转载

Android JNI介绍 (七)- 引用的管理

在前面的文章中,我们已经了解了JNI的工程结构、调用流程、异常处理等知识,本文将介绍JNI中的引用管理。

一、引用类型

JNI中封装了以下三种引用类型:

  • LocalReference

    局部引用,引用表的持有者是 JNIEnv ,在函数执行完时会自动释放,但是在函数执行过程中创建过多就会导致内存溢出或引用表溢出。

  • GlobalReference

    全局强引用,引用表的持有者是 JVM ,引用对象不会被gc,手动创建,手动释放,如果创建过多并且不释放会导致内存溢出或引用表溢出。

  • WeakGlobalReference

    全局弱引用,引用表的持有者是 JVM ,引用对象可能会被gc,手动创建,手动释放,如果创建过多并且不释放会导致内存溢出或引用表溢出。

二、各个引用的详细介绍

1. 引用表的介绍

引用表的数据类型为 IndirectReferenceTable ,定义在 IndirectReferenceTable.h 中,其实现是 MemMap ,是一块连续内存,可以理解为数组,通过下标进行标识当前数组内的数据量。对于 Add 操作,直接追加即可,在空间不够时通过 Resize 扩张, Resize 的实现类似于Java中的 ArrayList 扩张的实现:申请新的内存,再进行拷贝。对于 Remove 操作,如果 Remove 的是顶部元素,可以在释放对象并置空,直接修改下标,但是对于非顶部元素的移除,由于这个对象的内存是连续的,而不是链表,不能直接释放那块内存,因此, IndirectReferenceTable 在进行删除操作可能仍会占用一个内存区域,代码里称之为 Hole ,在其进行 Add 时,又会对这个 Hole 进行填充,尽可能地充分利用内存。

indirect_reference_table.cc 中, Add 函数的实现如下

IndirectRef IndirectReferenceTable::Add(IRTSegmentState previous_state,
                                        ObjPtr<mirror::Object> obj,
                                        std::string* error_msg) {
  if (kDebugIRT) {
    LOG(INFO) << "+++ Add: previous_state=" << previous_state.top_index
              << " top_index=" << segment_state_.top_index
              << " last_known_prev_top_index=" << last_known_previous_state_.top_index
              << " holes=" << current_num_holes_;
  }

  size_t top_index = segment_state_.top_index;

  CHECK(obj != nullptr);
  VerifyObject(obj);
  DCHECK(table_ != nullptr);

  // 当前表已满
  if (top_index == max_entries_) {
    // 对于不可Resize的情况,报错
    if (resizable_ == ResizableCapacity::kNo) {
      std::ostringstream oss;
      oss << "JNI ERROR (app bug): " << kind_ << " table overflow "
          << "(max=" << max_entries_ << ")"
          << MutatorLockedDumpable<IndirectReferenceTable>(*this);
      *error_msg = oss.str();
      return nullptr;
    }

    // 如果当前容量大于最大值的一半,x2就会过大,直接报错
    // Try to double space.
    if (std::numeric_limits<size_t>::max() / 2 < max_entries_) {
      std::ostringstream oss;
      oss << "JNI ERROR (app bug): " << kind_ << " table overflow "
          << "(max=" << max_entries_ << ")" << std::endl
          << MutatorLockedDumpable<IndirectReferenceTable>(*this)
          << " Resizing failed: exceeds size_t";
      *error_msg = oss.str();
      return nullptr;
    }
    
    // 尝试扩大一倍
    std::string inner_error_msg;
    if (!Resize(max_entries_ * 2, &inner_error_msg)) {
      std::ostringstream oss;
      oss << "JNI ERROR (app bug): " << kind_ << " table overflow "
          << "(max=" << max_entries_ << ")" << std::endl
          << MutatorLockedDumpable<IndirectReferenceTable>(*this)
          << " Resizing failed: " << inner_error_msg;
      *error_msg = oss.str();
      return nullptr;
    }
  }

  RecoverHoles(previous_state);
  CheckHoleCount(table_, current_num_holes_, previous_state, segment_state_);

