Android Java crash 处理流程详解

一、背景
二、App端Crash注册
2.1 commonInit()
2.2 KillApplicationHandler 类
2.2.1 ensureLogging()
2.2.2 ApplicationErrorReport
三、AMS端处理崩溃逻辑
3.1 AMS.handleApplicationCrash
3.1.1 AMS.handleApplicationCrashInner()
3.2 addErrorToDropBox()
3.3 AppErrors.crashApplication()
3.3.1 AppErrors.crashApplicationInner()
3.4 makeAppCrashingLocked()
3.4.1 ProcessRecord.startAppProblemLocked()
3.4.2 WindowProcessController.stopFreezingActivities()
3.4.3 handleAppCrashLocked()
3.5 小结
四、 mUiHandler发送 SHOW_ERROR_UI_MSG
4.1 handleShowAppErrorUi()
4.2 Process.killProcess()
五、Binder服务死亡通知
5.1 AMS.attachApplicationLocked()
5.2 AppDeathRecipient.binderDied()
5.2.1 appDiedLocked()
5.2.2 handleAppDiedLocked()
5.3 cleanUpApplicationRecordLocked()
5.4 atms.handleAppDied()
小结

一、背景

当Android系统发生native crash时，在日志台打印日志和生成tombstone_xxx文件，会通过 socket 通知 AMS 从而进入到Java crash侧处理流程中。同时，当发生Java crash时，系统会捕捉到该crash，从而也进入到Java crash的处理流程。

由此可见，Java crash处理流程是非常重要的。 native crash流程上篇文章已经分析过了，今天再来看看Java crash的处理流程。

二、App端Crash注册

不管是系统进程还是App进程，启动的时候都会走到这里。

2.1 commonInit()

RuntimeInit.java

 
@UnsupportedAppUsage
protected static final void commonInit() {
    if (DEBUG) Slog.d(TAG, "Entered RuntimeInit!");
    LoggingHandler loggingHandler = new LoggingHandler();
    RuntimeHooks.setUncaughtExceptionPreHandler(loggingHandler);
    // 注册处理器
    Thread.setDefaultUncaughtExceptionHandler(new KillApplicationHandler(loggingHandler));
}

注册 杀掉App进程的处理器 KillApplicationHandler 。

2.2 KillApplicationHandler 类

 
private static class KillApplicationHandler implements Thread.UncaughtExceptionHandler {
    private final LoggingHandler mLoggingHandler;
    /**
     * Create a new KillApplicationHandler that follows the given LoggingHandler.
     * If {@link #uncaughtException(Thread, Throwable) uncaughtException} is called
     * on the created instance without {@code loggingHandler} having been triggered,
     * {@link LoggingHandler#uncaughtException(Thread, Throwable)
     * loggingHandler.uncaughtException} will be called first.
     *
     * @param loggingHandler the {@link LoggingHandler} expected to have run before
     *     this instance's {@link #uncaughtException(Thread, Throwable) uncaughtException}
     *     is being called.
     */
    public KillApplicationHandler(LoggingHandler loggingHandler) {
        this.mLoggingHandler = Objects.requireNonNull(loggingHandler);
    }
    @Override
    public void uncaughtException(Thread t, Throwable e) {
        try {
            // 在日志台打印崩溃时的日志
            ensureLogging(t, e);
            // Don't re-enter -- avoid infinite loops if crash-reporting crashes.
            if (mCrashing) return;
            mCrashing = true;
            // Try to end profiling. If a profiler is running at this point, and we kill the
            // process (below), the in-memory buffer will be lost. So try to stop, which will
            // flush the buffer. (This makes method trace profiling useful to debug crashes.)
            if (ActivityThread.currentActivityThread() != null) {
                ActivityThread.currentActivityThread().stopProfiling();
            }
            // Bring up crash dialog, wait for it to be dismissed
            //弹出奔溃对话框 
            ActivityManager.getService().handleApplicationCrash(
                    mApplicationObject, new ApplicationErrorReport.ParcelableCrashInfo(e));
        } catch (Throwable t2) {
            if (t2 instanceof DeadObjectException) {
                // System process is dead; ignore
            } else {
                try {
                    Clog_e(TAG, "Error reporting crash", t2);
                } catch (Throwable t3) {
                    // Even Clog_e() fails!  Oh well.
                }
            }
        } finally {
            // Try everything to make sure this process goes away.
            // 最终关闭kill调进程
            Process.killProcess(Process.myPid());
            System.exit(10);
        }
    }
     private void ensureLogging(Thread t, Throwable e) {
            if (!mLoggingHandler.mTriggered) {
                try {
                    mLoggingHandler.uncaughtException(t, e);
                } catch (Throwable loggingThrowable) {
                    // Ignored.
                }
            }
        }
}

职责：

在日志台打印崩溃日志
调用 AMS的handleApplicationCrash()方法
在finally中杀掉App进程

2.2.1 ensureLogging()

内部调用了 LoggingHandler.uncaughtException()方法。LoggingHandler 也实现了 Thread.UncaughtExceptionHandler接口。重写了 uncaughtException() 方法。

 
private static class LoggingHandler implements Thread.UncaughtExceptionHandler {
    public volatile boolean mTriggered = false;
    @Override
    public void uncaughtException(Thread t, Throwable e) {
        mTriggered = true;
        // Don't re-enter if KillApplicationHandler has already run
        if (mCrashing) return;
        // mApplicationObject is null for non-zygote java programs (e.g. "am")
        // There are also apps running with the system UID. We don't want the
        // first clause in either of these two cases, only for system_server.
        if (mApplicationObject == null && (Process.SYSTEM_UID == Process.myUid())) {
            Clog_e(TAG, "*** FATAL EXCEPTION IN SYSTEM PROCESS: " + t.getName(), e);
        } else {
        // 准备拼接 FATAL EXCEPTION ，打印到控制台
            StringBuilder message = new StringBuilder();
            //
            // The "FATAL EXCEPTION" string is still used on Android even though
            // apps can set a custom UncaughtExceptionHandler that renders uncaught
            // exceptions non-fatal.
            message.append("FATAL EXCEPTION: ").append(t.getName()).append("\n");
            final String processName = ActivityThread.currentProcessName();
            if (processName != null) {
            // 拼上进程名字
                message.append("Process: ").append(processName).append(", ");
            }
            // 进程id
            message.append("PID: ").append(Process.myPid());
            // 打印message和 e异常信息
            Clog_e(TAG, message.toString(), e);
        }
    }
}

拼接 FATAL EXCEPTION 开头的字符串，同时打印崩溃的信息。

因此，可以通过过滤出 FATAL EXCEPTION精准定位崩溃的日志。

2.2.2 ApplicationErrorReport

new ApplicationErrorReport.ParcelableCrashInfo(e) 创建了一个crashinfo对象。这个对象其实就是从throwable中解析得到的。

App端打印了日志后，就进入到AMS端的处理逻辑中。

三、AMS端处理崩溃逻辑

3.1 AMS.handleApplicationCrash

 
public void handleApplicationCrash(IBinder app,
        ApplicationErrorReport.ParcelableCrashInfo crashInfo) {
     //找到 ProcessRecord对象
    ProcessRecord r = findAppProcess(app, "Crash");
    // app=null，表示system_server进程
    final String processName = app == null ? "system_server"
            : (r == null ? "unknown" : r.processName);
    handleApplicationCrashInner("crash", r, processName, crashInfo);
}

该方法是 RuntimeInit用来上报app崩溃时调用。当这个方法返回后，App进程将会退出。

找出崩溃进程对应的 ProcessRecord对象，如果app为空，则是system server进程。
继续调用 handleApplicationCrashInner()。

3.1.1 AMS.handleApplicationCrashInner()

 
/* Native crash reporting uses this inner version because it needs to be somewhat
 * decoupled from the AM-managed cleanup lifecycle
 */
void handleApplicationCrashInner(String eventType, ProcessRecord r, String processName,
        ApplicationErrorReport.CrashInfo crashInfo) {
   // ...
    final int relaunchReason = r == null ? RELAUNCH_REASON_NONE
                    : r.getWindowProcessController().computeRelaunchReason();
    final String relaunchReasonString = relaunchReasonToString(relaunchReason);
    if (crashInfo.crashTag == null) {
        crashInfo.crashTag = relaunchReasonString;
    } else {
        crashInfo.crashTag = crashInfo.crashTag + " " + relaunchReasonString;
    }
    // 1 写入崩溃信息到Dropbox
    addErrorToDropBox(
            eventType, r, processName, null, null, null, null, null, null, crashInfo);
    // 2 调用mAppErrors 的crashApplication方法
    mAppErrors.crashApplication(r, crashInfo);
}

这个方法不仅Java crash回调，Native crash也会通过AMS的之前注册的socket服务，调用到这里。可以参考Native crash流程。

写入崩溃信息到Dropbox
继续调用 mAppErrors 的 crashApplication() 。

3.2 addErrorToDropBox()

