前言
今天收到一份崩溃日志，经过一番分析之后，找到了原因，但对于这个崩溃，由于堆栈暴露的信息不足，项目代码又多又乱，基本无法定位崩溃代码，要定位代码，就是体力活，也没什么好方法。尽管如此，分析过程还是值得分享。
堆栈
java.lang.NullPointerException: Attempt to read from field 'int android.view.View.mPrivateFlags' on a null object reference
at android.view.ViewGroup.resetCancelNextUpFlag(ViewGroup.java:2779)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2678)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3022)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2680)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3022)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2680)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:3022)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2680)
at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:536)
at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1829)
at android.app.Dialog.dispatchTouchEvent(Dialog.java:815)
at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:422)
at android.view.View.dispatchPointerEvent(View.java:12067)
at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:4976)
at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:4786)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4318)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4371)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4337)
at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:4464)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4345)
at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:4521)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4318)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4371)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4337)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4345)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4318)
at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:6912)
at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:6886)
at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:6843)
at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:7030)
at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:186)
at android.os.MessageQueue.nativePollOnce(Native Method)
at android.os.MessageQueue.next(MessageQueue.java:325)
at android.os.Looper.loop(Looper.java:142)
at android.app.ActivityThread.main(ActivityThread.java:6523)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:857)
本地不知道如何重现，只知道崩溃机器ROM版本为Android 8.0或8.1。
分析
遇到这种崩溃就会比较蛋疼，一方面是崩溃点在系统源码里，另一方面崩溃堆栈毫不涉及项目代码。这也就导致即便我们搞清楚了崩溃原因，也很难查清楚具体是项目里的哪行代码导致的崩溃。这就是我这次遇到的情况。
直接看崩溃堆栈的前面三行：
java.lang.NullPointerException: Attempt to read from field 'int android.view.View.mPrivateFlags' on a null object reference
at android.view.ViewGroup.resetCancelNextUpFlag(ViewGroup.java:2779)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2678)
这种问题肯定是要看源码的，我看的是8.0.0_r36版本的源码。
幸运的是崩溃的原因很清晰，就是下面的view为null，也就是说参数传进来就是null。
private static boolean resetCancelNextUpFlag(@NonNull View view) {
if ((view.mPrivateFlags & PFLAG_CANCEL_NEXT_UP_EVENT) != 0) {
view.mPrivateFlags &= ~PFLAG_CANCEL_NEXT_UP_EVENT;
return true;
}
return false;
}
dispatchTouchEvent中有三处对resetCancelNextUpFlag的调用，需要确定到底是哪个调用点崩了，由于崩溃点传参是null，因此只需要着重看那些参数可能为null的调用点。
第一处
final boolean canceled = resetCancelNextUpFlag(this)
|| actionMasked == MotionEvent.ACTION_CANCEL;
直接传this，一定不为null，所以不是崩溃点。
第二处
if (!canViewReceivePointerEvents(child)
|| !isTransformedTouchPointInView(x, y, child, null)) {
ev.setTargetAccessibilityFocus(false);
continue;
}
newTouchTarget = getTouchTarget(child);
if (newTouchTarget != null) {
// Child is already receiving touch within its bounds.
// Give it the new pointer in addition to the ones it is handling.
newTouchTarget.pointerIdBits |= idBitsToAssign;
break;
}
resetCancelNextUpFlag(child);
child首先作为参数传给了canViewReceivePointerEvents，如果child为null，早就崩了，因此传给resetCancelNextUpFlag的时候一定不为null，这里也不是崩溃点。
那剩下的那一处resetCancelNextUpFlag调用就是崩溃点了，这是好消息，缩小了调查范围。
第三处(崩溃点)
崩溃点附近的代码如下：
// Dispatch to touch targets, excluding the new touch target if we already
// dispatched to it. Cancel touch targets if necessary.
