app crash问题系统侧分析方法_held mutexes= "abort lock-优快云博客

本文链接：https://blog.youkuaiyun.com/yimelancholy/article/details/131708385

event log

关键日志
am_crash
如：

am_crash: [12763,0,com.bilibili.priconne,988298820,java.lang.Error,signal 6 (SIGABRT), code -1 (?), fault addr --------

12763为应用进程号，通过这个进程号我们可以在android log中找异常的关键信息

crash日志

通过进程号找到对应crash日志
如：

07-06 22:55:51.628 12763 13066 E AndroidRuntime: Process: com.bilibili.priconne, PID: 12763
07-06 22:55:51.628 12763 13066 E AndroidRuntime: java.lang.Error: signal 6 (SIGABRT), code -1 (?), fault addr --------
07-06 22:55:51.628 12763 13066 E AndroidRuntime: pid: 12763, tid: 13300, name: Thread-22  >>> com.bilibili.priconne <<<
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x0   0000000000000000  x1   00000000000033f4  x2   0000000000000006  x3   00000077d7942d80
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x4   40110546735c0a02  x5   40110546735c0a02  x6   40110546735c0a02  x7   020a5cffffffffff
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x8   00000000000000f0  x9   00000079198aab70  x10  0000000000000001  x11  000000791991f308
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x12  0000007797ce2c30  x13  00000000019c7478  x14  00000000019c7338  x15  ffffffffffffffff
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x16  000000791998aa58  x17  0000007919962f90  x18  0000000000000002  x19  00000000000031db
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x20  00000000000033f4  x21  00000000ffffffff  x22  0000000000000000  x23  0000007871cb6932
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x24  0000007871c98cfd  x25  0000007871ca4ded  x26  000000005a000000  x27  00000077d7944000
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     x28  00000077d7944000  x29  00000077d7942e00  x30  0000007919910288
07-06 22:55:51.628 12763 13066 E AndroidRuntime:     sp   00000077d7942d60  pc   00000079199102b4  pstate 0000000000001000
07-06 22:55:51.628 12763 13066 E AndroidRuntime: 
07-06 22:55:51.628 12763 13066 E AndroidRuntime: 	at [vdso].(:0)
07-06 22:55:51.628 12763 13066 E AndroidRuntime: 	at libc.abort(abort:164)

这份log是没打印全的情况，但我们可以看到最后一行的AndroidRuntime: at libc.abort(abort:164)
找到对应Aborting thread相关log

	Line 1084112: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678] Aborting thread:
	Line 1084113: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678] "Thread-22" prio=5 tid=93 Runnable
	Line 1084114: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   | group="" sCount=0 ucsCount=0 flags=0 obj=0x14f9a9f0 self=0x779835bc00
	Line 1084115: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   | sysTid=13300 nice=8 cgrp=top-app sched=0/0 handle=0x77d7943cb0
	Line 1084116: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   | state=R schedstat=( 549764653 882413838 30783 ) utm=30 stm=24 core=7 HZ=100
	Line 1084117: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   | stack=0x77d784c000-0x77d784e000 stackSize=991KB
	Line 1084118: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   | held mutexes= "abort lock" "mutator lock"(shared held)
	Line 1084119: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #00 pc 00000000005624ac  /apex/com.android.art/lib64/libart.so (art::DumpNativeStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, int, BacktraceMap*, char const*, art::ArtMethod*, void*, bool)+152) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084120: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #01 pc 0000000000664340  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, bool, BacktraceMap*, bool) const+344) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084121: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #02 pc 0000000000631084  /apex/com.android.art/lib64/libart.so (art::AbortState::DumpThread(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, art::Thread*) const+72) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084122: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #03 pc 0000000000630ce8  /apex/com.android.art/lib64/libart.so (art::AbortState::Dump(std::__1::basic_ostream<char, std::__1::char_traits<char> >&) const+456) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084123: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #04 pc 000000000061b1f0  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort(char const*)+1272) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084124: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #05 pc 0000000000017114  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter(std::__1::function<void (char const*)>&&)::$_3::__invoke(char const*)+84) (BuildId: ef369bfbad96b532c6d8e0b144a68b96)
	Line 1084125: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #06 pc 0000000000016648  /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage()+356) (BuildId: ef369bfbad96b532c6d8e0b144a68b96)
	Line 1084126: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #07 pc 00000000006694f4  /apex/com.android.art/lib64/libart.so (art::Thread::AssertNoPendingException() const+1572) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084127: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #08 pc 00000000002a4424  /apex/com.android.art/lib64/libart.so (art::ClassLinker::FindClass(art::Thread*, char const*, art::Handle<art::mirror::ClassLoader>)+68) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084128: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #09 pc 0000000000465158  /apex/com.android.art/lib64/libart.so (art::JNI<false>::FindClass(_JNIEnv*, char const*)+1016) (BuildId: 21cdec58d836b96df5a87c25ec6cd8fa)
	Line 1084129: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #10 pc 0000000000048c88  /system/lib64/libmedia_jni.so (android::createCodecException(_JNIEnv*, int, int, char const*)+76) (BuildId: 65e4835dedc013bafc3e216c1b56303a)
	Line 1084130: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #11 pc 0000000000050d98  /system/lib64/libmedia_jni.so (throwExceptionAsNecessary(_JNIEnv*, int, int, char const*, android::sp<android::ICrypto> const&)+184) (BuildId: 65e4835dedc013bafc3e216c1b56303a)
	Line 1084131: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #12 pc 000000000004b47c  /system/lib64/libmedia_jni.so (android_media_MediaCodec_queueInputBuffer(_JNIEnv*, _jobject*, int, int, int, long, int)+456) (BuildId: 65e4835dedc013bafc3e216c1b56303a)
	Line 1084132: 07-06 22:55:51.362 12763 13300 F libili.priconne: runtime.cc:678]   native: #13 pc 00000000001b1094  /system/framework/arm64/boot-framework.oat (art_jni_trampoline+116) (BuildId: 6736b0eab3fb0a539c2312b1dfe4af5ab8e414a4)