  // We know there's enough room in the table.  Now we just need to find
  // the right spot.  If there's a hole, find it and fill it; otherwise,
  // add to the end of the list.
  IndirectRef result;
  size_t index;
  if (current_num_holes_ > 0) {
    DCHECK_GT(top_index, 1U);
    // Find the first hole; likely to be near the end of the list.
    IrtEntry* p_scan = &table_[top_index - 1];
    DCHECK(!p_scan->GetReference()->IsNull());
    --p_scan;
    while (!p_scan->GetReference()->IsNull()) {
      DCHECK_GE(p_scan, table_ + previous_state.top_index);
      --p_scan;
    }
    index = p_scan - table_;
    current_num_holes_--;
  } else {
    // Add to the end.
    index = top_index++;
    segment_state_.top_index = top_index;
  }
  table_[index].Add(obj);
  result = ToIndirectRef(index);
  if (kDebugIRT) {
    LOG(INFO) << "+++ added at " << ExtractIndex(result) << " top=" << segment_state_.top_index
              << " holes=" << current_num_holes_;
  }

  DCHECK(result != nullptr);
  return result;
}
复制代码

Remove 的实现如下

// Removes an object. We extract the table offset bits from "iref"
// and zap the corresponding entry, leaving a hole if it's not at the top.
// If the entry is not between the current top index and the bottom index
// specified by the cookie, we don't remove anything. This is the behavior
// required by JNI's DeleteLocalRef function.
// This method is not called when a local frame is popped; this is only used
// for explicit single removals.
// Returns "false" if nothing was removed.
bool IndirectReferenceTable::Remove(IRTSegmentState previous_state, IndirectRef iref) {
  ...
  if (idx == top_index - 1) {
    // Top-most entry.  Scan up and consume holes.

    if (!CheckEntry("remove", iref, idx)) {
      return false;
    }

    *table_[idx].GetReference() = GcRoot<mirror::Object>(nullptr);
    if (current_num_holes_ != 0) {
      uint32_t collapse_top_index = top_index;
      while (--collapse_top_index > bottom_index && current_num_holes_ != 0) {
        if (kDebugIRT) {
          ScopedObjectAccess soa(Thread::Current());
          LOG(INFO) << "+++ checking for hole at " << collapse_top_index - 1
                    << " (previous_state=" << bottom_index << ") val="
                    << table_[collapse_top_index - 1].GetReference()->Read<kWithoutReadBarrier>();
        }
        if (!table_[collapse_top_index - 1].GetReference()->IsNull()) {
          break;
        }
        if (kDebugIRT) {
          LOG(INFO) << "+++ ate hole at " << (collapse_top_index - 1);
        }
        current_num_holes_--;
      }
      segment_state_.top_index = collapse_top_index;

      CheckHoleCount(table_, current_num_holes_, previous_state, segment_state_);
    } else {
      segment_state_.top_index = top_index - 1;
      if (kDebugIRT) {
        LOG(INFO) << "+++ ate last entry " << top_index - 1;
      }
    }
  } else {
    // Not the top-most entry.  This creates a hole.  We null out the entry to prevent somebody
    // from deleting it twice and screwing up the hole count.
    if (table_[idx].GetReference()->IsNull()) {
      LOG(INFO) << "--- WEIRD: removing null entry " << idx;
      return false;
    }
    if (!CheckEntry("remove", iref, idx)) {
      return false;
    }

    *table_[idx].GetReference() = GcRoot<mirror::Object>(nullptr);
    current_num_holes_++;
    CheckHoleCount(table_, current_num_holes_, previous_state, segment_state_);
    if (kDebugIRT) {
      LOG(INFO) << "+++ left hole at " << idx << ", holes=" << current_num_holes_;
    }
  }

  return true;
}
复制代码

2. LocalReference

局部引用,我们调用的 FindClassGetObjectClassNewStringUTFNewObjectArrayNewByteArrayCallObjectMethod 等函数回传的都是局部引用。在没有循环处理的情况下,我们可以让其自动释放,但是在循环次数较多的循环中,需要手动释放。如果局部引用表溢出,就会出现异常。需要注意的是,局部引用不能保存在全局变量中使用,否则会报 JNI DETECTED ERROR IN APPLICATION: use of deleted local reference 错误提示。