把crash、WTF、ANR的描述写到drop box中。

 
public void addErrorToDropBox(String eventType,
        ProcessRecord process, String processName, String activityShortComponentName,
        String parentShortComponentName, ProcessRecord parentProcess,
        String subject, final String report, final File dataFile,
        final ApplicationErrorReport.CrashInfo crashInfo) {
    // Bail early if not published yet
    if (ServiceManager.getService(Context.DROPBOX_SERVICE) == null) return;
    // 获取 DBMS服务
    final DropBoxManager dbox = mContext.getSystemService(DropBoxManager.class);
    // Exit early if the dropbox isn't configured to accept this report type.
    // 确定错误类型
    final String dropboxTag = processClass(process) + "_" + eventType;
    if (dbox == null || !dbox.isTagEnabled(dropboxTag)) return;
    // Rate-limit how often we're willing to do the heavy lifting below to
    // collect and record logs; currently 5 logs per 10 second period.
    final long now = SystemClock.elapsedRealtime();
    if (now - mWtfClusterStart > 10 * DateUtils.SECOND_IN_MILLIS) {
        mWtfClusterStart = now;
        mWtfClusterCount = 1;
    } else {
        if (mWtfClusterCount++ >= 5) return;
    }
    // 开始拼接错误信息
    final StringBuilder sb = new StringBuilder(1024);
    appendDropBoxProcessHeaders(process, processName, sb);
    if (process != null) {
        // 是否前台
        sb.append("Foreground: ")
                .append(process.isInterestingToUserLocked() ? "Yes" : "No")
                .append("\n");
    }
    if (activityShortComponentName != null) {
        sb.append("Activity: ").append(activityShortComponentName).append("\n");
    }
    if (parentShortComponentName != null) {
        if (parentProcess != null && parentProcess.pid != process.pid) {
            sb.append("Parent-Process: ").append(parentProcess.processName).append("\n");
        }
        if (!parentShortComponentName.equals(activityShortComponentName)) {
            sb.append("Parent-Activity: ").append(parentShortComponentName).append("\n");
        }
    }
    if (subject != null) {
        sb.append("Subject: ").append(subject).append("\n");
    }
    sb.append("Build: ").append(Build.FINGERPRINT).append("\n");
    if (Debug.isDebuggerConnected()) {
        sb.append("Debugger: Connected\n");
    }
    if (crashInfo != null && crashInfo.crashTag != null && !crashInfo.crashTag.isEmpty()) {
        sb.append("Crash-Tag: ").append(crashInfo.crashTag).append("\n");
    }
    sb.append("\n");
    // Do the rest in a worker thread to avoid blocking the caller on I/O
    // (After this point, we shouldn't access AMS internal data structures.)
    // dump错误信息
    Thread worker = new Thread("Error dump: " + dropboxTag) {
        @Override
        public void run() {
            if (report != null) {
                sb.append(report);
            }
            String setting = Settings.Global.ERROR_LOGCAT_PREFIX + dropboxTag;
            int lines = Settings.Global.getInt(mContext.getContentResolver(), setting, 0);
            int maxDataFileSize = DROPBOX_MAX_SIZE - sb.length()
                    - lines * RESERVED_BYTES_PER_LOGCAT_LINE;
            if (dataFile != null && maxDataFileSize > 0) {
                try {
                    sb.append(FileUtils.readTextFile(dataFile, maxDataFileSize,
                                "\n\n[[TRUNCATED]]"));
                } catch (IOException e) {
                    Slog.e(TAG, "Error reading " + dataFile, e);
                }
            }
            if (crashInfo != null && crashInfo.stackTrace != null) {
                sb.append(crashInfo.stackTrace);
            }
            if (lines > 0) {
                sb.append("\n");
                // Merge several logcat streams, and take the last N lines
                InputStreamReader input = null;
                try {
                    java.lang.Process logcat = new ProcessBuilder(
                            "/system/bin/timeout", "-k", "15s", "10s",
                            "/system/bin/logcat", "-v", "threadtime", "-b", "events", "-b", "system",
                            "-b", "main", "-b", "crash", "-t", String.valueOf(lines))
                                    .redirectErrorStream(true).start();
                    try { logcat.getOutputStream().close(); } catch (IOException e) {}
                    try { logcat.getErrorStream().close(); } catch (IOException e) {}
                    input = new InputStreamReader(logcat.getInputStream());
                    int num;
                    char[] buf = new char[8192];
                    while ((num = input.read(buf)) > 0) sb.append(buf, 0, num);
                } catch (IOException e) {
                    Slog.e(TAG, "Error running logcat", e);
                } finally {
                    if (input != null) try { input.close(); } catch (IOException e) {}
                }
            }
            dbox.addText(dropboxTag, sb.toString());
        }
    };
    if (process == null) {
        // If process is null, we are being called from some internal code
        // and may be about to die -- run this synchronously.
        final int oldMask = StrictMode.allowThreadDiskWritesMask();
        try {
        // 直接在当前线程执行
            worker.run();
        } finally {
            StrictMode.setThreadPolicyMask(oldMask);
        }
    } else {
        // 开个新的线程执行
        worker.start();
    }
}

dropbox是system-server进程在 StartOtherServices中注册的服务DropBoxManager。它会记录系统的关键log信息，用来debug 调试。在ServiceManager 中的注册名字为 dropbox。 dropbox服务的数据保存在 /data/system/dropbox/中。

dropbox 支持保存的错误类型为：

anr 进程发生未响应
watchdog 进程触发watchdog
crash 进程发生java崩溃
native_crash 进程发生native崩溃
wtf 进程发生严重错误
lowmem 进程内存不足

写入到Dropbox文件后，继续看看 AppErrors.crashApplication()方法：

3.3 AppErrors.crashApplication()

AppErrors.java

 
void crashApplication(ProcessRecord r, ApplicationErrorReport.CrashInfo crashInfo) {
    final int callingPid = Binder.getCallingPid();
    final int callingUid = Binder.getCallingUid();
    final long origId = Binder.clearCallingIdentity();
    try {
        crashApplicationInner(r, crashInfo, callingPid, callingUid);
    } finally {
        Binder.restoreCallingIdentity(origId);
    }
}

3.3.1 AppErrors.crashApplicationInner()

AppErrors.java

 
 void crashApplicationInner(ProcessRecord r, ApplicationErrorReport.CrashInfo crashInfo,
            int callingPid, int callingUid) {
        long timeMillis = System.currentTimeMillis();
        String shortMsg = crashInfo.exceptionClassName;
        String longMsg = crashInfo.exceptionMessage;
        String stackTrace = crashInfo.stackTrace;
        if (shortMsg != null && longMsg != null) {
            longMsg = shortMsg + ": " + longMsg;
        } else if (shortMsg != null) {
            longMsg = shortMsg;
        }
      // ...
        final int relaunchReason = r != null
                ? r.getWindowProcessController().computeRelaunchReason() : RELAUNCH_REASON_NONE;
        AppErrorResult result = new AppErrorResult();
        int taskId;
        synchronized (mService) {
            // ...
             // If we can't identify the process or it's already exceeded its crash quota,
            // quit right away without showing a crash dialog.
            // 继续调用 makeAppCrashingLocked()
            if (r == null || !makeAppCrashingLocked(r, shortMsg, longMsg, stackTrace, data)) {
                return;
            }
            AppErrorDialog.Data data = new AppErrorDialog.Data();
            data.result = result;
            data.proc = r;
            final Message msg = Message.obtain();
            msg.what = ActivityManagerService.SHOW_ERROR_UI_MSG;
            taskId = data.taskId;
            msg.obj = data;
            // 发送消息，弹出crash对话框，等待用户选择
            mService.mUiHandler.sendMessage(msg);
        }
        // 得到用户选择结果
        int res = result.get();
        Intent appErrorIntent = null;
        MetricsLogger.action(mContext, MetricsProto.MetricsEvent.ACTION_APP_CRASH, res);
        // 如果是超时或者取消，则当成是强制退出
        if (res == AppErrorDialog.TIMEOUT || res == AppErrorDialog.CANCEL) {
            res = AppErrorDialog.FORCE_QUIT;
        }
        synchronized (mService) {
            if (res == AppErrorDialog.MUTE) {
                stopReportingCrashesLocked(r);
            }
            // 如果是重新启动
            if (res == AppErrorDialog.RESTART) {
                mService.mProcessList.removeProcessLocked(r, false, true, "crash");
                if (taskId != INVALID_TASK_ID) {
                    try {
                     //1. 从最近的任务列表中找到崩溃进程，再次启动
                        mService.startActivityFromRecents(taskId,
                                ActivityOptions.makeBasic().toBundle());
                    } catch (IllegalArgumentException e) {
                        // Hmm...that didn't work. Task should either be in recents or associated
                        // with a stack.
                        Slog.e(TAG, "Could not restart taskId=" + taskId, e);
                    }
                }
            }
             // 如果是退出
            if (res == AppErrorDialog.FORCE_QUIT) {
                long orig = Binder.clearCallingIdentity();
                try {
                    // Kill it with fire!
                    // 杀掉这个进程
                    mService.mAtmInternal.onHandleAppCrash(r.getWindowProcessController());
                    if (!r.isPersistent()) {
                        mService.mProcessList.removeProcessLocked(r, false, false, "crash");
                        mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
                    }
                } finally {
                    Binder.restoreCallingIdentity(orig);
                }
            }
             // 如果是显示应用信息
            if (res == AppErrorDialog.APP_INFO) {
                appErrorIntent = new Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS);
                appErrorIntent.setData(Uri.parse("package:" + r.info.packageName));
                appErrorIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            }
            if (res == AppErrorDialog.FORCE_QUIT_AND_REPORT) {
                appErrorIntent = createAppErrorIntentLocked(r, timeMillis, crashInfo);
            }
            if (r != null && !r.isolated && res != AppErrorDialog.RESTART) {
                // XXX Can't keep track of crash time for isolated processes,
                // since they don't have a persistent identity.
                mProcessCrashTimes.put(r.info.processName, r.uid,
                        SystemClock.uptimeMillis());
            }
        }
        if (appErrorIntent != null) {
            try {
            // 2. 启动一个系统页面的intent 来显示应用信息
                mContext.startActivityAsUser(appErrorIntent, new UserHandle(r.userId));
            } catch (ActivityNotFoundException e) {
                Slog.w(TAG, "bug report receiver dissappeared", e);
            }
        }
    }

职责：

继续调用 makeAppCrashingLocked()

发送 SHOW_ERROR_UI_MSG 消息，根据错误信息弹出crash对话框，等待用户选择

如果选择重新启动，则从最近任务列表中找到崩溃进程，再次拉起
如果选择强制退出，则杀掉app，进入kill流程
如果选择显示应用信息，则启动系统页面的intent，打开应用详情页面

我们先来看看 makeAppCrashingLocked()方法：

3.4 makeAppCrashingLocked()

 
private boolean makeAppCrashingLocked(ProcessRecord app,
         String shortMsg, String longMsg, String stackTrace, AppErrorDialog.Data data) {
     app.setCrashing(true);
     // 封装崩溃信息到 ProcessErrorStateInfo 中
     app.crashingReport = generateProcessError(app,
             ActivityManager.ProcessErrorStateInfo.CRASHED, null, shortMsg, longMsg, stackTrace);
     // 获取当前user的 error receiver；停止广播接收
     app.startAppProblemLocked();
     // 停是冻结屏幕
     app.getWindowProcessController().stopFreezingActivities();
     // 继续调用 handleAppCrashLocked
     return handleAppCrashLocked(app, "force-crash" /*reason*/, shortMsg, longMsg, stackTrace,
             data);
 }

封装崩溃信息到 ProcessErrorStateInfo 中
获取当前user的 error receiver；停止广播接收
停是冻结屏幕
继续调用 handleAppCrashLocked()

3.4.1 ProcessRecord.startAppProblemLocked()

ProcessRecord.java

 
void startAppProblemLocked() {
  // If this app is not running under the current user, then we can't give it a report button
  // because that would require launching the report UI under a different user.
  errorReportReceiver = null;
  for (int userId : mService.mUserController.getCurrentProfileIds()) {
      if (this.userId == userId) {
      // 找到当前用户的error receiver 
          errorReportReceiver = ApplicationErrorReport.getErrorReportReceiver(
                  mService.mContext, info.packageName, info.flags);
      }
  }
  // 停止接收广播
  mService.skipCurrentReceiverLocked(this);
}
// 
void skipCurrentReceiverLocked(ProcessRecord app) {
  for (BroadcastQueue queue : mBroadcastQueues) {
      queue.skipCurrentReceiverLocked(app);
  }
}
private void skipReceiverLocked(BroadcastRecord r) {
     logBroadcastReceiverDiscardLocked(r);
     // 停止广播接收
     finishReceiverLocked(r, r.resultCode, r.resultData,
             r.resultExtras, r.resultAbort, false);
     scheduleBroadcastsLocked();
 }

找到当前用户的error receiver 最终会返回注册 Intent.ACTION_APP_ERROR的ActivityComponent。
停止接收广播

3.4.2 WindowProcessController.stopFreezingActivities()

WindowProcessController.java

 
public void stopFreezingActivities() {
  synchronized (mAtm.mGlobalLock) {
      int i = mActivities.size();
      while (i > 0) {
          i--;
          //  mActivities存储的类型为 ActivityRecord
          mActivities.get(i).stopFreezingScreenLocked(true);
      }
  }
}

ActivityRecord.stopFreezingScreenLocked()