TouchTarget predecessor = null;
TouchTarget target = mFirstTouchTarget;
while (target != null) {
final TouchTarget next = target.next;
if (alreadyDispatchedToNewTouchTarget && target == newTouchTarget) {
handled = true;
} else {
final boolean cancelChild = resetCancelNextUpFlag(target.child)
|| intercepted;
if (dispatchTransformedTouchEvent(ev, cancelChild,
target.child, target.pointerIdBits)) {
handled = true;
}
if (cancelChild) {
if (predecessor == null) {
mFirstTouchTarget = next;
} else {
predecessor.next = next;
}
target.recycle();
target = next;
continue;
}
}
predecessor = target;
target = next;
}
可以看出，当崩溃发生时，target.child是null，那么我们的重点就在target.child是如何变为null的，首先就需要知道target是干什么的。
TouchTarget
由于我们的手机屏幕都支持多点触控，那么当用户同时用多个手指触摸屏幕的时候，产生的TouchEvent中就包含了多个触摸点的信息，一般我们把单个的触摸点就叫pointer，每个pointer都有它的pointer id。
TouchTarget用于记录一个被触摸的View，以及它所捕获的全部pointer。说白了，就是一个能处理TouchEvent的View，加上它处理的TouchEvent所属pointer的id。一个View能处理多个pointer产生的TouchEvent。
同时，在有多个pointer的情况下，不同的pointer产生的TouchEvent可能需要给不同的View处理，因此需要多个TouchTarget来记录这些信息，这些TouchTarget以链表的形式组织，每个TouchTarget都有一个next变量，指向另一个TouchTarget，链表尾的指向null。而TouchTarget的child变量，就是处理TouchEvent的View。
TouchTarget的添加
在dispatchTouchEvent方法中，会通过dispatchTransformedTouchEvent将调整后的TouchEvent派发给子View，如果子View感兴趣，会返回true，此时就会把该子View和它感兴趣的TouchEvent的pointer存储到TouchTarget中，加入链表作为表头存储，mFirstTouchTarget指向表头。这里有一点关键信息，后添加的TouchTarget是表头，也就是说，当我们先按住A按钮不松开，再按住B按钮不松开，此时表头的TouchTarget中child值指向B按钮。
TouchTarget的删除
当一个TouchTarget不捕获任何pointer的时候，如按在该View上的所有手指抬起时，该TouchTarget就会从链表中删除，并且执行recycle操作。
当调用ViewGroup#removeView移除某个子View时，ViewGroup会调用下面的方法，该方法不仅从链表中删除了TouchTarget，调用其recycle方法，还给它保存的View发了一个ACTION_CANCEL事件，使得View能清理各类状态。
private void cancelTouchTarget(View view) {
TouchTarget predecessor = null;
TouchTarget target = mFirstTouchTarget;
while (target != null) {
final TouchTarget next = target.next;
if (target.child == view) {
if (predecessor == null) {
mFirstTouchTarget = next;
} else {
predecessor.next = next;
}
target.recycle();
final long now = SystemClock.uptimeMillis();
MotionEvent event = MotionEvent.obtain(now, now,
MotionEvent.ACTION_CANCEL, 0.0f, 0.0f, 0);
event.setSource(InputDevice.SOURCE_TOUCHSCREEN);
view.dispatchTouchEvent(event);
event.recycle();
return;
}
predecessor = target;
target = next;
}
}
child置空时机
当TouchTarget#recycle被调用时，child被置空。
public void recycle() {
if (child == null) {
throw new IllegalStateException("already recycled once");
}
synchronized (sRecycleLock) {
......
child = null;
}
}
崩溃点反推
经过上面的分析，TouchTarget链表的增减逻辑正确，且所有的节点的recycle是与删除一起做的，这些操作都是在主线程完成的，因此只要是从链表中拿到的节点，child一定不为null。现在回头看一下崩溃点，在崩溃点反推代码的执行逻辑。
TouchTarget predecessor = null;
TouchTarget target = mFirstTouchTarget;
while (target != null) {
final TouchTarget next = target.next;
if (alreadyDispatchedToNewTouchTarget && target == newTouchTarget) {
handled = true;
} else {
final boolean cancelChild = resetCancelNextUpFlag(target.child)
|| intercepted;
if (dispatchTransformedTouchEvent(ev, cancelChild,
target.child, target.pointerIdBits)) {
handled = true;
}
if (cancelChild) {
if (predecessor == null) {
mFirstTouchTarget = next;
} else {
predecessor.next = next;
}
target.recycle();
target = next;
continue;
}
}
predecessor = target;