  • 示例操作

    正确示例

    extern "C" JNIEXPORT void
    JNICALL
    Java_com_wsy_jnidemo_test_ReferenceTest_createLocalRef(
            JNIEnv *env,
            jclass,jint count) {
        for (int i = 0; i < count; ++i) {
            jobject localRef = env->NewByteArray(1);
            ... 
            env->DeleteLocalRef(localRef);
        }
    }
    复制代码

    错误示例

    extern "C" JNIEXPORT void
    JNICALL
    Java_com_wsy_jnidemo_test_ReferenceTest_createLocalRef(
            JNIEnv *env,
            jclass,jint count) {
        for (int i = 0; i < count; ++i) {
            env->NewByteArray(1);
        }
    }
    复制代码

    对于错误示例,当我们分10000次,每次创建10000个 LocalReference 的方式进行调用,并不会crash

    for (int i = 0; i < 10000; i++) {
           ReferenceTest.createLocalRef(10000);
        }
    复制代码

    而当我们只调用一次,创建100000000个 LocalReference 的方式进行调用,就会crash

    ReferenceTest.createLocalRef(100000000);
    复制代码

    crash日志类似如下,提示 local reference table overflow

    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG: Abort message: 'JNI ERROR (app bug): local reference table overflow (max=8388608)
        local reference table dump:
          Last 10 entries (of 8388608):
            8388607: 0x1b4007c0 byte[] (1 elements)
            8388606: 0x1b4007b0 byte[] (1 elements)
            8388605: 0x1b4007a0 byte[] (1 elements)
            8388604: 0x1b400790 byte[] (1 elements)
            8388603: 0x1b400780 byte[] (1 elements)
            8388602: 0x1b400770 byte[] (1 elements)
            8388601: 0x1b400760 byte[] (1 elements)
            8388600: 0x1b400750 byte[] (1 elements)
            8388599: 0x1b400740 byte[] (1 elements)
            8388598: 0x1b400730 byte[] (1 elements)
          Summary:
            8388607 of byte[] (1 elements) (8388607 unique instances)
                1 of java.lang.Thread
         Resizing failed: Requested size exceeds maximum: 16777216'
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x0  0000000000000000  x1  0000000000003780  x2  0000000000000006  x3  0000007417e7c9f0
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x4  fefeff740442df97  x5  fefeff740442df97  x6  fefeff740442df97  x7  7f7f7f7f7f7fffff
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x8  00000000000000f0  x9  d0dac69971875631  x10 0000000000000001  x11 0000000000000000
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x12 fffffff0fffffbdf  x13 ffffffffffffffff  x14 0000000000000004  x15 ffffffffffffffff
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x16 0000007505532738  x17 0000007505510be0  x18 0000007416f64000  x19 000000000000374d
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x20 0000000000003780  x21 00000000ffffffff  x22 00000074768c5e00  x23 0000007481cff1c3
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x24 0000007481cdf247  x25 000000748221b000  x26 00000074822fd258  x27 000000748221b000
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     x28 0000000000000043  x29 0000007417e7ca90
    2019-12-27 21:20:38.543 14219-14219/? A/DEBUG:     sp  0000007417e7c9d0  lr  00000075054c2404  pc  00000075054c2430
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG: backtrace:
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #00 pc 0000000000073430  /apex/com.android.runtime/lib64/bionic/libc.so (abort+160) (BuildId: a2584ee8458a61d422edf24b4cd23b78)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #01 pc 00000000004b8650  /apex/com.android.runtime/lib64/libart.so (art::Runtime::Abort(char const*)+2280) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #02 pc 000000000000b458  /system/lib64/libbase.so (android::base::LogMessage::~LogMessage()+580) (BuildId: 1efae6b19d52bd307d764e26e1d0e2c9)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #03 pc 00000000003c67c0  /apex/com.android.runtime/lib64/libart.so (art::JNI::NewByteArray(_JNIEnv*, int)+1428) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #04 pc 0000000000371dfc  /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::CheckJNI::NewPrimitiveArray(char const*, _JNIEnv*, int, art::Primitive::Type)+932) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #05 pc 0000000000000f68  /data/app/com.wsy.jnidemo-EKfsEZ5DLE64_7yrLJJNVA==/lib/arm64/libreftest.so (_JNIEnv::NewByteArray(int)+36) (BuildId: f8de44f2f2443e0b50ce67aad7bbdfa9ffdecf7a)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #06 pc 0000000000000fec  /data/app/com.wsy.jnidemo-EKfsEZ5DLE64_7yrLJJNVA==/lib/arm64/libreftest.so (Java_com_wsy_jnidemo_test_ReferenceTest_createLocalRef+52) (BuildId: f8de44f2f2443e0b50ce67aad7bbdfa9ffdecf7a)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #07 pc 000000000013f350  /apex/com.android.runtime/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #08 pc 00000000001365b8  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_static_stub+568) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #09 pc 000000000014500c  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+276) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #10 pc 00000000002e281c  /apex/com.android.runtime/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+384) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #11 pc 00000000002dda7c  /apex/com.android.runtime/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+892) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #12 pc 00000000005a2adc  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+372) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #13 pc 0000000000130994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #14 pc 0000000000012df4  [anon:dalvik-classes2.dex extracted in memory from /data/app/com.wsy.jnidemo-EKfsEZ5DLE64_7yrLJJNVA==/base.apk!classes2.dex] (com.wsy.jnidemo.MainActivity.doReferenceTest+12)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #15 pc 00000000005a25d4  /apex/com.android.runtime/lib64/libart.so (MterpInvokeDirect+1100) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #16 pc 0000000000130914  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_direct+20) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #17 pc 0000000000012d24  [anon:dalvik-classes2.dex extracted in memory from /data/app/com.wsy.jnidemo-EKfsEZ5DLE64_7yrLJJNVA==/base.apk!classes2.dex] (com.wsy.jnidemo.MainActivity.access$000)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #18 pc 00000000005a2d78  /apex/com.android.runtime/lib64/libart.so (MterpInvokeStatic+1040) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #19 pc 0000000000130994  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_static+20) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #20 pc 0000000000012cc8  [anon:dalvik-classes2.dex extracted in memory from /data/app/com.wsy.jnidemo-EKfsEZ5DLE64_7yrLJJNVA==/base.apk!classes2.dex] (com.wsy.jnidemo.MainActivity$1.run+4)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #21 pc 00000000005a1ae8  /apex/com.android.runtime/lib64/libart.so (MterpInvokeInterface+1788) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #22 pc 0000000000130a14  /apex/com.android.runtime/lib64/libart.so (mterp_op_invoke_interface+20) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #23 pc 00000000000ec0f0  /apex/com.android.runtime/javalib/core-oj.jar (java.lang.Thread.run+8)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #24 pc 00000000002b3b30  /apex/com.android.runtime/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEbb.llvm.3929369822492601747+240) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #25 pc 0000000000591570  /apex/com.android.runtime/lib64/libart.so (artQuickToInterpreterBridge+1032) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #26 pc 000000000013f468  /apex/com.android.runtime/lib64/libart.so (art_quick_to_interpreter_bridge+88) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #27 pc 0000000000136334  /apex/com.android.runtime/lib64/libart.so (art_quick_invoke_stub+548) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #28 pc 0000000000144fec  /apex/com.android.runtime/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+244) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #29 pc 00000000004aff10  /apex/com.android.runtime/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #30 pc 00000000004b1024  /apex/com.android.runtime/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue const*)+416) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #31 pc 00000000004f19ec  /apex/com.android.runtime/lib64/libart.so (art::Thread::CreateCallback(void*)+1176) (BuildId: 615724283373fd93e5fb77101fe57dab)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #32 pc 00000000000d6b70  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+36) (BuildId: a2584ee8458a61d422edf24b4cd23b78)
    2019-12-27 21:20:38.606 14219-14219/? A/DEBUG:       #33 pc 0000000000074eac  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: a2584ee8458a61d422edf24b4cd23b78)
    复制代码
  • 源码阅读

    局部变量表对象定义在 jni_env_ext.h

    // JNI local references.
      IndirectReferenceTable locals_ GUARDED_BY(Locks::mutator_lock_);
    复制代码