ActivityRecord.java

 
public void stopFreezingScreenLocked(boolean force) {
  if (force || frozenBeforeDestroy) {
      frozenBeforeDestroy = false;
      if (mAppWindowToken == null) {
          return;
      }
      mAppWindowToken.stopFreezingScreen(true, force);
  }
}

最终调到 AMS的 stopFreezingDisplayLocked() 方法来冻结屏幕。

3.4.3 handleAppCrashLocked()

 
boolean handleAppCrashLocked(ProcessRecord app, String reason,
         String shortMsg, String longMsg, String stackTrace, AppErrorDialog.Data data) {
     final long now = SystemClock.uptimeMillis();
     final boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),
             Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;
     final boolean procIsBoundForeground =
         (app.getCurProcState() == ActivityManager.PROCESS_STATE_BOUND_FOREGROUND_SERVICE);
     // 确定崩溃的时间
     Long crashTime;
     Long crashTimePersistent;
     boolean tryAgain = false;
     if (!app.isolated) {
         crashTime = mProcessCrashTimes.get(app.info.processName, app.uid);
         crashTimePersistent = mProcessCrashTimesPersistent.get(app.info.processName, app.uid);
     } else {
         crashTime = crashTimePersistent = null;
     }
     // Bump up the crash count of any services currently running in the proc.
     // 增加ServiceRecord中crashCount
     for (int i = app.services.size() - 1; i >= 0; i--) {
         // Any services running in the application need to be placed
         // back in the pending list.
         ServiceRecord sr = app.services.valueAt(i);
         // If the service was restarted a while ago, then reset crash count, else increment it.
         if (now > sr.restartTime + ProcessList.MIN_CRASH_INTERVAL) {
             sr.crashCount = 1;
         } else {
             sr.crashCount++;
         }
         // Allow restarting for started or bound foreground services that are crashing.
         // This includes wallpapers.
         if (sr.crashCount < mService.mConstants.BOUND_SERVICE_MAX_CRASH_RETRY
                 && (sr.isForeground || procIsBoundForeground)) {
             tryAgain = true;
         }
     }
      // 同一个进程，如果连续两次崩溃的间隔小于 一分钟，则认为崩溃过于频繁
     if (crashTime != null && now < crashTime + ProcessList.MIN_CRASH_INTERVAL) {
         // The process crashed again very quickly. If it was a bound foreground service, let's
         // try to restart again in a while, otherwise the process loses!
         Slog.w(TAG, "Process " + app.info.processName
                 + " has crashed too many times: killing!");
         EventLog.writeEvent(EventLogTags.AM_PROCESS_CRASHED_TOO_MUCH,
                 app.userId, app.info.processName, app.uid);
                 // 2.8.1 回调 atm的onHandleAppCrash 
         mService.mAtmInternal.onHandleAppCrash(app.getWindowProcessController());
         if (!app.isPersistent()) {
           // 如果不是persistent进程,则不再重启，除非用户主动触发
             // We don't want to start this process again until the user
             // explicitly does so...  but for persistent process, we really
             // need to keep it running.  If a persistent process is actually
             // repeatedly crashing, then badness for everyone.
             if (!app.isolated) {
                 // XXX We don't have a way to mark isolated processes
                 // as bad, since they don't have a peristent identity.
                 mBadProcesses.put(app.info.processName, app.uid,
                         new BadProcessInfo(now, shortMsg, longMsg, stackTrace));
                 mProcessCrashTimes.remove(app.info.processName, app.uid);
             }
             app.bad = true;
             app.removed = true;
             // Don't let services in this process be restarted and potentially
             // annoy the user repeatedly.  Unless it is persistent, since those
             // processes run critical code.
             // 移除进程中的所有服务
             mService.mProcessList.removeProcessLocked(app, false, tryAgain, "crash");
             // 恢复顶部的activity
             mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
             if (!showBackground) {
                 return false;
             }
         }
         mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
     } else {
     // 不是一分钟内连续崩溃
         final int affectedTaskId = mService.mAtmInternal.finishTopCrashedActivities(
                         app.getWindowProcessController(), reason);
         if (data != null) {
             data.taskId = affectedTaskId;
         }
         if (data != null && crashTimePersistent != null
                 && now < crashTimePersistent + ProcessList.MIN_CRASH_INTERVAL) {
             data.repeating = true;
         }
     }
     if (data != null && tryAgain) {
         data.isRestartableForService = true;
     }
     // If the crashing process is what we consider to be the "home process" and it has been
     // replaced by a third-party app, clear the package preferred activities from packages
     // with a home activity running in the process to prevent a repeatedly crashing app
     // from blocking the user to manually clear the list.
     final WindowProcessController proc = app.getWindowProcessController();
     final WindowProcessController homeProc = mService.mAtmInternal.getHomeProcess();
     if (proc == homeProc && proc.hasActivities()
             && (((ProcessRecord) homeProc.mOwner).info.flags & FLAG_SYSTEM) == 0) {
         proc.clearPackagePreferredForHomeActivities();
     }
     if (!app.isolated) {
         // XXX Can't keep track of crash times for isolated processes,
         // because they don't have a persistent identity.
         mProcessCrashTimes.put(app.info.processName, app.uid, now);
         mProcessCrashTimesPersistent.put(app.info.processName, app.uid, now);
     }
      // 如果 app的crashHandler存在，则交给其处理
     if (app.crashHandler != null) mService.mHandler.post(app.crashHandler);
     return true;
 }

职责：

记录崩溃之间

增加 ServiceRecord 中crashCount数量

是否是一分钟内连续崩溃如果是两次连续崩溃小于一分钟，则认为是频繁崩溃。

调用onHandleAppCrash方法
如果不是persistent进程,则不再重启，除非用户主动触发
移除进程中的所有服务，且不再重启
恢复栈顶的activity
不是连续崩溃，则记录崩溃受影响的taskid
如果 app的crashHandler存在，则交给其处理

ATMS.onHandleAppCrash()

ActivityTaskManagerService.java

 
@Override
public void onHandleAppCrash(WindowProcessController wpc) {
   synchronized (mGlobalLock) {
       mRootActivityContainer.handleAppCrash(wpc);
   }
}
//RootActivityContainer.java
void handleAppCrash(WindowProcessController app) {
   // 遍历所有的ActivityDisplay
  for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
      final ActivityDisplay display = mActivityDisplays.get(displayNdx);
      // 遍历ActivityDisplay中管理的所有 ActivityStack 
      for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
         // 获取activity stack对象 
          final ActivityStack stack = display.getChildAt(stackNdx);
          stack.handleAppCrash(app);
      }
  }
}
>ActivityStack.java
void handleAppCrash(WindowProcessController app) {
  // 循环ActivityStack中管理的 TaskRecord
  for (int taskNdx = mTaskHistory.size() - 1; taskNdx >= 0; --taskNdx) {
      // 得到 TaskRecord中管理的所有  ActivityRecord集合
      final ArrayList<ActivityRecord> activities = mTaskHistory.get(taskNdx).mActivities;
      // 遍历 ActivityRecord集合，得到每一个 ActivityRecord对象
      for (int activityNdx = activities.size() - 1; activityNdx >= 0; --activityNdx) {
          final ActivityRecord r = activities.get(activityNdx);
          // 如果是崩溃的进程，则销毁activity
          if (r.app == app) {
              // Force the destroy to skip right to removal.
              r.app = null;
              // 
              getDisplay().mDisplayContent.prepareAppTransition(
                      TRANSIT_CRASHING_ACTIVITY_CLOSE, false /* alwaysKeepCurrent */);
              // finish销毁当前activity
              finishCurrentActivityLocked(r, FINISH_IMMEDIATELY, false,
                      "handleAppCrashedLocked");
          }
      }
  }
}

职责：

遍历所有ActivityDisplay，得到ActivityDisplay对象 display
然后在遍历display中的所有 ActivityStack对象，stack
再遍历 stack中所有的 TaskRecord对象，record
在遍历record中的所有 ActivityRecord对象，如果属于崩溃进程则销毁它

3.5 小结

AMS端在收到App的崩溃后，大概流程如下：

把崩溃信息通过 DBS 服务，写入到Dropbox文件中。dropbox支持错误类型：crash、wtf、anr
停止崩溃进程接收广播；增加ServiceRecord中的crashcount数；销毁所有的activies；
弹出崩溃对话框，等待用户选择 3.1. 如果选择重新启动，则从最近任务列表中找到崩溃进程，再次拉起 3.2. 如果选择强制退出，则杀掉app，进入kill流程 3.3. 如果选择显示应用信息，则启动系统页面的intent，打开应用详情页面

回到3.3.1中，当处理完 makeAppCrashingLocked()方法逻辑后，会通过AMS的 mUiHandler 发送 SHOW_ERROR_UI_MSG 弹出对话框。

四、 mUiHandler发送 SHOW_ERROR_UI_MSG

AMS.java

 
final class UiHandler extends Handler {
     public UiHandler() {
         super(com.android.server.UiThread.get().getLooper(), null, true);
     }
     @Override
     public void handleMessage(Message msg) {
         switch (msg.what) {
         case SHOW_ERROR_UI_MSG: {
             mAppErrors.handleShowAppErrorUi(msg);
             ensureBootCompleted();
         } break;
        // ...

4.1 handleShowAppErrorUi()

AppErrors.java

 
void handleShowAppErrorUi(Message msg) {
     AppErrorDialog.Data data = (AppErrorDialog.Data) msg.obj;
     boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),
             Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;
     AppErrorDialog dialogToShow = null;
     final String packageName;
     final int userId;
     synchronized (mService) {
     // 获取进程信息
         final ProcessRecord proc = data.proc;
         final AppErrorResult res = data.result;
         if (proc == null) {
             Slog.e(TAG, "handleShowAppErrorUi: proc is null");
             return;
         }
         packageName = proc.info.packageName;
         userId = proc.userId;
         // 如果已经有对话框，则不再弹出
         if (proc.crashDialog != null) {
             Slog.e(TAG, "App already has crash dialog: " + proc);
             if (res != null) {
                 res.set(AppErrorDialog.ALREADY_SHOWING);
             }
             return;
         }
         boolean isBackground = (UserHandle.getAppId(proc.uid)
                 >= Process.FIRST_APPLICATION_UID
                 && proc.pid != MY_PID);
         for (int profileId : mService.mUserController.getCurrentProfileIds()) {
             isBackground &= (userId != profileId);
         }
         if (isBackground && !showBackground) {
             Slog.w(TAG, "Skipping crash dialog of " + proc + ": background");
             if (res != null) {
                 res.set(AppErrorDialog.BACKGROUND_USER);
             }
             return;
         }
         final boolean showFirstCrash = Settings.Global.getInt(
                 mContext.getContentResolver(),
                 Settings.Global.SHOW_FIRST_CRASH_DIALOG, 0) != 0;
         final boolean showFirstCrashDevOption = Settings.Secure.getIntForUser(
                 mContext.getContentResolver(),
                 Settings.Secure.SHOW_FIRST_CRASH_DIALOG_DEV_OPTION,
                 0,
                 mService.mUserController.getCurrentUserId()) != 0;
         final boolean crashSilenced = mAppsNotReportingCrashes != null &&
                 mAppsNotReportingCrashes.contains(proc.info.packageName);
         if ((mService.mAtmInternal.canShowErrorDialogs() || showBackground)
                 && !crashSilenced
                 && (showFirstCrash || showFirstCrashDevOption || data.repeating)) {
                 // 创建对话框，5分钟超时等待，超时后自动关闭
             proc.crashDialog = dialogToShow = new AppErrorDialog(mContext, mService, data);
         } else {
             // The device is asleep, so just pretend that the user
             // saw a crash dialog and hit "force quit".
             if (res != null) {
                 res.set(AppErrorDialog.CANT_SHOW);
             }
         }
     }
     // If we've created a crash dialog, show it without the lock held
     if (dialogToShow != null) {
         Slog.i(TAG, "Showing crash dialog for package " + packageName + " u" + userId);
         // 弹出对话框
         dialogToShow.show();
     }
 }