target = next;
}
现在假设resetCancelNextUpFlag处的参数target.child为null，反推代码执行情况。
while循环实际上就是顺着链表在分发TouchEvent。
第一轮循环
我们知道TouchTarget链表维护正确，因此当我们获取表头的时候，它的child一定不为null，所以至少是在循环体第二次执行的时候target.child才为null。循环体第二次执行的时候，target实际上是第一次循环中的next指向的B。
第二轮循环
在第二轮循环的时候target.child为null，则需要第一轮循环时next指向的TouchTarget的child变为null，当B被removeView的时候，就会导致next指向的TouchTarget被recycle，导致next.child为null，继而使得第二轮循环时target.child为null
在第一次循环的时候B有可能被removeView吗？
显然ViewGroup自身是不会在这种时候更改View的结构，但是方法中执行了dispatchTransformedTouchEvent，这个方法会分发TouchEvent给子View，子View的dispatchTouchEvent，onTouchEvent会得到执行，如果子View中尝试removeView，恰好移除next.child指向的View B，此时ViewGroup会删除链表中第二个节点，调整链表。
第一轮循环：B被删除
A链向C，A与B的链被切断。B的recycle被调用，B的child为null，因为在dispatchTransformedTouchEvent执行之前，next就已经指向B了，相当于next.child被置null。在第二次循环的时候，next被赋值给target，此时target.child为null，导致resetCancelNextUpFlag的参数为null。
由于在第二轮循环就能发生空指针，因此只需要两个TouchTarget就能复现崩溃：
两个TouchTarget即可复现
崩溃复现
理论推导完了，就需要实际写代码验证一下，我们需要两个可以处理TouchEvent的View，直接用两个Button就行，一个叫ButtonA，一个叫ButtonB，将这两个按钮添加到同一个ViewGroup中，在ButtonA的onTouchEvent中（dispatchTouchEvent也可以），当发现ACTION_UP时尝试从ViewGroup中删除ButtonB，为了方便，直接用一个Dialog来展示这个ViewGroup。代码如下：
Dialog dialog = new Dialog(context);
final LinearLayout linearLayout = new LinearLayout(context);
linearLayout.setOrientation(LinearLayout.VERTICAL);
final Button btnB = new Button(context);
btnB.setText("ButtonB");
linearLayout.addView(btnB, getParam());
Button btnA = new Button(context) {
@Override
public boolean onTouchEvent(MotionEvent event) {
if (event.getAction() == MotionEvent.ACTION_UP) {
linearLayout.removeView(btnB);
}
return super.onTouchEvent(event);
}
};
btnA.setText("ButtonA");
linearLayout.addView(btnA, getParam());
dialog.setContentView(linearLayout);
dialog.show();
运行的话可以看到如下界面，有两个按钮：
测试Dialog
由于被删除的是ButtonB，因此TouchTarget的表头应当是ButtonA，这个和上面的理论推导是一致的。
我们之前提到过后添加到链表里的TouchTarget是表头，也就是说我们需要ButtonA后添加到TouchTarget，因此我们应该这样操作来复现崩溃：
- 按住ButtonB，不松手
- 按住ButtonA，不松手
- 抬起按在ButtonA上的手指，触发removeView
在我们抬手指的一瞬间，App就会崩溃，崩溃堆栈如下：
java.lang.NullPointerException: Attempt to read from field 'int android.view.View.mPrivateFlags' on a null object reference
at android.view.ViewGroup.resetCancelNextUpFlag(ViewGroup.java:2743)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2648)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2961)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2650)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2961)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2650)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2961)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2650)
at android.view.ViewGroup.dispatchTransformedTouchEvent(ViewGroup.java:2961)
at android.view.ViewGroup.dispatchTouchEvent(ViewGroup.java:2650)
at com.android.internal.policy.DecorView.superDispatchTouchEvent(DecorView.java:445)
at com.android.internal.policy.PhoneWindow.superDispatchTouchEvent(PhoneWindow.java:1828)
at android.app.Dialog.dispatchTouchEvent(Dialog.java:815)
at com.android.internal.policy.DecorView.dispatchTouchEvent(DecorView.java:407)
at android.view.View.dispatchPointerEvent(View.java:11960)
at android.view.ViewRootImpl$ViewPostImeInputStage.processPointerEvent(ViewRootImpl.java:4776)