    当我们在进行一些 JNI 操作时,会进行添加,例如以下函数

    jni_internal.cc 中的 JNI 函数的实现

    static jobject CallObjectMethod(JNIEnv* env, jobject obj, jmethodID mid, ...) {
        va_list ap;
        va_start(ap, mid);
        ScopedVAArgs free_args_later(&ap);
        CHECK_NON_NULL_ARGUMENT(obj);
        CHECK_NON_NULL_ARGUMENT(mid);
        ScopedObjectAccess soa(env);
        JValue result(InvokeVirtualOrInterfaceWithVarArgs(soa, obj, mid, ap));
        return soa.AddLocalReference<jobject>(result.GetL());
      }
    复制代码
    static jstring NewStringUTF(JNIEnv* env, const char* utf) {
        if (utf == nullptr) {
          return nullptr;
        }
        ScopedObjectAccess soa(env);
        ObjPtr<mirror::String> result = mirror::String::AllocFromModifiedUtf8(soa.Self(), utf);
        return soa.AddLocalReference<jstring>(result);
      }
    复制代码

    jni_env_ext-inl.h 中, AddLocalReference 的实现如下,调用了 locals_Add

    template<typename T>
    inline T JNIEnvExt::AddLocalReference(ObjPtr<mirror::Object> obj) {
      std::string error_msg;
      IndirectRef ref = locals_.Add(local_ref_cookie_, obj, &error_msg);
      if (UNLIKELY(ref == nullptr)) {
        // This is really unexpected if we allow resizing local IRTs...
        LOG(FATAL) << error_msg;
        UNREACHABLE();
      }
        
      // TODO: fix this to understand PushLocalFrame, so we can turn it on.
      if (false) {
        if (check_jni_) {
          size_t entry_count = locals_.Capacity();
          if (entry_count > 16) {
             locals_.Dump(LOG_STREAM(WARNING) << "Warning: more than 16 JNI local references: "
                                            << entry_count << " (most recent was a "
                                            << mirror::Object::PrettyTypeOf(obj) << ")/n");
          // TODO: LOG(FATAL) in a later release?
          }
        }
      }
        
      return reinterpret_cast<T>(ref);
    }
    复制代码

    若运行过程中 Add 过多就会溢出,为了防止溢出,我们需要调用 DeleteLocalRef 方法,内部调用了 locals_Remove

    static void DeleteLocalRef(JNIEnv* env, jobject obj) {
        if (obj == nullptr) {
          return;
        }
        // SOA is only necessary to have exclusion between GC root marking and removing.
        // We don't want to have the GC attempt to mark a null root if we just removed
        // it. b/22119403
        ScopedObjectAccess soa(env);
        auto* ext_env = down_cast<JNIEnvExt*>(env);
        if (!ext_env->locals_.Remove(ext_env->local_ref_cookie_, obj)) {
          // Attempting to delete a local reference that is not in the
          // topmost local reference frame is a no-op.  DeleteLocalRef returns
          // void and doesn't throw any exceptions, but we should probably
          // complain about it so the user will notice that things aren't
          // going quite the way they expect.
          LOG(WARNING) << "JNI WARNING: DeleteLocalRef(" << obj << ") "
                       << "failed to find entry";
        }
      }
    复制代码

    在函数运行结束,调用栈被 Pop 时,会执行以下内容:

    jni_env_ext.cc

    void JNIEnvExt::PopFrame() {
      locals_.SetSegmentState(local_ref_cookie_);
      local_ref_cookie_ = stacked_local_ref_cookies_.back();
      stacked_local_ref_cookies_.pop_back();
    }
    复制代码

    因此我们循环调用时,不会溢出。

3. GlobalReference

全局引用,如果我们希望在native层保存一个Java对象使用,那我们可以选择全局引用,全局引用的使用方式是 env->NewGlobalRef(obj) ,返回的虽然也是 jobject ,但它是一个全局引用,是可以保存下来后续使用的。

对于全局引用,我们需要妥善管理,每一个主动创建的全局引用在最后不使用时都要调用 env->DeleteGlobalRef(obj) 释放。否则也会导致溢出或者内存溢出。

  • 示例操作

类似于上述的 LocalRefrence 操作,我们循环创建全局引用进行测试,但是和上述的 LocalRefrence 操作不同的是,这里我们将创建 GlobalReference 的循环放在 Java 层进行验证