逻辑很简单，就是获取进程的信息，并且展示错误对话框。5分钟用户没有选择，则自动关闭。

如果用户选择应用信息，则展示应用的运行信息
如果选择关闭应用，则执行杀应用流程
如果不选择，5分钟后自动关闭。

在1和3中都还没有执行杀应用流程，回顾2.2中的流程，在finally语句中都会走杀进程逻辑。

 
finally {
   // Try everything to make sure this process goes away.
   // 最终关闭kill掉进程
   Process.killProcess(Process.myPid());
   System.exit(10);
}

4.2 Process.killProcess()

 
public static final void killProcess(int pid) {
     sendSignal(pid, SIGNAL_KILL);
 }
public static final native void sendSignal(int pid, int signal);

给指定的进程发送一个 SIGNAL_KILL 信号。具体的杀进程流程，后续再单独分析。

至此，应用进程已经被杀死，但是还没完。因为system server进程中有注册Binder服务的死亡监听。当App进程死亡后，会回调到AMS 的死亡监听中，此时还需要处理Binder死亡通知回调逻辑。

五、Binder服务死亡通知

那么，AMS是什么时候注册死亡通知的呢？

还记得在创建进程的过程中，ActivityThread会调用AMS的 attachApplication(), 内部会调用到 attachApplicationLocked()方法。在这里注册的Binder的死亡通知。

5.1 AMS.attachApplicationLocked()

 
@GuardedBy("this")
 private final boolean attachApplicationLocked(IApplicationThread thread,
         int pid, int callingUid, long startSeq) {
         //...
   try {
         AppDeathRecipient adr = new AppDeathRecipient(
                 app, pid, thread);
         thread.asBinder().linkToDeath(adr, 0);
         app.deathRecipient = adr;
     } catch (RemoteException e) {
         app.resetPackageList(mProcessStats);
         mProcessList.startProcessLocked(app,
                 new HostingRecord("link fail", processName));
         return false;
     }
   //...
}

当有binder服务死亡，会调用 AppDeathRecipient 的 binderDied()方法：

5.2 AppDeathRecipient.binderDied()

AMS.java

 
@Override
public void binderDied() {
   if (DEBUG_ALL) Slog.v(
       TAG, "Death received in " + this
       + " for thread " + mAppThread.asBinder());
   synchronized(ActivityManagerService.this) {
       appDiedLocked(mApp, mPid, mAppThread, true);
   }
}

5.2.1 appDiedLocked()

 
@GuardedBy("this")
final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread,
      boolean fromBinderDied) {
  // First check if this ProcessRecord is actually active for the pid.
  synchronized (mPidsSelfLocked) {
      ProcessRecord curProc = mPidsSelfLocked.get(pid);
      if (curProc != app) {
          Slog.w(TAG, "Spurious death for " + app + ", curProc for " + pid + ": " + curProc);
          return;
      }
  }
  BatteryStatsImpl stats = mBatteryStatsService.getActiveStatistics();
  synchronized (stats) {
      stats.noteProcessDiedLocked(app.info.uid, pid);
  }
   // 如果没有被杀，再次杀app
  if (!app.killed) {
      if (!fromBinderDied) {
          killProcessQuiet(pid);
      }
      ProcessList.killProcessGroup(app.uid, pid);
      app.killed = true;
  }
  // Clean up already done if the process has been re-started.
  if (app.pid == pid && app.thread != null &&
          app.thread.asBinder() == thread.asBinder()) {
      boolean doLowMem = app.getActiveInstrumentation() == null;
      boolean doOomAdj = doLowMem;
      if (!app.killedByAm) {
          reportUidInfoMessageLocked(TAG,
                  "Process " + app.processName + " (pid " + pid + ") has died: "
                          + ProcessList.makeOomAdjString(app.setAdj, true) + " "
                          + ProcessList.makeProcStateString(app.setProcState), app.info.uid);
          mAllowLowerMemLevel = true;
      } else {
          // Note that we always want to do oom adj to update our state with the
          // new number of procs.
          mAllowLowerMemLevel = false;
          doLowMem = false;
      }
      //  调用 handleAppDiedLocked
      handleAppDiedLocked(app, false, true);
      if (doOomAdj) {
          updateOomAdjLocked(OomAdjuster.OOM_ADJ_REASON_PROCESS_END);
      }
      if (doLowMem) {
          doLowMemReportIfNeededLocked(app);
      }
  }
  //...
}

5.2.2 handleAppDiedLocked()

 
final void handleAppDiedLocked(ProcessRecord app,
         boolean restarting, boolean allowRestart) {
     int pid = app.pid;
     // 清理service、broadcastreveiver、contentprovider等信息
     boolean kept = cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1,
             false /*replacingPid*/);
     if (!kept && !restarting) {
     // 移除崩溃进程在AMS中的代表 ProcessRecord
         removeLruProcessLocked(app);
         if (pid > 0) {
             ProcessList.remove(pid);
         }
     }
     if (mProfileData.getProfileProc() == app) {
         clearProfilerLocked();
     }
      // 继续调用 atm的 handleAppDied
     mAtmInternal.handleAppDied(app.getWindowProcessController(), restarting, () -> {
         Slog.w(TAG, "Crash of app " + app.processName
                 + " running instrumentation " + app.getActiveInstrumentation().mClass);
         Bundle info = new Bundle();
         info.putString("shortMsg", "Process crashed.");
         finishInstrumentationLocked(app, Activity.RESULT_CANCELED, info);
     });
 }

清理service、broadcastreveiver、contentprovider等信息
移除移除崩溃进程 ProcessRecord
继续调用 atm的 handleAppDied

5.3 cleanUpApplicationRecordLocked()

该方法清理崩溃进程相关的所有信息。

 
final boolean cleanUpApplicationRecordLocked(ProcessRecord app,
         boolean restarting, boolean allowRestart, int index, boolean replacingPid) {
     if (index >= 0) {
         removeLruProcessLocked(app);
         ProcessList.remove(app.pid);
     }
     mProcessesToGc.remove(app);
     mPendingPssProcesses.remove(app);
     ProcessList.abortNextPssTime(app.procStateMemTracker);
      // 关闭所有已经打开的对话框： crash、anr、wait等
     // Dismiss any open dialogs.
     if (app.crashDialog != null && !app.forceCrashReport) {
         app.crashDialog.dismiss();
         app.crashDialog = null;
     }
     if (app.anrDialog != null) {
         app.anrDialog.dismiss();
         app.anrDialog = null;
     }
     if (app.waitDialog != null) {
         app.waitDialog.dismiss();
         app.waitDialog = null;
     }
     app.setCrashing(false);
     app.setNotResponding(false);
     app.resetPackageList(mProcessStats);
     app.unlinkDeathRecipient();
     app.makeInactive(mProcessStats);
     app.waitingToKill = null;
     app.forcingToImportant = null;
     updateProcessForegroundLocked(app, false, 0, false);
     app.setHasForegroundActivities(false);
     app.hasShownUi = false;
     app.treatLikeActivity = false;
     app.hasAboveClient = false;
     app.setHasClientActivities(false);
      // 移除所有service 信息
     mServices.killServicesLocked(app, allowRestart);
     boolean restart = false;
      // 移除所有的contentprovicer信息
     // Remove published content providers.
     for (int i = app.pubProviders.size() - 1; i >= 0; i--) {
         ContentProviderRecord cpr = app.pubProviders.valueAt(i);
         final boolean always = app.bad || !allowRestart;
         boolean inLaunching = removeDyingProviderLocked(app, cpr, always);
         if ((inLaunching || always) && cpr.hasConnectionOrHandle()) {
             // We left the provider in the launching list, need to
             // restart it.
             restart = true;
         }
         cpr.provider = null;
         cpr.setProcess(null);
     }
     app.pubProviders.clear();
     // Take care of any launching providers waiting for this process.
     if (cleanupAppInLaunchingProvidersLocked(app, false)) {
         restart = true;
     }
     // Unregister from connected content providers.
     if (!app.conProviders.isEmpty()) {
         for (int i = app.conProviders.size() - 1; i >= 0; i--) {
             ContentProviderConnection conn = app.conProviders.get(i);
             conn.provider.connections.remove(conn);
             stopAssociationLocked(app.uid, app.processName, conn.provider.uid,
                     conn.provider.appInfo.longVersionCode, conn.provider.name,
                     conn.provider.info.processName);
         }
         app.conProviders.clear();
     }
     // At this point there may be remaining entries in mLaunchingProviders
     // where we were the only one waiting, so they are no longer of use.
     // Look for these and clean up if found.
     // XXX Commented out for now.  Trying to figure out a way to reproduce
     // the actual situation to identify what is actually going on.
     if (false) {
         for (int i = mLaunchingProviders.size() - 1; i >= 0; i--) {
             ContentProviderRecord cpr = mLaunchingProviders.get(i);
             if (cpr.connections.size() <= 0 && !cpr.hasExternalProcessHandles()) {
                 synchronized (cpr) {
                     cpr.launchingApp = null;
                     cpr.notifyAll();
                 }
             }
         }
     }
      //移除所有的广播信息
     skipCurrentReceiverLocked(app);
     // Unregister any receivers.
     for (int i = app.receivers.size() - 1; i >= 0; i--) {
         removeReceiverLocked(app.receivers.valueAt(i));
     }
     app.receivers.clear();
   //清理App所有的备份 信息
     // If the app is undergoing backup, tell the backup manager about it
     final BackupRecord backupTarget = mBackupTargets.get(app.userId);
     if (backupTarget != null && app.pid == backupTarget.app.pid) {
         if (DEBUG_BACKUP || DEBUG_CLEANUP) Slog.d(TAG_CLEANUP, "App "
                 + backupTarget.appInfo + " died during backup");
         mHandler.post(new Runnable() {
             @Override
             public void run(){
                 try {
                     IBackupManager bm = IBackupManager.Stub.asInterface(
                             ServiceManager.getService(Context.BACKUP_SERVICE));
                     bm.agentDisconnectedForUser(app.userId, app.info.packageName);
                 } catch (RemoteException e) {
                     // can't happen; backup manager is local
                 }
             }
         });
     }
     for (int i = mPendingProcessChanges.size() - 1; i >= 0; i--) {
         ProcessChangeItem item = mPendingProcessChanges.get(i);
         if (app.pid > 0 && item.pid == app.pid) {
             mPendingProcessChanges.remove(i);
             mAvailProcessChanges.add(item);
         }
     }
     mUiHandler.obtainMessage(DISPATCH_PROCESS_DIED_UI_MSG, app.pid, app.info.uid,
             null).sendToTarget();
     // If the caller is restarting this app, then leave it in its
     // current lists and let the caller take care of it.
     if (restarting) {
         return false;
     }
     if (!app.isPersistent() || app.isolated) {
         if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG_CLEANUP,
                 "Removing non-persistent process during cleanup: " + app);
         if (!replacingPid) {
             mProcessList.removeProcessNameLocked(app.processName, app.uid, app);
         }
         mAtmInternal.clearHeavyWeightProcessIfEquals(app.getWindowProcessController());
     } else if (!app.removed) {
         // This app is persistent, so we need to keep its record around.
         // If it is not already on the pending app list, add it there
         // and start a new process for it.
         if (mPersistentStartingProcesses.indexOf(app) < 0) {
             mPersistentStartingProcesses.add(app);
             restart = true;
         }
     }
     if ((DEBUG_PROCESSES || DEBUG_CLEANUP) && mProcessesOnHold.contains(app)) Slog.v(
             TAG_CLEANUP, "Clean-up removing on hold: " + app);
     mProcessesOnHold.remove(app);
     mAtmInternal.onCleanUpApplicationRecord(app.getWindowProcessController());
     if (restart && !app.isolated) {
         // We have components that still need to be running in the
         // process, so re-launch it.
         if (index < 0) {
             ProcessList.remove(app.pid);
         }
         mProcessList.addProcessNameLocked(app);
         app.pendingStart = false;
         mProcessList.startProcessLocked(app,
                 new HostingRecord("restart", app.processName));
         return true;
     } else if (app.pid > 0 && app.pid != MY_PID) {
         // Goodbye!
         mPidsSelfLocked.remove(app);
         mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
         mBatteryStatsService.noteProcessFinish(app.processName, app.info.uid);
         if (app.isolated) {
             mBatteryStatsService.removeIsolatedUid(app.uid, app.info.uid);
         }
         app.setPid(0);
     }
     return false;
 }

