android System_server进成的GC线程卡死,无法退出GC

[wylandroid]

具体如图:
使用:top -t -m 5



system_server的GC线程卡住.


查询命令:debuggred -B 205(system_server进程号)
此命令可以打印出进程中所有线程的当前访问时的cpu执行代码地址.我们执行了300次,取得当前卡死的机器,system_server进程的GC线程执行情况:
"GC" sysTid=208
#00 pc 0007247a /system/lib/libdvm.so (mspace_inspect_all+103)
#01 pc 000726fd /system/lib/libdvm.so
#02 pc 000727a1 /system/lib/libdvm.so
#03 pc 00054969 /system/lib/libdvm.so
#04 pc 0000d248 /system/lib/libc.so (__thread_entry+72)
#05 pc 0000d3e0 /system/lib/libc.so (pthread_create+240)
通过命令:arm-eabi-addr2line -e out/target/product/panther_b20b/symbols/system/lib/libdvm.so -f -C 0007247a
执行结果:internal_inspect_all

/work/source/B20B/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5175


此命令是根据pc的地址,可以定位具体再libdvm.so的哪行代码.通过此方法我们对300个地址进行了去重复的操作,最后得出的结果:

/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5174
/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5175
/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5180
/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5181
/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5192
/home/wuheng/work/b20b/dalvik/vm/alloc/../../../bionic/libc/upstream-dlmalloc/malloc.c:5194
当时卡死的车机,发现是GC时,一直再这些行的代码上进行死循环的跑.没有能break出来.

具体代码:
static void internal_inspect_all(mstate m,
void(*handler)(void *start,
void *end,
size_t used_bytes,
void* callback_arg),
void* arg) {
if (is_initialized(m)) {
mchunkptr top = m->top;
msegmentptr s;
for (s = &m->seg; s != 0; s = s->next) {
mchunkptr q = align_as_chunk(s->base);
5174 while (segment_holds(s, q) && q->head != FENCEPOST_HEAD) {
mchunkptr next = next_chunk(q);
size_t sz = chunksize(q);
size_t used;
void* start;
if (is_inuse(q)) {
used = sz - CHUNK_OVERHEAD; /* must not be mmapped */
start = chunk2mem(q);
}
else {
used = 0;
if (is_small(sz)) { /* offset by possible bookkeeping */
start = (void*)((char*)q + sizeof(struct malloc_chunk));
}
else {
start = (void*)((char*)q + sizeof(struct malloc_tree_chunk));
}
}
if (start < (void*)next) /* skip if all space is bookkeeping */
handler(start, next, used, arg);
5194 if (q == top)
break;
q = next;
}
}
}
}

请大神帮忙看看,为什么一直在while循环里面出不来.

[wylandroid]

此图片为top -t 输出结果.

[feel_inn]

GC线程卡死，可能是你的堆损坏造成的，而堆损坏有两种，一种是libc中的堆损坏，一种是libdvm中的java堆损坏。较长见的堆损坏是内存越界操作，覆盖了其他chunk的头。