正确示例

extern "C" JNIEXPORT void
JNICALL
Java_com_wsy_jnidemo_test_ReferenceTest_createGlobalRef(
        JNIEnv *env,
        jclass) {
    jobject globalRef = env->NewGlobalRef(env->NewByteArray(1));
    env->DeleteGlobalRef(globalRef);
}
复制代码

错误示例

extern "C" JNIEXPORT void
JNICALL
Java_com_wsy_jnidemo_test_ReferenceTest_createGlobalRef(
        JNIEnv *env,
        jclass) {
    jobject globalRef = env->NewGlobalRef(env->NewByteArray(1));
}
复制代码

Java 代码

for (int i = 0; i < 50000000; i++) {
        ReferenceTest.createGlobalRef();
    }
复制代码

以如上的Java代码进行调用,错误示例的运行效果如下,引用表溢出

2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666] JNI ERROR (app bug): global reference table overflow (max=51200)global reference table dump:
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]   Last 10 entries (of 51200):
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51199: 0x13ac4c70 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51198: 0x13ac4c60 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51197: 0x13ac4c50 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51196: 0x13ac4c40 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51195: 0x13ac4c30 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51194: 0x13ac4c20 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51193: 0x13ac4c10 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51192: 0x13ac4c00 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51191: 0x13ac4bf0 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     51190: 0x13ac4be0 byte[] (1 elements)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]   Summary:
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]     50250 of byte[] (1 elements) (50250 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]       604 of java.nio.DirectByteBuffer (604 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]       317 of java.lang.Class (244 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         3 of android.opengl.EGLDisplay (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         3 of android.opengl.EGLSurface (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         3 of android.opengl.EGLContext (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         2 of dalvik.system.PathClassLoader (1 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         2 of java.lang.String (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         2 of java.lang.ThreadGroup (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         2 of java.lang.ref.WeakReference (2 unique instances)
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of com.qualcomm.qti.Performance$PerfServiceDeathRecipient
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of dalvik.system.VMRuntime
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.app.ActivityThread$ApplicationThread
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.os.Binder
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.view.inputmethod.InputMethodManager$ControlledInputConnectionWrapper
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.graphics.HardwareRenderer$ProcessInitializer$1
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.view.WindowManagerGlobal$1
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.view.inputmethod.InputMethodManager$1
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.hardware.display.DisplayManagerGlobal$DisplayManagerCallback
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.view.accessibility.AccessibilityManager$1
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.os.PersistableBundle$1
2019-12-28 10:58:26.301 2354-2415/com.wsy.jnidemo A/com.wsy.jnidem: java_vm_ext.cc:666]         1 of android.view.ViewRootImpl$W
复制代码
  • 源码解析

    和局部变量表不同,全局变量表对象定义在 java_vm_ext.h

    // Not guarded by globals_lock since we sometimes use SynchronizedGet in Thread::DecodeJObject.
      IndirectReferenceTable globals_;
    复制代码

    jni_internal.cc 中, NewGlobalRef 的实现如下,会调用JavaVM的 AddGlobalRef

    static jobject NewGlobalRef(JNIEnv* env, jobject obj) {
        ScopedObjectAccess soa(env);
        ObjPtr<mirror::Object> decoded_obj = soa.Decode<mirror::Object>(obj);
        return soa.Vm()->AddGlobalRef(soa.Self(), decoded_obj);
      }
    复制代码

    java_vm_ext.cc 中, AddGlobalRef 的实现如下,会添加全局引用到全局引用表中

    jobject JavaVMExt::AddGlobalRef(Thread *self, ObjPtr <mirror::Object> obj) {
        // Check for null after decoding the object to handle cleared weak globals.
        if (obj == nullptr) {
            return nullptr;
        }
        IndirectRef ref;
        std::string error_msg;
        {
            WriterMutexLock mu(self, *Locks::jni_globals_lock_);
            ref = globals_.Add(kIRTFirstSegment, obj, &error_msg);
        }
        if (UNLIKELY(ref == nullptr)) {
            LOG(FATAL) << error_msg;
            UNREACHABLE();
        }
        CheckGlobalRefAllocationTracking();
        return reinterpret_cast<jobject>(ref);
    }
    复制代码