职责：

清理所有跟崩溃进程相关的service、provider、receiver等信息。

5.4 atms.handleAppDied()

ActivityTaskManagerService.java

 
@HotPath(caller = HotPath.PROCESS_CHANGE)
@Override
public void handleAppDied(WindowProcessController wpc, boolean restarting,
       Runnable finishInstrumentationCallback) {
   synchronized (mGlobalLockWithoutBoost) {
       // Remove this application's activities from active lists.
       // 清理activities相关信息
       boolean hasVisibleActivities = mRootActivityContainer.handleAppDied(wpc);
       wpc.clearRecentTasks();
       wpc.clearActivities();
       if (wpc.isInstrumenting()) {
           finishInstrumentationCallback.run();
       }
       if (!restarting &amp;&amp; hasVisibleActivities) {
           mWindowManager.deferSurfaceLayout();
           try {
               if (!mRootActivityContainer.resumeFocusedStacksTopActivities()) {
                   // If there was nothing to resume, and we are not already restarting
                   // this process, but there is a visible activity that is hosted by the
                   // process...then make sure all visible activities are running, taking
                   // care of restarting this process.
                   // 确保恢复顶部的activity
                   mRootActivityContainer.ensureActivitiesVisible(null, 0,
                           !PRESERVE_WINDOWS);
               }
           } finally {
              // windows相关
               mWindowManager.continueSurfaceLayout();
           }
       }
   }
}

清理activities相关信息
确保恢复顶部的activity
更新windows相关信息

至此，Binder死亡通知后的处理流程也基本走完，App的整个java crash流程也宣告结束了。

小结

当App发生崩溃后，除了弹出对话框，发送kill命令杀掉自身后。AMS还会收到App进程的Binder服务死亡通知，只有当走完Binder的 binderDied()流程后，整个崩溃流程才算真正结束。

	@UnsupportedAppUsage
	protected static final void commonInit() {
	if (DEBUG) Slog.d(TAG, "Entered RuntimeInit!");
	LoggingHandler loggingHandler = new LoggingHandler();
	RuntimeHooks.setUncaughtExceptionPreHandler(loggingHandler);
	// 注册处理器
	Thread.setDefaultUncaughtExceptionHandler(new KillApplicationHandler(loggingHandler));
	}

	private static class KillApplicationHandler implements Thread.UncaughtExceptionHandler {
	private final LoggingHandler mLoggingHandler;
	/**
	* Create a new KillApplicationHandler that follows the given LoggingHandler.
	* If {@link #uncaughtException(Thread, Throwable) uncaughtException} is called
	* on the created instance without {@code loggingHandler} having been triggered,
	* {@link LoggingHandler#uncaughtException(Thread, Throwable)
	* loggingHandler.uncaughtException} will be called first.
	*
	* @param loggingHandler the {@link LoggingHandler} expected to have run before
	* this instance's {@link #uncaughtException(Thread, Throwable) uncaughtException}
	* is being called.
	*/
	public KillApplicationHandler(LoggingHandler loggingHandler) {
	this.mLoggingHandler = Objects.requireNonNull(loggingHandler);
	}
	@Override
	public void uncaughtException(Thread t, Throwable e) {
	try {
	// 在日志台打印崩溃时的日志
	ensureLogging(t, e);
	// Don't re-enter -- avoid infinite loops if crash-reporting crashes.
	if (mCrashing) return;
	mCrashing = true;
	// Try to end profiling. If a profiler is running at this point, and we kill the
	// process (below), the in-memory buffer will be lost. So try to stop, which will
	// flush the buffer. (This makes method trace profiling useful to debug crashes.)
	if (ActivityThread.currentActivityThread() != null) {
	ActivityThread.currentActivityThread().stopProfiling();
	}
	// Bring up crash dialog, wait for it to be dismissed
	//弹出奔溃对话框
	ActivityManager.getService().handleApplicationCrash(
	mApplicationObject, new ApplicationErrorReport.ParcelableCrashInfo(e));
	} catch (Throwable t2) {
	if (t2 instanceof DeadObjectException) {
	// System process is dead; ignore
	} else {
	try {
	Clog_e(TAG, "Error reporting crash", t2);
	} catch (Throwable t3) {
	// Even Clog_e() fails! Oh well.
	}
	}
	} finally {
	// Try everything to make sure this process goes away.
	// 最终关闭kill调进程
	Process.killProcess(Process.myPid());
	System.exit(10);
	}
	}
	private void ensureLogging(Thread t, Throwable e) {
	if (!mLoggingHandler.mTriggered) {
	try {
	mLoggingHandler.uncaughtException(t, e);
	} catch (Throwable loggingThrowable) {
	// Ignored.
	}
	}
	}
	}

	private static class LoggingHandler implements Thread.UncaughtExceptionHandler {
	public volatile boolean mTriggered = false;
	@Override
	public void uncaughtException(Thread t, Throwable e) {
	mTriggered = true;
	// Don't re-enter if KillApplicationHandler has already run
	if (mCrashing) return;
	// mApplicationObject is null for non-zygote java programs (e.g. "am")
	// There are also apps running with the system UID. We don't want the
	// first clause in either of these two cases, only for system_server.
	if (mApplicationObject == null && (Process.SYSTEM_UID == Process.myUid())) {
	Clog_e(TAG, "*** FATAL EXCEPTION IN SYSTEM PROCESS: " + t.getName(), e);
	} else {
	// 准备拼接 FATAL EXCEPTION ，打印到控制台
	StringBuilder message = new StringBuilder();
	//
	// The "FATAL EXCEPTION" string is still used on Android even though
	// apps can set a custom UncaughtExceptionHandler that renders uncaught
	// exceptions non-fatal.
	message.append("FATAL EXCEPTION: ").append(t.getName()).append("\n");
	final String processName = ActivityThread.currentProcessName();
	if (processName != null) {
	// 拼上进程名字
	message.append("Process: ").append(processName).append(", ");
	}
	// 进程id
	message.append("PID: ").append(Process.myPid());
	// 打印message和 e异常信息
	Clog_e(TAG, message.toString(), e);
	}
	}
	}

	public void handleApplicationCrash(IBinder app,
	ApplicationErrorReport.ParcelableCrashInfo crashInfo) {
	//找到 ProcessRecord对象
	ProcessRecord r = findAppProcess(app, "Crash");
	// app=null，表示system_server进程
	final String processName = app == null ? "system_server"
	: (r == null ? "unknown" : r.processName);
	handleApplicationCrashInner("crash", r, processName, crashInfo);
	}

	/* Native crash reporting uses this inner version because it needs to be somewhat
	* decoupled from the AM-managed cleanup lifecycle
	*/
	void handleApplicationCrashInner(String eventType, ProcessRecord r, String processName,
	ApplicationErrorReport.CrashInfo crashInfo) {
	// ...
	final int relaunchReason = r == null ? RELAUNCH_REASON_NONE
	: r.getWindowProcessController().computeRelaunchReason();
	final String relaunchReasonString = relaunchReasonToString(relaunchReason);
	if (crashInfo.crashTag == null) {
	crashInfo.crashTag = relaunchReasonString;
	} else {
	crashInfo.crashTag = crashInfo.crashTag + " " + relaunchReasonString;
	}
	// 1 写入崩溃信息到Dropbox
	addErrorToDropBox(
	eventType, r, processName, null, null, null, null, null, null, crashInfo);
	// 2 调用mAppErrors 的crashApplication方法
	mAppErrors.crashApplication(r, crashInfo);
	}