at android.view.ViewRootImpl$ViewPostImeInputStage.onProcess(ViewRootImpl.java:4590)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4128)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4181)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4147)
at android.view.ViewRootImpl$AsyncInputStage.forward(ViewRootImpl.java:4274)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4155)
at android.view.ViewRootImpl$AsyncInputStage.apply(ViewRootImpl.java:4331)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4128)
at android.view.ViewRootImpl$InputStage.onDeliverToNext(ViewRootImpl.java:4181)
at android.view.ViewRootImpl$InputStage.forward(ViewRootImpl.java:4147)
at android.view.ViewRootImpl$InputStage.apply(ViewRootImpl.java:4155)
at android.view.ViewRootImpl$InputStage.deliver(ViewRootImpl.java:4128)
at android.view.ViewRootImpl.deliverInputEvent(ViewRootImpl.java:6642)
at android.view.ViewRootImpl.doProcessInputEvents(ViewRootImpl.java:6616)
at android.view.ViewRootImpl.enqueueInputEvent(ViewRootImpl.java:6577)
at android.view.ViewRootImpl$WindowInputEventReceiver.onInputEvent(ViewRootImpl.java:6745)
at android.view.InputEventReceiver.dispatchInputEvent(InputEventReceiver.java:185)
at android.os.MessageQueue.nativePollOnce(Native Method)
at android.os.MessageQueue.next(MessageQueue.java:325)
at android.os.Looper.loop(Looper.java:142)
at android.app.ActivityThread.main(ActivityThread.java:6541)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.Zygote$MethodAndArgsCaller.run(Zygote.java:240)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:767)
基本上崩溃堆栈是一模一样的。当然，最好用原生ROM测试，我用小米4，一直不崩，搞的我一度怀疑我是不是没看清楚源码。换了Nexus Android 8.0之后立马就崩了。
当然也有其他方式可以干扰TouchTarget链表，removeView是开发者最容易利用的手段，因此基本可以确定崩溃的原因是在某些界面上，存在一个ViewA的dispatchTouchEvent或者onTouchEvent中尝试remove一个ViewB的情况，且ViewB所属TouchTarget刚好在TouchTarget链表中排在ViewA所属TouchTarget的后面。
结论
在事件分发时removeView导致该崩溃。
不要在事件分发，绘制，动画这类调用中removeView，否则很容易遇到这种ViewGroup内部崩溃。实在要removeView，可以往主线程post一下，并做好判空。
附录
之前只是对事件分发有大概的印象，为了分析这个崩溃，仔细看了事件分发的代码，放在这里给自己参考。
Android 8.0.0_r36 ViewGroup#dispatchTouchEvent源码阅读笔记：
@Override
public boolean dispatchTouchEvent(MotionEvent ev) {
if (mInputEventConsistencyVerifier != null) {// 这个只是用来检查TouchEvent是否连贯，不影响事件分发流程分析。
mInputEventConsistencyVerifier.onTouchEvent(ev, 1);
}
// If the event targets the accessibility focused view and this is it, start
// normal event dispatch. Maybe a descendant is what will handle the click.
if (ev.isTargetAccessibilityFocus() && isAccessibilityFocusedViewOrHost()) {// 看注释即可，事件的这个属性标志该事件是系统合成的，且要优先给accessibility view，如果当前view具有这种属性，就会清除标志。
ev.setTargetAccessibilityFocus(false);
}
boolean handled = false;// handled变量用于记录事件是否被处理了，返回给方法调用者，指示事件是否被处理了。
if (onFilterTouchEventForSecurity(ev)) {// 这里是一个较弱的检测，当View设置窗口有遮罩时滤除事件，且当前event带有窗口被遮罩的标识时，返回false，即该逻辑会导致所有分发到这里的事件被忽略掉。
final int action = ev.getAction();
final int actionMasked = action & MotionEvent.ACTION_MASK;// 本质上就是获取action，因为action里面有可能还有pointer_index信息，因此需要与ACTION_MASK做&运算
// Handle an initial down.
if (actionMasked == MotionEvent.ACTION_DOWN) {// 如果是ACTION_DOWN事件，意味着是最开始的事件，做一些清理工作，如注释所说，framework有可能没有分发up和cancel等事件过来。
// Throw away all previous state when starting a new touch gesture.