    Add 的实现详见上述引用表的实现介绍,和局部引用表一样,若运行过程中添加的引用过多, globals_ 就会溢出,而且和局部引用表不同,对于全局引用表,在函数执行完时,其数据不会被移除,因此我们需要主动调用 DeleteGlobalRef 进行释放。为了防止溢出,我们需要调用 DeleteGlobalRef 方法,内部调用了 globals_Remove 函数。

    jni_internal.cc 中, DeleteGlobalRef 的实现如下

    static void DeleteGlobalRef(JNIEnv* env, jobject obj) {
        JavaVMExt* vm = down_cast<JNIEnvExt*>(env)->GetVm();
        Thread* self = down_cast<JNIEnvExt*>(env)->self_;
        vm->DeleteGlobalRef(self, obj);
      }
    复制代码

    java_vm_ext.cc 中, DeleteGlobalRef 的实现如下,会在 globals_ 表中移除全局引用对象

    void JavaVMExt::DeleteGlobalRef(Thread *self, jobject obj) {
        if (obj == nullptr) {
            return;
        }
        {
            WriterMutexLock mu(self, *Locks::jni_globals_lock_);
            if (!globals_.Remove(kIRTFirstSegment, obj)) {
                LOG(WARNING) << "JNI WARNING: DeleteGlobalRef(" << obj << ") "
                             << "failed to find entry";
            }
        }
        CheckGlobalRefAllocationTracking();
    }
    复制代码

4. WeakGlobalReference

全局弱引用,如果我们希望在native层保存一个Java对象使用,那我们也可以选择全局弱引用,全局弱引用的使用方式是 env->NewWeakGlobalRef(obj) ,返回的虽然也是 jobject ,但它是一个全局弱引用,是可以保存下来后续使用的。

对于全局弱引用,我们需要妥善管理,每一个主动创建的全局引用在最后不使用时都要调用 env->DeleteWeakGlobalRef(obj) 释放。否则也会导致溢出或者内存溢出。

  • 示例操作
  1. 在内部进行循环,使内存溢出

    Java

    ReferenceTest.createWeakGlobalRef();
    复制代码

    C++

    extern "C" JNIEXPORT void
    JNICALL
    Java_com_wsy_jnidemo_test_ReferenceTest_createWeakGlobalRef(
            JNIEnv *env,
            jclass) {
        for (int i = 0; i < 50000; i++) {
            jobject weakGlobalRef = env->NewWeakGlobalRef(env->NewByteArray(50000));
        }
    }
    复制代码

    日志如下

    2019-12-28 21:40:50.142 6391-6391/? A/DEBUG: Abort message: 'JNI DETECTED ERROR IN APPLICATION: JNI NewWeakGlobalRef called with pending exception java.lang.OutOfMemoryError: Failed to allocate a 50016 byte allocation with 880 free bytes and 880B until OOM, target footprint 536870912, growth limit 536870912
            at void com.wsy.jnidemo.test.ReferenceTest.createWeakGlobalRef() (ReferenceTest.java:-2)
            at void com.wsy.jnidemo.MainActivity.doReferenceTest() (MainActivity.java:66)
            at void com.wsy.jnidemo.MainActivity.access$000(com.wsy.jnidemo.MainActivity) (MainActivity.java:15)
            at void com.wsy.jnidemo.MainActivity$1.run() (MainActivity.java:45)
            at void java.lang.Thread.run() (Thread.java:919)
        
            in call to NewWeakGlobalRef
            from void com.wsy.jnidemo.test.ReferenceTest.createWeakGlobalRef()'
    复制代码
  2. 在外部进行循环,并不会造成内存溢出

    Java

    for (int i = 0; i < 50000; i++) {
            ReferenceTest.createWeakGlobalRef();
        }
    复制代码

    C++

    extern "C" JNIEXPORT void
        JNICALL
        Java_com_wsy_jnidemo_test_ReferenceTest_createWeakGlobalRef(
                JNIEnv *env,
                jclass) {
                jobject weakGlobalRef = env->NewWeakGlobalRef(env->NewByteArray(50000));
        }
    复制代码