	public void addErrorToDropBox(String eventType,
	ProcessRecord process, String processName, String activityShortComponentName,
	String parentShortComponentName, ProcessRecord parentProcess,
	String subject, final String report, final File dataFile,
	final ApplicationErrorReport.CrashInfo crashInfo) {
	// Bail early if not published yet
	if (ServiceManager.getService(Context.DROPBOX_SERVICE) == null) return;
	// 获取 DBMS服务
	final DropBoxManager dbox = mContext.getSystemService(DropBoxManager.class);
	// Exit early if the dropbox isn't configured to accept this report type.
	// 确定错误类型
	final String dropboxTag = processClass(process) + "_" + eventType;
	if (dbox == null \|\| !dbox.isTagEnabled(dropboxTag)) return;
	// Rate-limit how often we're willing to do the heavy lifting below to
	// collect and record logs; currently 5 logs per 10 second period.
	final long now = SystemClock.elapsedRealtime();
	if (now - mWtfClusterStart > 10 * DateUtils.SECOND_IN_MILLIS) {
	mWtfClusterStart = now;
	mWtfClusterCount = 1;
	} else {
	if (mWtfClusterCount++ >= 5) return;
	}
	// 开始拼接错误信息
	final StringBuilder sb = new StringBuilder(1024);
	appendDropBoxProcessHeaders(process, processName, sb);
	if (process != null) {
	// 是否前台
	sb.append("Foreground: ")
	.append(process.isInterestingToUserLocked() ? "Yes" : "No")
	.append("\n");
	}
	if (activityShortComponentName != null) {
	sb.append("Activity: ").append(activityShortComponentName).append("\n");
	}
	if (parentShortComponentName != null) {
	if (parentProcess != null && parentProcess.pid != process.pid) {
	sb.append("Parent-Process: ").append(parentProcess.processName).append("\n");
	}
	if (!parentShortComponentName.equals(activityShortComponentName)) {
	sb.append("Parent-Activity: ").append(parentShortComponentName).append("\n");
	}
	}
	if (subject != null) {
	sb.append("Subject: ").append(subject).append("\n");
	}
	sb.append("Build: ").append(Build.FINGERPRINT).append("\n");
	if (Debug.isDebuggerConnected()) {
	sb.append("Debugger: Connected\n");
	}
	if (crashInfo != null && crashInfo.crashTag != null && !crashInfo.crashTag.isEmpty()) {
	sb.append("Crash-Tag: ").append(crashInfo.crashTag).append("\n");
	}
	sb.append("\n");
	// Do the rest in a worker thread to avoid blocking the caller on I/O
	// (After this point, we shouldn't access AMS internal data structures.)
	// dump错误信息
	Thread worker = new Thread("Error dump: " + dropboxTag) {
	@Override
	public void run() {
	if (report != null) {
	sb.append(report);
	}
	String setting = Settings.Global.ERROR_LOGCAT_PREFIX + dropboxTag;
	int lines = Settings.Global.getInt(mContext.getContentResolver(), setting, 0);
	int maxDataFileSize = DROPBOX_MAX_SIZE - sb.length()
	- lines * RESERVED_BYTES_PER_LOGCAT_LINE;
	if (dataFile != null && maxDataFileSize > 0) {
	try {
	sb.append(FileUtils.readTextFile(dataFile, maxDataFileSize,
	"\n\n[[TRUNCATED]]"));
	} catch (IOException e) {
	Slog.e(TAG, "Error reading " + dataFile, e);
	}
	}
	if (crashInfo != null && crashInfo.stackTrace != null) {
	sb.append(crashInfo.stackTrace);
	}
	if (lines > 0) {
	sb.append("\n");
	// Merge several logcat streams, and take the last N lines
	InputStreamReader input = null;
	try {
	java.lang.Process logcat = new ProcessBuilder(
	"/system/bin/timeout", "-k", "15s", "10s",
	"/system/bin/logcat", "-v", "threadtime", "-b", "events", "-b", "system",
	"-b", "main", "-b", "crash", "-t", String.valueOf(lines))
	.redirectErrorStream(true).start();
	try { logcat.getOutputStream().close(); } catch (IOException e) {}
	try { logcat.getErrorStream().close(); } catch (IOException e) {}
	input = new InputStreamReader(logcat.getInputStream());
	int num;
	char[] buf = new char[8192];
	while ((num = input.read(buf)) > 0) sb.append(buf, 0, num);
	} catch (IOException e) {
	Slog.e(TAG, "Error running logcat", e);
	} finally {
	if (input != null) try { input.close(); } catch (IOException e) {}
	}
	}
	dbox.addText(dropboxTag, sb.toString());
	}
	};
	if (process == null) {
	// If process is null, we are being called from some internal code
	// and may be about to die -- run this synchronously.
	final int oldMask = StrictMode.allowThreadDiskWritesMask();
	try {
	// 直接在当前线程执行
	worker.run();
	} finally {
	StrictMode.setThreadPolicyMask(oldMask);
	}
	} else {
	// 开个新的线程执行
	worker.start();
	}
	}

	void crashApplication(ProcessRecord r, ApplicationErrorReport.CrashInfo crashInfo) {
	final int callingPid = Binder.getCallingPid();
	final int callingUid = Binder.getCallingUid();
	final long origId = Binder.clearCallingIdentity();
	try {
	crashApplicationInner(r, crashInfo, callingPid, callingUid);
	} finally {
	Binder.restoreCallingIdentity(origId);
	}
	}

	void crashApplicationInner(ProcessRecord r, ApplicationErrorReport.CrashInfo crashInfo,
	int callingPid, int callingUid) {
	long timeMillis = System.currentTimeMillis();
	String shortMsg = crashInfo.exceptionClassName;
	String longMsg = crashInfo.exceptionMessage;
	String stackTrace = crashInfo.stackTrace;
	if (shortMsg != null && longMsg != null) {
	longMsg = shortMsg + ": " + longMsg;
	} else if (shortMsg != null) {
	longMsg = shortMsg;
	}
	// ...
	final int relaunchReason = r != null
	? r.getWindowProcessController().computeRelaunchReason() : RELAUNCH_REASON_NONE;
	AppErrorResult result = new AppErrorResult();
	int taskId;
	synchronized (mService) {
	// ...
	// If we can't identify the process or it's already exceeded its crash quota,
	// quit right away without showing a crash dialog.
	// 继续调用 makeAppCrashingLocked()
	if (r == null \|\| !makeAppCrashingLocked(r, shortMsg, longMsg, stackTrace, data)) {
	return;
	}
	AppErrorDialog.Data data = new AppErrorDialog.Data();
	data.result = result;
	data.proc = r;
	final Message msg = Message.obtain();
	msg.what = ActivityManagerService.SHOW_ERROR_UI_MSG;
	taskId = data.taskId;
	msg.obj = data;
	// 发送消息，弹出crash对话框，等待用户选择
	mService.mUiHandler.sendMessage(msg);
	}
	// 得到用户选择结果
	int res = result.get();
	Intent appErrorIntent = null;
	MetricsLogger.action(mContext, MetricsProto.MetricsEvent.ACTION_APP_CRASH, res);
	// 如果是超时或者取消，则当成是强制退出
	if (res == AppErrorDialog.TIMEOUT \|\| res == AppErrorDialog.CANCEL) {
	res = AppErrorDialog.FORCE_QUIT;
	}
	synchronized (mService) {
	if (res == AppErrorDialog.MUTE) {
	stopReportingCrashesLocked(r);
	}
	// 如果是重新启动
	if (res == AppErrorDialog.RESTART) {
	mService.mProcessList.removeProcessLocked(r, false, true, "crash");
	if (taskId != INVALID_TASK_ID) {
	try {
	//1. 从最近的任务列表中找到崩溃进程，再次启动
	mService.startActivityFromRecents(taskId,
	ActivityOptions.makeBasic().toBundle());
	} catch (IllegalArgumentException e) {
	// Hmm...that didn't work. Task should either be in recents or associated
	// with a stack.
	Slog.e(TAG, "Could not restart taskId=" + taskId, e);
	}
	}
	}
	// 如果是退出
	if (res == AppErrorDialog.FORCE_QUIT) {
	long orig = Binder.clearCallingIdentity();
	try {
	// Kill it with fire!
	// 杀掉这个进程
	mService.mAtmInternal.onHandleAppCrash(r.getWindowProcessController());
	if (!r.isPersistent()) {
	mService.mProcessList.removeProcessLocked(r, false, false, "crash");
	mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
	}
	} finally {
	Binder.restoreCallingIdentity(orig);
	}
	}
	// 如果是显示应用信息
	if (res == AppErrorDialog.APP_INFO) {
	appErrorIntent = new Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS);
	appErrorIntent.setData(Uri.parse("package:" + r.info.packageName));
	appErrorIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
	}
	if (res == AppErrorDialog.FORCE_QUIT_AND_REPORT) {
	appErrorIntent = createAppErrorIntentLocked(r, timeMillis, crashInfo);
	}
	if (r != null && !r.isolated && res != AppErrorDialog.RESTART) {
	// XXX Can't keep track of crash time for isolated processes,
	// since they don't have a persistent identity.
	mProcessCrashTimes.put(r.info.processName, r.uid,
	SystemClock.uptimeMillis());
	}
	}
	if (appErrorIntent != null) {
	try {
	// 2. 启动一个系统页面的intent 来显示应用信息
	mContext.startActivityAsUser(appErrorIntent, new UserHandle(r.userId));
	} catch (ActivityNotFoundException e) {
	Slog.w(TAG, "bug report receiver dissappeared", e);
	}
	}
	}

	private boolean makeAppCrashingLocked(ProcessRecord app,
	String shortMsg, String longMsg, String stackTrace, AppErrorDialog.Data data) {
	app.setCrashing(true);
	// 封装崩溃信息到 ProcessErrorStateInfo 中
	app.crashingReport = generateProcessError(app,
	ActivityManager.ProcessErrorStateInfo.CRASHED, null, shortMsg, longMsg, stackTrace);
	// 获取当前user的 error receiver；停止广播接收
	app.startAppProblemLocked();
	// 停是冻结屏幕
	app.getWindowProcessController().stopFreezingActivities();
	// 继续调用 handleAppCrashLocked
	return handleAppCrashLocked(app, "force-crash" /reason/, shortMsg, longMsg, stackTrace,
	data);
	}

	void startAppProblemLocked() {
	// If this app is not running under the current user, then we can't give it a report button
	// because that would require launching the report UI under a different user.
	errorReportReceiver = null;
	for (int userId : mService.mUserController.getCurrentProfileIds()) {
	if (this.userId == userId) {
	// 找到当前用户的error receiver
	errorReportReceiver = ApplicationErrorReport.getErrorReportReceiver(
	mService.mContext, info.packageName, info.flags);
	}
	}
	// 停止接收广播
	mService.skipCurrentReceiverLocked(this);
	}
	//
	void skipCurrentReceiverLocked(ProcessRecord app) {
	for (BroadcastQueue queue : mBroadcastQueues) {
	queue.skipCurrentReceiverLocked(app);
	}
	}
	private void skipReceiverLocked(BroadcastRecord r) {
	logBroadcastReceiverDiscardLocked(r);
	// 停止广播接收
	finishReceiverLocked(r, r.resultCode, r.resultData,
	r.resultExtras, r.resultAbort, false);
	scheduleBroadcastsLocked();
	}

	public void stopFreezingActivities() {
	synchronized (mAtm.mGlobalLock) {
	int i = mActivities.size();
	while (i > 0) {
	i--;
	// mActivities存储的类型为 ActivityRecord
	mActivities.get(i).stopFreezingScreenLocked(true);
	}
	}
	}

	public void stopFreezingScreenLocked(boolean force) {
	if (force \|\| frozenBeforeDestroy) {
	frozenBeforeDestroy = false;
	if (mAppWindowToken == null) {
	return;
	}
	mAppWindowToken.stopFreezingScreen(true, force);
	}
	}