// The framework may have dropped the up or cancel event for the previous gesture
// due to an app switch, ANR, or some other state change.
cancelAndClearTouchTargets(ev);// 如果mFirstTouchTarget不为null，就会将事件分发给所有的TouchTarget，TouchTarget采用链表连接。分发完之后将TouchTarget链表置空，将mFirstTouchTarget置空。
// 将TouchTarget链表置空，将mFirstTouchTarget置空。重置PFLAG_CANCEL_NEXT_UP_EVENT标识，重置FLAG_DISALLOW_INTERCEPT，重置mNestedScrollAxes为SCROLL_AXIS_NONE
resetTouchState();
}
// Check for interception.
final boolean intercepted;
if (actionMasked == MotionEvent.ACTION_DOWN
|| mFirstTouchTarget != null) {
// 没有mFirstTouchTarget或者是ACTION_DOWN，且目前没有disallowIntercept，就会询问onInterceptTouchEvent是否拦截，onInterceptTouchEvent会在特定情况下返回true，比如是ACTION_DOWN的情况
final boolean disallowIntercept = (mGroupFlags & FLAG_DISALLOW_INTERCEPT) != 0;
if (!disallowIntercept) {
intercepted = onInterceptTouchEvent(ev);
ev.setAction(action); // restore action in case it was changed
} else {// 如果已经禁止拦截，则置intercepted false
intercepted = false;
}
} else {// 其他情况，我们都要拦截
// There are no touch targets and this action is not an initial down
// so this view group continues to intercept touches.
intercepted = true;
}
// If intercepted, start normal event dispatch. Also if there is already
// a view that is handling the gesture, do normal event dispatch.
if (intercepted || mFirstTouchTarget != null) {// 看上面注释即可，依然是取消FLAG_TARGET_ACCESSIBILITY_FOCUS
ev.setTargetAccessibilityFocus(false);
}
// Check for cancelation.
final boolean canceled = resetCancelNextUpFlag(this)// 要么是ViewGroup自己要求下次事件过来要取消，要么事件本身就是ACTION_CANCEL，都会给canceled赋值true
|| actionMasked == MotionEvent.ACTION_CANCEL;
// Update list of touch targets for pointer down, if needed.
final boolean split = (mGroupFlags & FLAG_SPLIT_MOTION_EVENTS) != 0;// split表示ViewGroup会在合适的时候把事件分给多个子view
TouchTarget newTouchTarget = null;
boolean alreadyDispatchedToNewTouchTarget = false;
if (!canceled && !intercepted) {// 既没有cancel掉，也不拦截的时候，执行以下分发逻辑
// If the event is targeting accessiiblity focus we give it to the
// view that has accessibility focus and if it does not handle it
// we clear the flag and dispatch the event to all children as usual.
// We are looking up the accessibility focused host to avoid keeping
// state since these events are very rare.
View childWithAccessibilityFocus = ev.isTargetAccessibilityFocus()// 如果事件要求优先给accessibilityFocus View处理，我们就找一个出来。
? findChildWithAccessibilityFocus() : null;
if (actionMasked == MotionEvent.ACTION_DOWN
|| (split && actionMasked == MotionEvent.ACTION_POINTER_DOWN)
|| actionMasked == MotionEvent.ACTION_HOVER_MOVE) {
final int actionIndex = ev.getActionIndex(); // always 0 for down
final int idBitsToAssign = split ? 1 << ev.getPointerId(actionIndex)// idBitsToAssign用于在一个变量里存PointerId，变量中可以存许多PointerId，idBitsToAssgin相当于一个flag值。
: TouchTarget.ALL_POINTER_IDS;
// Clean up earlier touch targets for this pointer id in case they
// have become out of sync.
// 顺着mFirstTouchTarget链表往后，挨个对比，如果有对应的idBitsToAssign，移除对应的bits，如果发现target.pointerIdBits == 0，从链表删除它
removePointersFromTouchTargets(idBitsToAssign);
final int childrenCount = mChildrenCount;// 这里直接取了mChildrenCount存到childrenCount里
if (newTouchTarget == null && childrenCount != 0) {// dispatchTouchEvent第一次进来，newTouchTarget一定为null，ViewGroup一般而言也有子view，因此会执行if逻辑
final float x = ev.getX(actionIndex);// 获取事件的坐标
final float y = ev.getY(actionIndex);
// Find a child that can receive the event.
