你的debug包在Android 14变卡了吗 ｜ 得物技术

一

背景

发现怀疑点

排查怀疑点

void Runtime::SetRuntimeDebugState(RuntimeDebugState state) {  if (state != RuntimeDebugState::kJavaDebuggableAtInit) {    // We never change the state if we started as a debuggable runtime.    DCHECK(runtime_debug_state_ != RuntimeDebugState::kJavaDebuggableAtInit);  }  runtime_debug_state_ = state;}

排查native耗时

那就想着从debuggable的源头入手，逐步缩小范围定位影响变量。

AndroidManifest中的debuggable影响系统system进程启动我们进程中的一个runtimeFlags。

frameworks/base/core/java/android/os/Process.java 中的start方法 其中第6个参数就是runtimeFlags而如果是debuggableFlag runtimeFlags会被添加以下一些flag 那就先缩小标签范围。

 if (debuggableFlag) {                runtimeFlags |= Zygote.DEBUG_ENABLE_JDWP;                runtimeFlags |= Zygote.DEBUG_ENABLE_PTRACE;                runtimeFlags |= Zygote.DEBUG_JAVA_DEBUGGABLE;                // Also turn on CheckJNI for debuggable apps. It's quite                // awkward to turn on otherwise.                runtimeFlags |= Zygote.DEBUG_ENABLE_CHECKJNI;
                // Check if the developer does not want ART verification                if (android.provider.Settings.Global.getInt(mService.mContext.getContentResolver(),                        android.provider.Settings.Global.ART_VERIFIER_VERIFY_DEBUGGABLE, 1) == 0) {                    runtimeFlags |= Zygote.DISABLE_VERIFIER;                    Slog.w(TAG_PROCESSES, app + ": ART verification disabled");                }            }

需要修改我们进程的启动参数。那就需要去hook system进程了。这边涉及到手机root，安装hook框架的一些操作，然后通过hook Process的start去做一些参数修改。

hookAllMethods(        Process.class,        "start",        new XC_MethodHook() {            @Override            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {                final String niceName = (String) param.args[1];                final int uid = (int) param.args[2];                final int runtimeFlags = (int) param.args[5];                XposedBridge.log("process_xx " + runtimeFlags);                if (isDebuggable(niceName, user)) {                    param.args[5] = runtimeFlags&~DEBUG_JAVA_DEBUGGABLE;                    XposedBridge.log("process_xx " + param.args[5]);
                }            }        });

这次还是有一些明显的结果的。测试包 runtimeflags 移除DEBUG_JAVA_DEBUGGABLE后不卡了。而生产包包括应用市场上的应用加上DEBUG_JAVA_DEBUGGABLE标记后全部都变卡了。那就可以证明是DEBUG_JAVA_DEBUGGABLE这个变量引起的。

继续源码观察DEBUG_JAVA_DEBUGGABLE带来的影响。

if ((runtime_flags & DEBUG_JAVA_DEBUGGABLE) != 0) {    runtime->AddCompilerOption("--debuggable");    runtime_flags |= DEBUG_GENERATE_MINI_DEBUG_INFO;    runtime->SetRuntimeDebugState(Runtime::RuntimeDebugState::kJavaDebuggableAtInit);    {      // Deoptimize the boot image as it may be non-debuggable.      ScopedSuspendAll ssa(__FUNCTION__);      runtime->DeoptimizeBootImage();    }    runtime_flags &= ~DEBUG_JAVA_DEBUGGABLE;    needs_non_debuggable_classes = true;  }

这里有逻辑是DEBUG_JAVA_DEBUGGABLE带来的影响点，SetRuntimeDebugState之前已经测试过了。也不是DEBUG_GENERATE_MINI_DEBUG_INFO带来的影响，那是runtime->DeoptimizeBootImage()？于是我用debugable为false的包通过_ZN3art7Runtime19DeoptimizeBootImageEv主动去调用了DeoptimizeBootImage方法，然后复现了！

验证是系统问题

反馈问题

三

临时解决

void Instrumentation::UpdateEntrypointsForDebuggable() {  Runtime* runtime = Runtime::Current();  // If we are transitioning from non-debuggable to debuggable, we patch  // entry points of methods to remove any aot / JITed entry points.  InstallStubsClassVisitor visitor(this);  runtime->GetClassLinker()->VisitClasses(&visitor);}

Java_test_ArtMethodTrace_bootImageNterp(JNIEnv *env,                                                      jclass clazz) {    void *handler = shadowhook_dlopen("libart.so");    instance_ = static_cast<void **>(shadowhook_dlsym(handler, "_ZN3art7Runtime9instance_E"));    jobject    (*getSystemThreadGroup)(void *runtime) =(jobject (*)(void *runtime)) shadowhook_dlsym(handler,                                                                                          "_ZNK3art7Runtime20GetSystemThreadGroupEv");    void    (*UpdateEntrypointsForDebuggable)(void *instrumentation) = (void (*)(void *i)) shadowhook_dlsym(            handler,            "_ZN3art15instrumentation15Instrumentation30UpdateEntrypointsForDebuggableEv");    if (getSystemThreadGroup == nullptr || UpdateEntrypointsForDebuggable == nullptr) {        LOGE("getSystemThreadGroup  failed ");        shadowhook_dlclose(handler);        return;    }    jobject thread_group = getSystemThreadGroup(*instance_);    int vm_offset = findOffset(*instance_, 0, 4000, thread_group);    if (vm_offset < 0) {        LOGE("vm_offset not found ");        shadowhook_dlclose(handler);        return;    }    void (*setRuntimeDebugState)(void *instance_, int r) =(void (*)(void *runtime,                                                                    int r)) shadowhook_dlsym(            handler, "_ZN3art7Runtime20SetRuntimeDebugStateENS0_17RuntimeDebugStateE");    if (setRuntimeDebugState != nullptr) {        setRuntimeDebugState(*instance_, 0);    }    void *instrumentation = reinterpret_cast<void *>(reinterpret_cast<char *>(*instance_) +                                                     vm_offset - 368 );
    UpdateEntrypointsForDebuggable(instrumentation);    setRuntimeDebugState(*instance_, 2);    shadowhook_dlclose(handler);    LOGE("bootImageNterp success");
}

四

最后