从日志中可以发现，似乎是MediaCodec有异常，从而去看看常规log

再例如某个应用有如下堆栈信息：

10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694] "main" prio=5 tid=1 Runnable
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   | group="" sCount=0 ucsCount=0 flags=0 obj=0x737ca4c8 self=0xb400007b433a52c0
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   | sysTid=25141 nice=0 cgrp=top-app sched=1073741825/1 handle=0x7c4cf944f8
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   | state=R schedstat=( 238385943 915052 79 ) utm=14 stm=9 core=6 HZ=100
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   | stack=0x7ff31a9000-0x7ff31ab000 stackSize=8188KB
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   | held mutexes= "abort lock" "mutator lock"(shared held)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #00 pc 00568ee8  /apex/com.android.art/lib64/libart.so (art::DumpNativeStack+176) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #01 pc 00688a50  /apex/com.android.art/lib64/libart.so (art::Thread::DumpStack const+344) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #02 pc 006a7088  /apex/com.android.art/lib64/libart.so (art::DumpCheckpoint::Run+920) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #03 pc 006a11e8  /apex/com.android.art/lib64/libart.so (art::ThreadList::RunCheckpoint+1008) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #04 pc 006a0204  /apex/com.android.art/lib64/libart.so (art::ThreadList::Dump+1416) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #05 pc 0064a838  /apex/com.android.art/lib64/libart.so (art::AbortState::Dump const+232) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #06 pc 00633398  /apex/com.android.art/lib64/libart.so (art::Runtime::Abort+1544) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #07 pc 000193c8  /apex/com.android.art/lib64/libbase.so (android::base::SetAborter::$_0::__invoke+84) (BuildId: 9a988d17d758075a325528226085af86)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #08 pc 000188dc  /apex/com.android.art/lib64/libbase.so (android::base::LogMessage::~LogMessage+356) (BuildId: 9a988d17d758075a325528226085af86)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #09 pc 002842e0  /apex/com.android.art/lib64/libart.so (art::ClassLinker::ResolveMethodExceptionHandlerTypes+1204) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #10 pc 0028318c  /apex/com.android.art/lib64/libart.so (art::ClassLinker::VerifyClass+1808) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #11 pc 00286898  /apex/com.android.art/lib64/libart.so (art::ClassLinker::InitializeClass+748) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #12 pc 002663b8  /apex/com.android.art/lib64/libart.so (art::ClassLinker::EnsureInitialized+164) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)
10-20 21:08:52.334 25141 25141 F .mobileplatform: runtime.cc:694]   native: #13 pc 005864b0  /apex/com.android.art/lib64/libart.so (art::Class_newInstance +1624) (BuildId: 686fc4abc0dc7a1e2199cb9c64d4e32e)

堆栈信息中有ResolveMethodExceptionHandlerTypes，说明应用不兼容当前系统版本，需要应用适配

android log

接着前面进程为12763的应用分析

07-06 22:55:51.284 12763 13642 E MediaCodec: Codec reported err 0xfffffff4/NO_MEMORY, actionCode 0, while in state 5/STARTING
07-06 22:55:51.284 12763 13642 D MediaCodec: flushMediametrics
07-06 22:55:51.284 12763 13642 D SurfaceUtils: disconnecting from surface 0x77e662a010, reason disconnectFromSurface
07-06 22:55:51.288 12763 13300 F libili.priconne: thread.cc:2468] No pending exception expected: android.media.MediaCodec$CodecException: start failed
07-06 22:55:51.288 12763 13300 F libili.priconne: thread.cc:2468]   at void android.media.MediaCodec.native_start() (MediaCodec.java:-2)
07-06 22:55:51.288 12763 13300 F libili.priconne: thread.cc:2468]   at void android.media.MediaCodec.start() (MediaCodec.java:2334)

有MediaCodec异常，且进程号为12763

tips

查看堆栈在对应代码第几行
在编译过全仓的代码根目录下运行命令
./prebuilts/clang/host/linux-x86/llvm-binutils-stable/llvm-addr2line -f -e out/target/product/emulator_x86_64/symbols/system/lib64/libaudiopolicyservice.so 000000000004ecb0

其中out/target/product/qssi/symbols/system/lib64/libaudiopolicyservice.so 000000000004ecb0
前半部分out/target/product/emulator_x86_64/symbols替换为对应的out目录下symbols的路径
在这里插入图片描述

后半部分system/lib64/libaudiopolicyservice.so 000000000004ecb0替换为对应堆栈的信息
例如堆栈中打印
libili.priconne: runtime.cc:678] native: #12 pc 000000000004b47c /system/lib64/libmedia_jni.so (android_media_MediaCodec_queueInputBuffer(_JNIEnv*, _jobject*, int, int, int, long, int)+456) (BuildId: 65e4835dedc013bafc3e216c1b56303a)

则替换为/system/lib64/libmedia_jni.so 000000000004b47c