// Scan children from front to back.
final ArrayList preorderedList = buildTouchDispatchChildList();// 构建一个child分发列表，按照Z顺序，绘制顺序降序排序，如果子View都没有Z轴的概念，则返回null
final boolean customOrder = preorderedList == null// 如果为true，则是按绘制顺序，因为child没有Z轴。false则没有绘制顺序的概念了。
&& isChildrenDrawingOrderEnabled();
final View[] children = mChildren;// 此处直接从mChildren获取子View们。
for (int i = childrenCount - 1; i >= 0; i--) {// 遍历使用我们保存的childrenCount遍历。
final int childIndex = getAndVerifyPreorderedIndex(// 获取第i个view的绘制顺序index
childrenCount, i, customOrder);
final View child = getAndVerifyPreorderedView(// 获取绘制顺序为index的view
preorderedList, children, childIndex);
// If there is a view that has accessibility focus we want it
// to get the event first and if not handled we will perform a
// normal dispatch. We may do a double iteration but this is
// safer given the timeframe.
if (childWithAccessibilityFocus != null) {// 如果存在childWithAccessibilityFocus，首先就找到这个child，然后执行下面的逻辑来处理
if (childWithAccessibilityFocus != child) {
continue;
}
childWithAccessibilityFocus = null;// 清空这个值
i = childrenCount - 1;// 这样保证再循环一次
}
if (!canViewReceivePointerEvents(child)// View只有在VISIBLE或者getAnimation不为null时，才能处理事件
|| !isTransformedTouchPointInView(x, y, child, null)) {// 把坐标转换成子view里的坐标，主要就是根据子view位置删减了一下坐标值
ev.setTargetAccessibilityFocus(false);// 处理不了事件，的情况，就continue，并且还将事件的FLAG_TARGET_ACCESSIBILITY_FOCUS清除
continue;
}
// 运行到此处，当前view能处理事件，且事件坐标也落在view里
newTouchTarget = getTouchTarget(child);// 在mFirstTouchTarget链表里面找child，找不到则返回null，找不到其实也表示它没有处理过这个pointerId的事件
if (newTouchTarget != null) {
// Child is already receiving touch within its bounds.
// Give it the new pointer in addition to the ones it is handling.
newTouchTarget.pointerIdBits |= idBitsToAssign;// 找到的情况下，给它的pointerIdBits加上此次事件的标识，就可以直接break出去了
break;
}
resetCancelNextUpFlag(child);// 事件是初始化事件，所以可以reset
if (dispatchTransformedTouchEvent(ev, false, child, idBitsToAssign)) {// 分析在下面
// Child wants to receive touch within its bounds.
// child#dispatchTouchEvent返回了true，下面继续处理逻辑
mLastTouchDownTime = ev.getDownTime();
if (preorderedList != null) {
// childIndex points into presorted list, find original index
for (int j = 0; j < childrenCount; j++) {
if (children[childIndex] == mChildren[j]) {
mLastTouchDownIndex = j;// 赋值上次TouchDown被处理的index，index是mChildren中的下标
break;
}
}
} else {
mLastTouchDownIndex = childIndex;
}
mLastTouchDownX = ev.getX();// 赋值mLastTouchDownX，mLastTouchDownY
mLastTouchDownY = ev.getY();
newTouchTarget = addTouchTarget(child, idBitsToAssign);// 将child加上TouchTarget，这个方法同时也会改变mFirstTouchTarget，会指向表头child
alreadyDispatchedToNewTouchTarget = true;// 已经派发给了新的TouchTarget
break;
}
// The accessibility focus didn't handle the event, so clear
// the flag and do a normal dispatch to all children.
ev.setTargetAccessibilityFocus(false);// 下次循环不会再管childWithAccessibilityFocus的事情了
}
if (preorderedList != null) preorderedList.clear();
}
if (newTouchTarget == null && mFirstTouchTarget != null) {
// Did not find a child to receive the event.
// Assign the pointer to the least recently added target.
newTouchTarget = mFirstTouchTarget;
while (newTouchTarget.next != null) {
newTouchTarget = newTouchTarget.next;
}
newTouchTarget.pointerIdBits |= idBitsToAssign;// 不明白为什么会把idBitsToAssign给TouchTarget的最后一个
}
}
}
// Dispatch to touch targets.
if (mFirstTouchTarget == null) {
// No touch targets so treat this as an ordinary view.
// 相当于直接分派给自己去处理了
handled = dispatchTransformedTouchEvent(ev, canceled, null,
TouchTarget.ALL_POINTER_IDS);
} else {
// Dispatch to touch targets, excluding the new touch target if we already
// dispatched to it. Cancel touch targets if necessary.
