global reference table overflow

https://blog.youkuaiyun.com/a396604593/article/details/105771093

ErrorLog:

    04-26 18:20:16.112 12201 12201 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
    04-26 18:20:16.112 12201 12201 F DEBUG   : Build fingerprint:
    'htc/ocmdugl_00401/htc_ocmdugl:9/PQ2A.190205.003/1076299.1:user/release-keys'
    04-26 18:20:16.113 12201 12201 F DEBUG   : Revision: '0'
    04-26 18:20:16.113 12201 12201 F DEBUG   : ABI: 'arm64'
    04-26 18:20:16.113 12201 12201 F DEBUG   : pid: 1773, tid: 7880, name: Binder:1773_20  >>> system_server <<<
    04-26 18:20:16.113 12201 12201 F DEBUG   : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
    04-26 18:20:16.113 12201 12201 F DEBUG   : Abort message: 'java_vm_ext.cc:676] JNI ERROR (app bug): global reference table
    overflow (max=51200)global reference table dump:'

1、百度搜索global reference table overflow (max=51200)

JNI层coding经常会遇到ReferenceTable overflow（引用表溢出造成的崩溃）问题，特别是当jni函数被反复调用上千上万次的时候。

2、log中搜索java_vm_ext.cc:676发现

48560 of com.android.server.am.PendingIntentRecord (48560 unique instances)

max=51200,而PendingIntentRecord就有 48560个。

这时如果能抓取system_server的hprof文件进行查看，会很方便的看出哪个对象导致的内存溢出。

3、如果没有hprof文件，只看log文件。

从上述log中得到pid: 1773, tid: 7880, name: Binder:1773_20，在log中

搜索Binder:1773_20:

…

04-26 18:20:15.119  1773  7880 F system_server: runtime.cc:558] "Binder:1773_20" prio=5 tid=135 Runnable

…

查看log发现

    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at android.os.Parcel.nativeWriteStrongBinder(Native method)
    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at ndroid.os.Parcel.writeStrongBinder(Parcel.java:737)
    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at android.app.IActivityManager$Stub.onTransact$getIntentSender$(IActivityManager.java:10438)
    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:775)
    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:3435)
    04-26 18:20:15.121  1773  7880 F system_server: runtime.cc:558]   at android.os.Binder.execTransact(Binder.java:740)

发现bind相关操作导致，这个是导致崩溃的最后一根稻草

4、搜索7880，
发现activityManager多次bindService、unbindService。

导致system_server的内存溢出。

源码分析:

JNI ERROR (app bug): global reference table overflow (max=51200)

全局引用表溢出,说明全局对象个数太多

报错的行数java_vm_ext.cc:676

相关代码:

    jobject JavaVMExt::AddGlobalRef(Thread* self, ObjPtr<mirror::Object> obj) {
      // Check for null after decoding the object to handle cleared weak globals.
      if (obj == nullptr) {
        return nullptr;
      }
      IndirectRef ref;
      std::string error_msg;
      {
        WriterMutexLock mu(self, *Locks::jni_globals_lock_);
        ref = globals_.Add(kIRTFirstSegment, obj, &error_msg);//error_msg的来源
      }
      if (UNLIKELY(ref == nullptr)) {
        LOG(FATAL) << error_msg;//报错的行数
        UNREACHABLE();
      }
      CheckGlobalRefAllocationTracking();
      return reinterpret_cast<jobject>(ref);
    }

可以看出是globals_.Add中出了问题

indirect_reference_table.cc#Add中

    if (top_index == max_entries_) {//下标是否达到最大值
        if (resizable_ == ResizableCapacity::kNo) {//是否可以调整表的容量
          std::ostringstream oss;
          oss << "JNI ERROR (app bug): " << kind_ << " table overflow "
              << "(max=" << max_entries_ << ")"
              << MutatorLockedDumpable<IndirectReferenceTable>(*this);
          *error_msg = oss.str();
          return nullptr;
    }

其中max_entries_当前值定义为51200, java_vm_ext.cc中定义了最大值如下:

static constexpr size_t kGlobalsMax = 51200;  // Arbitrary sanity check. (Must fit in 16 bits.)

每个Binder实体在jni层都会对应一个JavaBBinder实例.

bindServer时,为什么在art中会存在一个全局引用对象?

调用过程

<1>writeStrongBinder(IBinder val)

<2>android_os_Parcel_writeStrongBinder()

<3>ibinderForJavaObject(env, object)

<4> JavaBBinderHolder::get(env, obj)

<5> new JavaBBinder(env, obj);

<6> mObject(env->NewGlobalRef(object)

<7> JNI::NewGlobalRef()

<8> art::JavaVMExt::AddGlobalRef()

<9> art::IndirectReferenceTable::Add()

参考链接:

问题分析过程:

https://www.jianshu.com/p/bcc5462a78ce

https://blog.youkuaiyun.com/chi_wy/article/details/83104748

抓取hprof文件:

https://blog.youkuaiyun.com/happy_develop_/article/details/79099227

bindService启动Service与Binder服务实体的流程:android-N的

https://www.jianshu.com/p/9128f1b65586

jni文档:

https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html
————————————————
版权声明：本文为优快云博主「纵容_伊人倩影」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.youkuaiyun.com/a396604593/article/details/105771093