	boolean handleAppCrashLocked(ProcessRecord app, String reason,
	String shortMsg, String longMsg, String stackTrace, AppErrorDialog.Data data) {
	final long now = SystemClock.uptimeMillis();
	final boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),
	Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;
	final boolean procIsBoundForeground =
	(app.getCurProcState() == ActivityManager.PROCESS_STATE_BOUND_FOREGROUND_SERVICE);
	// 确定崩溃的时间
	Long crashTime;
	Long crashTimePersistent;
	boolean tryAgain = false;
	if (!app.isolated) {
	crashTime = mProcessCrashTimes.get(app.info.processName, app.uid);
	crashTimePersistent = mProcessCrashTimesPersistent.get(app.info.processName, app.uid);
	} else {
	crashTime = crashTimePersistent = null;
	}
	// Bump up the crash count of any services currently running in the proc.
	// 增加ServiceRecord中crashCount
	for (int i = app.services.size() - 1; i >= 0; i--) {
	// Any services running in the application need to be placed
	// back in the pending list.
	ServiceRecord sr = app.services.valueAt(i);
	// If the service was restarted a while ago, then reset crash count, else increment it.
	if (now > sr.restartTime + ProcessList.MIN_CRASH_INTERVAL) {
	sr.crashCount = 1;
	} else {
	sr.crashCount++;
	}
	// Allow restarting for started or bound foreground services that are crashing.
	// This includes wallpapers.
	if (sr.crashCount < mService.mConstants.BOUND_SERVICE_MAX_CRASH_RETRY
	&& (sr.isForeground \|\| procIsBoundForeground)) {
	tryAgain = true;
	}
	}
	// 同一个进程，如果连续两次崩溃的间隔小于一分钟，则认为崩溃过于频繁
	if (crashTime != null && now < crashTime + ProcessList.MIN_CRASH_INTERVAL) {
	// The process crashed again very quickly. If it was a bound foreground service, let's
	// try to restart again in a while, otherwise the process loses!
	Slog.w(TAG, "Process " + app.info.processName
	+ " has crashed too many times: killing!");
	EventLog.writeEvent(EventLogTags.AM_PROCESS_CRASHED_TOO_MUCH,
	app.userId, app.info.processName, app.uid);
	// 2.8.1 回调 atm的onHandleAppCrash
	mService.mAtmInternal.onHandleAppCrash(app.getWindowProcessController());
	if (!app.isPersistent()) {
	// 如果不是persistent进程,则不再重启，除非用户主动触发
	// We don't want to start this process again until the user
	// explicitly does so... but for persistent process, we really
	// need to keep it running. If a persistent process is actually
	// repeatedly crashing, then badness for everyone.
	if (!app.isolated) {
	// XXX We don't have a way to mark isolated processes
	// as bad, since they don't have a peristent identity.
	mBadProcesses.put(app.info.processName, app.uid,
	new BadProcessInfo(now, shortMsg, longMsg, stackTrace));
	mProcessCrashTimes.remove(app.info.processName, app.uid);
	}
	app.bad = true;
	app.removed = true;
	// Don't let services in this process be restarted and potentially
	// annoy the user repeatedly. Unless it is persistent, since those
	// processes run critical code.
	// 移除进程中的所有服务
	mService.mProcessList.removeProcessLocked(app, false, tryAgain, "crash");
	// 恢复顶部的activity
	mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
	if (!showBackground) {
	return false;
	}
	}
	mService.mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
	} else {
	// 不是一分钟内连续崩溃
	final int affectedTaskId = mService.mAtmInternal.finishTopCrashedActivities(
	app.getWindowProcessController(), reason);
	if (data != null) {
	data.taskId = affectedTaskId;
	}
	if (data != null && crashTimePersistent != null
	&& now < crashTimePersistent + ProcessList.MIN_CRASH_INTERVAL) {
	data.repeating = true;
	}
	}
	if (data != null && tryAgain) {
	data.isRestartableForService = true;
	}
	// If the crashing process is what we consider to be the "home process" and it has been
	// replaced by a third-party app, clear the package preferred activities from packages
	// with a home activity running in the process to prevent a repeatedly crashing app
	// from blocking the user to manually clear the list.
	final WindowProcessController proc = app.getWindowProcessController();
	final WindowProcessController homeProc = mService.mAtmInternal.getHomeProcess();
	if (proc == homeProc && proc.hasActivities()
	&& (((ProcessRecord) homeProc.mOwner).info.flags & FLAG_SYSTEM) == 0) {
	proc.clearPackagePreferredForHomeActivities();
	}
	if (!app.isolated) {
	// XXX Can't keep track of crash times for isolated processes,
	// because they don't have a persistent identity.
	mProcessCrashTimes.put(app.info.processName, app.uid, now);
	mProcessCrashTimesPersistent.put(app.info.processName, app.uid, now);
	}
	// 如果 app的crashHandler存在，则交给其处理
	if (app.crashHandler != null) mService.mHandler.post(app.crashHandler);
	return true;
	}

	@Override
	public void onHandleAppCrash(WindowProcessController wpc) {
	synchronized (mGlobalLock) {
	mRootActivityContainer.handleAppCrash(wpc);
	}
	}
	//RootActivityContainer.java
	void handleAppCrash(WindowProcessController app) {
	// 遍历所有的ActivityDisplay
	for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
	final ActivityDisplay display = mActivityDisplays.get(displayNdx);
	// 遍历ActivityDisplay中管理的所有 ActivityStack
	for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
	// 获取activity stack对象
	final ActivityStack stack = display.getChildAt(stackNdx);
	stack.handleAppCrash(app);
	}
	}
	}
	>ActivityStack.java
	void handleAppCrash(WindowProcessController app) {
	// 循环ActivityStack中管理的 TaskRecord
	for (int taskNdx = mTaskHistory.size() - 1; taskNdx >= 0; --taskNdx) {
	// 得到 TaskRecord中管理的所有 ActivityRecord集合
	final ArrayList<ActivityRecord> activities = mTaskHistory.get(taskNdx).mActivities;
	// 遍历 ActivityRecord集合，得到每一个 ActivityRecord对象
	for (int activityNdx = activities.size() - 1; activityNdx >= 0; --activityNdx) {
	final ActivityRecord r = activities.get(activityNdx);
	// 如果是崩溃的进程，则销毁activity
	if (r.app == app) {
	// Force the destroy to skip right to removal.
	r.app = null;
	//
	getDisplay().mDisplayContent.prepareAppTransition(
	TRANSIT_CRASHING_ACTIVITY_CLOSE, false /* alwaysKeepCurrent */);
	// finish销毁当前activity
	finishCurrentActivityLocked(r, FINISH_IMMEDIATELY, false,
	"handleAppCrashedLocked");
	}
	}
	}
	}

	final class UiHandler extends Handler {
	public UiHandler() {
	super(com.android.server.UiThread.get().getLooper(), null, true);
	}
	@Override
	public void handleMessage(Message msg) {
	switch (msg.what) {
	case SHOW_ERROR_UI_MSG: {
	mAppErrors.handleShowAppErrorUi(msg);
	ensureBootCompleted();
	} break;
	// ...

	void handleShowAppErrorUi(Message msg) {
	AppErrorDialog.Data data = (AppErrorDialog.Data) msg.obj;
	boolean showBackground = Settings.Secure.getInt(mContext.getContentResolver(),
	Settings.Secure.ANR_SHOW_BACKGROUND, 0) != 0;
	AppErrorDialog dialogToShow = null;
	final String packageName;
	final int userId;
	synchronized (mService) {
	// 获取进程信息
	final ProcessRecord proc = data.proc;
	final AppErrorResult res = data.result;
	if (proc == null) {
	Slog.e(TAG, "handleShowAppErrorUi: proc is null");
	return;
	}
	packageName = proc.info.packageName;
	userId = proc.userId;
	// 如果已经有对话框，则不再弹出
	if (proc.crashDialog != null) {
	Slog.e(TAG, "App already has crash dialog: " + proc);
	if (res != null) {
	res.set(AppErrorDialog.ALREADY_SHOWING);
	}
	return;
	}
	boolean isBackground = (UserHandle.getAppId(proc.uid)
	>= Process.FIRST_APPLICATION_UID
	&& proc.pid != MY_PID);
	for (int profileId : mService.mUserController.getCurrentProfileIds()) {
	isBackground &= (userId != profileId);
	}
	if (isBackground && !showBackground) {
	Slog.w(TAG, "Skipping crash dialog of " + proc + ": background");
	if (res != null) {
	res.set(AppErrorDialog.BACKGROUND_USER);
	}
	return;
	}
	final boolean showFirstCrash = Settings.Global.getInt(
	mContext.getContentResolver(),
	Settings.Global.SHOW_FIRST_CRASH_DIALOG, 0) != 0;
	final boolean showFirstCrashDevOption = Settings.Secure.getIntForUser(
	mContext.getContentResolver(),
	Settings.Secure.SHOW_FIRST_CRASH_DIALOG_DEV_OPTION,
	0,
	mService.mUserController.getCurrentUserId()) != 0;
	final boolean crashSilenced = mAppsNotReportingCrashes != null &&
	mAppsNotReportingCrashes.contains(proc.info.packageName);
	if ((mService.mAtmInternal.canShowErrorDialogs() \|\| showBackground)
	&& !crashSilenced
	&& (showFirstCrash \|\| showFirstCrashDevOption \|\| data.repeating)) {
	// 创建对话框，5分钟超时等待，超时后自动关闭
	proc.crashDialog = dialogToShow = new AppErrorDialog(mContext, mService, data);
	} else {
	// The device is asleep, so just pretend that the user
	// saw a crash dialog and hit "force quit".
	if (res != null) {
	res.set(AppErrorDialog.CANT_SHOW);
	}
	}
	}
	// If we've created a crash dialog, show it without the lock held
	if (dialogToShow != null) {
	Slog.i(TAG, "Showing crash dialog for package " + packageName + " u" + userId);
	// 弹出对话框
	dialogToShow.show();
	}
	}

	finally {
	// Try everything to make sure this process goes away.
	// 最终关闭kill掉进程
	Process.killProcess(Process.myPid());
	System.exit(10);
	}

	public static final void killProcess(int pid) {
	sendSignal(pid, SIGNAL_KILL);
	}
	public static final native void sendSignal(int pid, int signal);

	@GuardedBy("this")
	private final boolean attachApplicationLocked(IApplicationThread thread,
	int pid, int callingUid, long startSeq) {
	//...
	try {
	AppDeathRecipient adr = new AppDeathRecipient(
	app, pid, thread);
	thread.asBinder().linkToDeath(adr, 0);
	app.deathRecipient = adr;
	} catch (RemoteException e) {
	app.resetPackageList(mProcessStats);
	mProcessList.startProcessLocked(app,
	new HostingRecord("link fail", processName));
	return false;
	}
	//...
	}

	@Override
	public void binderDied() {
	if (DEBUG_ALL) Slog.v(
	TAG, "Death received in " + this
	+ " for thread " + mAppThread.asBinder());
	synchronized(ActivityManagerService.this) {
	appDiedLocked(mApp, mPid, mAppThread, true);
	}
	}

Android Java crash 处理流程详解

目录

一、背景

二、App端Crash注册

2.1 commonInit()

2.2 KillApplicationHandler 类

2.2.1 ensureLogging()

2.2.2 ApplicationErrorReport

三、AMS端处理崩溃逻辑

3.1 AMS.handleApplicationCrash

3.1.1 AMS.handleApplicationCrashInner()

3.2 addErrorToDropBox()

3.3 AppErrors.crashApplication()

3.3.1 AppErrors.crashApplicationInner()

3.4 makeAppCrashingLocked()

3.4.1 ProcessRecord.startAppProblemLocked()

3.4.2 WindowProcessController.stopFreezingActivities()

3.4.3 handleAppCrashLocked()

3.5 小结

四、 mUiHandler发送 SHOW_ERROR_UI_MSG

4.1 handleShowAppErrorUi()

4.2 Process.killProcess()

五、Binder服务死亡通知

5.1 AMS.attachApplicationLocked()

5.2 AppDeathRecipient.binderDied()

5.2.1 appDiedLocked()

5.2.2 handleAppDiedLocked()