TouchTarget predecessor = null;
TouchTarget target = mFirstTouchTarget;
while (target != null) {
final TouchTarget next = target.next;
if (alreadyDispatchedToNewTouchTarget && target == newTouchTarget) {
handled = true;
} else {
final boolean cancelChild = resetCancelNextUpFlag(target.child)// reset这个TouchTarget的PFLAG_CANCEL_NEXT_UP_EVENT
|| intercepted;// 拦截的情况下也要cancel
if (dispatchTransformedTouchEvent(ev, cancelChild,
target.child, target.pointerIdBits)) {
handled = true;
}
if (cancelChild) {// 对于要cancel的child，从TouchTarget中移除
if (predecessor == null) {
mFirstTouchTarget = next;
} else {
predecessor.next = next;
}
target.recycle();
target = next;
continue;
}
}
predecessor = target;
target = next;
}
}
// Update list of touch targets for pointer up or cancel, if needed.
if (canceled
|| actionMasked == MotionEvent.ACTION_UP
|| actionMasked == MotionEvent.ACTION_HOVER_MOVE) {// 如果是cancel，up之类的，要恢复touch状态
resetTouchState();
} else if (split && actionMasked == MotionEvent.ACTION_POINTER_UP) {
final int actionIndex = ev.getActionIndex();
final int idBitsToRemove = 1 << ev.getPointerId(actionIndex);
removePointersFromTouchTargets(idBitsToRemove);// 移除所有TouchTarget中的idBitsToRemove
}
}
if (!handled && mInputEventConsistencyVerifier != null) {
mInputEventConsistencyVerifier.onUnhandledEvent(ev, 1);
}
return handled;
}
/**
* Transforms a motion event into the coordinate space of a particular child view,
* filters out irrelevant pointer ids, and overrides its action if necessary.
* If child is null, assumes the MotionEvent will be sent to this ViewGroup instead.
*/
private boolean dispatchTransformedTouchEvent(MotionEvent event, boolean cancel,
View child, int desiredPointerIdBits) {
final boolean handled;
// Canceling motions is a special case. We don't need to perform any transformations
// or filtering. The important part is the action, not the contents.
final int oldAction = event.getAction();// 这部分看注释就明白了
if (cancel || oldAction == MotionEvent.ACTION_CANCEL) {
event.setAction(MotionEvent.ACTION_CANCEL);
if (child == null) {
handled = super.dispatchTouchEvent(event);
} else {
handled = child.dispatchTouchEvent(event);
}
event.setAction(oldAction);
return handled;
}
// Calculate the number of pointers to deliver.
final int oldPointerIdBits = event.getPointerIdBits();
final int newPointerIdBits = oldPointerIdBits & desiredPointerIdBits;// 确定我们要传的是哪个PointerId
// If for some reason we ended up in an inconsistent state where it looks like we
// might produce a motion event with no pointers in it, then drop the event.
if (newPointerIdBits == 0) {// 不正确的情况需要抛弃
return false;
}
// If the number of pointers is the same and we don't need to perform any fancy
// irreversible transformations, then we can reuse the motion event for this
// dispatch as long as we are careful to revert any changes we make.
// Otherwise we need to make a copy.
final MotionEvent transformedEvent;
if (newPointerIdBits == oldPointerIdBits) {
if (child == null || child.hasIdentityMatrix()) {
if (child == null) {
handled = super.dispatchTouchEvent(event);
} else {
final float offsetX = mScrollX - child.mLeft;
final float offsetY = mScrollY - child.mTop;
event.offsetLocation(offsetX, offsetY);// 事件的坐标偏移到子view的坐标系内
handled = child.dispatchTouchEvent(event);
event.offsetLocation(-offsetX, -offsetY);// 分发完成后事件的坐标需要偏移回来
}
return handled;
}
transformedEvent = MotionEvent.obtain(event);
} else {
transformedEvent = event.split(newPointerIdBits);// 拆出一个pointerid作为转换后的event
}
// Perform any necessary transformations and dispatch.
if (child == null) {
handled = super.dispatchTouchEvent(transformedEvent);
} else {
final float offsetX = mScrollX - child.mLeft;
final float offsetY = mScrollY - child.mTop;
transformedEvent.offsetLocation(offsetX, offsetY);// 对于transformedEvent，偏移后不需要偏移回来，因为实例是我们自己的
if (! child.hasIdentityMatrix()) {
transformedEvent.transform(child.getInverseMatrix());
}
handled = child.dispatchTouchEvent(transformedEvent);
}
// Done.
transformedEvent.recycle();// 回收TouchEvent
return handled;
}