProxyOffsets.mOrgue, reinterpret_cast<jlong>(drl.get()));

        // Note that a new object reference has been created.

        android_atomic_inc(&gNumProxyRefs);

        incRefsCreated(env);

    }

    return object;

}

sp<IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj)

{

    if (obj == NULL) return NULL;

//如果是Binder类及其子类

    if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) {

        JavaBBinderHolder* jbh = (JavaBBinderHolder*)

            env->GetLongField(obj, gBinderOffsets.mObject);

        return jbh != NULL ? jbh->get(env, obj) : NULL;

    }

//如果是BinderProxy类及其子类，在c-AMS-s的过程中会传BinderProxy

    if (env->IsInstanceOf(obj, gBinderProxyOffsets.mClass)) {

        return (IBinder*)

            env->GetLongField(obj, gBinderProxyOffsets.mObject);

    }

    ALOGW("ibinderForJavaObject: %p is not a Binder object", obj);

    return NULL;

}

 

kernel-3.18/drivers/staging/android/binder.c

static void binder_transaction(struct binder_proc *proc,

                              struct binder_thread *thread,

                              struct binder_transaction_data *tr, int reply)

{

… …

case BINDER_TYPE_WEAK_HANDLE: {

       struct binder_ref *ref = binder_get_ref(proc, fp->handle);

 

       if (ref == NULL) {

              binder_user_error("%d:%d got transaction with invalid handle, %d\n",

                            proc->pid,

                            thread->pid, fp->handle);

              return_error = BR_FAILED_REPLY;

              goto err_binder_get_ref_failed;

       }

       if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {

              return_error = BR_FAILED_REPLY;

              goto err_binder_get_ref_failed;

       }

//如果client端和target端在同一个进程中

       if (ref->node->proc == target_proc) {

              if (fp->type == BINDER_TYPE_HANDLE)

                     fp->type = BINDER_TYPE_BINDER;

              else

                     fp->type = BINDER_TYPE_WEAK_BINDER;

              fp->binder = ref->node->ptr;

              fp->cookie = ref->node->cookie;

              binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL);

              trace_binder_transaction_ref_to_node(t, ref);

              binder_debug(BINDER_DEBUG_TRANSACTION,

                          "        ref %d desc %d -> node %d u%016llx\n",

                          ref->debug_id, ref->desc, ref->node->debug_id,

                          (u64)ref->node->ptr);

       } else {

              … …

       }

} break;

 

case BINDER_TYPE_FD: {

… …

}