    这样不会导致crash,因为局部引用表的的对象对应的 Java 对象会被 gc ,但是会造成引用表中会多出50000个对象,久而久之会造成引用表溢出。

  3. 在外部进行循环,使引用表溢出

    Java

    for (long i = 0; i < 2500000000L; i++) {
            ReferenceTest.createWeakGlobalRef();
        }
    复制代码

    C++

    extern "C" JNIEXPORT void
        JNICALL
        Java_com_wsy_jnidemo_test_ReferenceTest_createWeakGlobalRef(
                JNIEnv *env,
                jclass) {
                jobject weakGlobalRef = env->NewWeakGlobalRef(env->NewByteArray(1));
        }
    复制代码

    这样会造成引用表溢出,错误信息如下

    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG: Abort message: 'JNI ERROR (app bug): weak global reference table overflow (max=51200)weak global reference table dump:
          Last 10 entries (of 51200):
            51199: 0x133c8580 byte[] (1 elements)
            51198: 0x133c8570 byte[] (1 elements)
            51197: 0x133c8560 byte[] (1 elements)
            51196: 0x133c8550 byte[] (1 elements)
            51195: 0x133c8540 byte[] (1 elements)
            51194: 0x133c8530 byte[] (1 elements)
            51193: 0x133c8520 byte[] (1 elements)
            51192: 0x133c8510 byte[] (1 elements)
            51191: 0x133c8500 byte[] (1 elements)
            51190: 0x133c84f0 byte[] (1 elements)
          Summary:
            51163 of byte[] (1 elements) (51163 unique instances)
               27 of java.lang.DexCache (27 unique instances)
                9 of dalvik.system.PathClassLoader (6 unique instances)
                1 of java.lang.BootClassLoader
        '
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x0  0000000000000000  x1  0000000000001ef7  x2  0000000000000006  x3  0000007417e93890
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x4  fefeff740442df97  x5  fefeff740442df97  x6  fefeff740442df97  x7  7f7f7f7f7f7fffff
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x8  00000000000000f0  x9  d0dac69971875631  x10 0000000000000001  x11 0000000000000000
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x12 fffffff0fffffbdf  x13 ffffffffffffffff  x14 0000000000000004  x15 ffffffffffffffff
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x16 0000007505532738  x17 0000007505510be0  x18 000000741781c000  x19 0000000000001ec8
    2019-12-28 21:56:20.866 7937-7937/? A/DEBUG:     x20 0000000000001ef7  x21 00000000ffffffff  x22 000000747685e280  x23 0000007481cff1c3
    2019-12-28 21:56:20.867 7937-7937/? A/DEBUG:     x24 0000007481cdf247  x25 000000748221b000  x26 00000074822fd258  x27 000000748221b000
    2019-12-28 21:56:20.867 7937-7937/? A/DEBUG:     x28 0000000000000043  x29 0000007417e93930
    2019-12-28 21:56:20.867 7937-7937/? A/DEBUG:     sp  0000007417e93870  lr  00000075054c2404  pc  00000075054c2430
    复制代码
  • 源码阅读

    GlobalReference 不同, WeakGlobalReference 是可以被gc回收的,以下函数会在标记清除时被调用,

    void JavaVMExt::SweepJniWeakGlobals(IsMarkedVisitor *visitor) {
        MutexLock mu(Thread::Current(), *Locks::jni_weak_globals_lock_);
        Runtime *const runtime = Runtime::Current();
        for (auto *entry : weak_globals_) {
            // Need to skip null here to distinguish between null entries and cleared weak ref entries.
            if (!entry->IsNull()) {
                // Since this is called by the GC, we don't need a read barrier.
                mirror::Object *obj = entry->Read<kWithoutReadBarrier>();
                mirror::Object *new_obj = visitor->IsMarked(obj);
                if (new_obj == nullptr) {
                    new_obj = runtime->GetClearedJniWeakGlobal();
                }
                *entry = GcRoot<mirror::Object>(new_obj);
            }
        }
    }
    复制代码
原文  https://juejin.im/post/5e04b2236fb9a0162c487ef8
正文到此结束
Loading...