5.3 cleanUpApplicationRecordLocked()

5.4 atms.handleAppDied()

小结

	@GuardedBy("this")
	final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread,
	boolean fromBinderDied) {
	// First check if this ProcessRecord is actually active for the pid.
	synchronized (mPidsSelfLocked) {
	ProcessRecord curProc = mPidsSelfLocked.get(pid);
	if (curProc != app) {
	Slog.w(TAG, "Spurious death for " + app + ", curProc for " + pid + ": " + curProc);
	return;
	}
	}
	BatteryStatsImpl stats = mBatteryStatsService.getActiveStatistics();
	synchronized (stats) {
	stats.noteProcessDiedLocked(app.info.uid, pid);
	}
	// 如果没有被杀，再次杀app
	if (!app.killed) {
	if (!fromBinderDied) {
	killProcessQuiet(pid);
	}
	ProcessList.killProcessGroup(app.uid, pid);
	app.killed = true;
	}
	// Clean up already done if the process has been re-started.
	if (app.pid == pid && app.thread != null &&
	app.thread.asBinder() == thread.asBinder()) {
	boolean doLowMem = app.getActiveInstrumentation() == null;
	boolean doOomAdj = doLowMem;
	if (!app.killedByAm) {
	reportUidInfoMessageLocked(TAG,
	"Process " + app.processName + " (pid " + pid + ") has died: "
	+ ProcessList.makeOomAdjString(app.setAdj, true) + " "
	+ ProcessList.makeProcStateString(app.setProcState), app.info.uid);
	mAllowLowerMemLevel = true;
	} else {
	// Note that we always want to do oom adj to update our state with the
	// new number of procs.
	mAllowLowerMemLevel = false;
	doLowMem = false;
	}
	// 调用 handleAppDiedLocked
	handleAppDiedLocked(app, false, true);
	if (doOomAdj) {
	updateOomAdjLocked(OomAdjuster.OOM_ADJ_REASON_PROCESS_END);
	}
	if (doLowMem) {
	doLowMemReportIfNeededLocked(app);
	}
	}
	//...
	}

	final void handleAppDiedLocked(ProcessRecord app,
	boolean restarting, boolean allowRestart) {
	int pid = app.pid;
	// 清理service、broadcastreveiver、contentprovider等信息
	boolean kept = cleanUpApplicationRecordLocked(app, restarting, allowRestart, -1,
	false /replacingPid/);
	if (!kept && !restarting) {
	// 移除崩溃进程在AMS中的代表 ProcessRecord
	removeLruProcessLocked(app);
	if (pid > 0) {
	ProcessList.remove(pid);
	}
	}
	if (mProfileData.getProfileProc() == app) {
	clearProfilerLocked();
	}
	// 继续调用 atm的 handleAppDied
	mAtmInternal.handleAppDied(app.getWindowProcessController(), restarting, () -> {
	Slog.w(TAG, "Crash of app " + app.processName
	+ " running instrumentation " + app.getActiveInstrumentation().mClass);
	Bundle info = new Bundle();
	info.putString("shortMsg", "Process crashed.");
	finishInstrumentationLocked(app, Activity.RESULT_CANCELED, info);
	});
	}

	final boolean cleanUpApplicationRecordLocked(ProcessRecord app,
	boolean restarting, boolean allowRestart, int index, boolean replacingPid) {
	if (index >= 0) {
	removeLruProcessLocked(app);
	ProcessList.remove(app.pid);
	}
	mProcessesToGc.remove(app);
	mPendingPssProcesses.remove(app);
	ProcessList.abortNextPssTime(app.procStateMemTracker);
	// 关闭所有已经打开的对话框： crash、anr、wait等
	// Dismiss any open dialogs.
	if (app.crashDialog != null && !app.forceCrashReport) {
	app.crashDialog.dismiss();
	app.crashDialog = null;
	}
	if (app.anrDialog != null) {
	app.anrDialog.dismiss();
	app.anrDialog = null;
	}
	if (app.waitDialog != null) {
	app.waitDialog.dismiss();
	app.waitDialog = null;
	}
	app.setCrashing(false);
	app.setNotResponding(false);
	app.resetPackageList(mProcessStats);
	app.unlinkDeathRecipient();
	app.makeInactive(mProcessStats);
	app.waitingToKill = null;
	app.forcingToImportant = null;
	updateProcessForegroundLocked(app, false, 0, false);
	app.setHasForegroundActivities(false);
	app.hasShownUi = false;
	app.treatLikeActivity = false;
	app.hasAboveClient = false;
	app.setHasClientActivities(false);
	// 移除所有service 信息
	mServices.killServicesLocked(app, allowRestart);
	boolean restart = false;
	// 移除所有的contentprovicer信息
	// Remove published content providers.
	for (int i = app.pubProviders.size() - 1; i >= 0; i--) {
	ContentProviderRecord cpr = app.pubProviders.valueAt(i);
	final boolean always = app.bad \|\| !allowRestart;
	boolean inLaunching = removeDyingProviderLocked(app, cpr, always);
	if ((inLaunching \|\| always) && cpr.hasConnectionOrHandle()) {
	// We left the provider in the launching list, need to
	// restart it.
	restart = true;
	}
	cpr.provider = null;
	cpr.setProcess(null);
	}
	app.pubProviders.clear();
	// Take care of any launching providers waiting for this process.
	if (cleanupAppInLaunchingProvidersLocked(app, false)) {
	restart = true;
	}
	// Unregister from connected content providers.
	if (!app.conProviders.isEmpty()) {
	for (int i = app.conProviders.size() - 1; i >= 0; i--) {
	ContentProviderConnection conn = app.conProviders.get(i);
	conn.provider.connections.remove(conn);
	stopAssociationLocked(app.uid, app.processName, conn.provider.uid,
	conn.provider.appInfo.longVersionCode, conn.provider.name,
	conn.provider.info.processName);
	}
	app.conProviders.clear();
	}
	// At this point there may be remaining entries in mLaunchingProviders
	// where we were the only one waiting, so they are no longer of use.
	// Look for these and clean up if found.
	// XXX Commented out for now. Trying to figure out a way to reproduce
	// the actual situation to identify what is actually going on.
	if (false) {
	for (int i = mLaunchingProviders.size() - 1; i >= 0; i--) {
	ContentProviderRecord cpr = mLaunchingProviders.get(i);
	if (cpr.connections.size() <= 0 && !cpr.hasExternalProcessHandles()) {
	synchronized (cpr) {
	cpr.launchingApp = null;
	cpr.notifyAll();
	}
	}
	}
	}
	//移除所有的广播信息
	skipCurrentReceiverLocked(app);
	// Unregister any receivers.
	for (int i = app.receivers.size() - 1; i >= 0; i--) {
	removeReceiverLocked(app.receivers.valueAt(i));
	}
	app.receivers.clear();
	//清理App所有的备份信息
	// If the app is undergoing backup, tell the backup manager about it
	final BackupRecord backupTarget = mBackupTargets.get(app.userId);
	if (backupTarget != null && app.pid == backupTarget.app.pid) {
	if (DEBUG_BACKUP \|\| DEBUG_CLEANUP) Slog.d(TAG_CLEANUP, "App "
	+ backupTarget.appInfo + " died during backup");
	mHandler.post(new Runnable() {
	@Override
	public void run(){
	try {
	IBackupManager bm = IBackupManager.Stub.asInterface(
	ServiceManager.getService(Context.BACKUP_SERVICE));
	bm.agentDisconnectedForUser(app.userId, app.info.packageName);
	} catch (RemoteException e) {
	// can't happen; backup manager is local
	}
	}
	});
	}
	for (int i = mPendingProcessChanges.size() - 1; i >= 0; i--) {
	ProcessChangeItem item = mPendingProcessChanges.get(i);
	if (app.pid > 0 && item.pid == app.pid) {
	mPendingProcessChanges.remove(i);
	mAvailProcessChanges.add(item);
	}
	}
	mUiHandler.obtainMessage(DISPATCH_PROCESS_DIED_UI_MSG, app.pid, app.info.uid,
	null).sendToTarget();
	// If the caller is restarting this app, then leave it in its
	// current lists and let the caller take care of it.
	if (restarting) {
	return false;
	}
	if (!app.isPersistent() \|\| app.isolated) {
	if (DEBUG_PROCESSES \|\| DEBUG_CLEANUP) Slog.v(TAG_CLEANUP,
	"Removing non-persistent process during cleanup: " + app);
	if (!replacingPid) {
	mProcessList.removeProcessNameLocked(app.processName, app.uid, app);
	}
	mAtmInternal.clearHeavyWeightProcessIfEquals(app.getWindowProcessController());
	} else if (!app.removed) {
	// This app is persistent, so we need to keep its record around.
	// If it is not already on the pending app list, add it there
	// and start a new process for it.
	if (mPersistentStartingProcesses.indexOf(app) < 0) {
	mPersistentStartingProcesses.add(app);
	restart = true;
	}
	}
	if ((DEBUG_PROCESSES \|\| DEBUG_CLEANUP) && mProcessesOnHold.contains(app)) Slog.v(
	TAG_CLEANUP, "Clean-up removing on hold: " + app);
	mProcessesOnHold.remove(app);
	mAtmInternal.onCleanUpApplicationRecord(app.getWindowProcessController());
	if (restart && !app.isolated) {
	// We have components that still need to be running in the
	// process, so re-launch it.
	if (index < 0) {
	ProcessList.remove(app.pid);
	}
	mProcessList.addProcessNameLocked(app);
	app.pendingStart = false;
	mProcessList.startProcessLocked(app,
	new HostingRecord("restart", app.processName));
	return true;
	} else if (app.pid > 0 && app.pid != MY_PID) {
	// Goodbye!
	mPidsSelfLocked.remove(app);
	mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
	mBatteryStatsService.noteProcessFinish(app.processName, app.info.uid);
	if (app.isolated) {
	mBatteryStatsService.removeIsolatedUid(app.uid, app.info.uid);
	}
	app.setPid(0);
	}
	return false;
	}

	@HotPath(caller = HotPath.PROCESS_CHANGE)
	@Override
	public void handleAppDied(WindowProcessController wpc, boolean restarting,
	Runnable finishInstrumentationCallback) {
	synchronized (mGlobalLockWithoutBoost) {
	// Remove this application's activities from active lists.
	// 清理activities相关信息
	boolean hasVisibleActivities = mRootActivityContainer.handleAppDied(wpc);
	wpc.clearRecentTasks();
	wpc.clearActivities();
	if (wpc.isInstrumenting()) {
	finishInstrumentationCallback.run();
	}
	if (!restarting && hasVisibleActivities) {
	mWindowManager.deferSurfaceLayout();
	try {
	if (!mRootActivityContainer.resumeFocusedStacksTopActivities()) {
	// If there was nothing to resume, and we are not already restarting
	// this process, but there is a visible activity that is hosted by the
	// process...then make sure all visible activities are running, taking
	// care of restarting this process.
	// 确保恢复顶部的activity
	mRootActivityContainer.ensureActivitiesVisible(null, 0,
	!PRESERVE_WINDOWS);
	}
	} finally {
	// windows相关
	mWindowManager.continueSurfaceLayout();
	}
	}
	}
	}