LeakCanary 原理解析

LeakCanary 是由 Square 开源的针对 Android 和 Java 的内存泄漏检测工具。

使用

LeakCanary 的集成过程很简单，首先在 build.gradle 文件中添加依赖：

dependencies {
  debugImplementation 'com.squareup.leakcanary:leakcanary-android:1.5.4'
  releaseImplementation 'com.squareup.leakcanary:leakcanary-android-no-op:1.5.4'
}

debug 和 release 版本中使用的是不同的库。LeakCanary 运行时会经常执行 GC 操作，在 release 版本中会影响效率。android-no-op 版本中基本没有逻辑实现，用于 release 版本。

然后实现自己的 Application 类：

public class ExampleApplication extends Application {

  @Override public void onCreate() {
    super.onCreate();
    if (LeakCanary.isInAnalyzerProcess(this)) {
      // This process is dedicated to LeakCanary for heap analysis.
      // You should not init your app in this process.
      return;
    }
    LeakCanary.install(this);
    // Normal app init code...
  }
}

这样就集成完成了。当 LeakCanary 检测到内存泄露时，会自动弹出 Notification 通知开发者发生内存泄漏的 Activity 和引用链，以便进行修复。

源码分析

从入口函数 LeakCanary.install(this) 开始分析：

LeakCanary.install

LeakCanary.java

/**
 * Creates a {@link RefWatcher} that works out of the box, and starts watching activity
 * references (on ICS+).
 */
public static RefWatcher install(Application application) {
  return refWatcher(application).listenerServiceClass(DisplayLeakService.class)
      .excludedRefs(AndroidExcludedRefs.createAppDefaults().build())
      .buildAndInstall();
}

LeakCanary.refWatcher

LeakCanary.java

/** Builder to create a customized {@link RefWatcher} with appropriate Android defaults. */
public static AndroidRefWatcherBuilder refWatcher(Context context) {
  return new AndroidRefWatcherBuilder(context);
}

refWatcher() 方法新建了一个 AndroidRefWatcherBuilder 对象，该对象继承于 RefWatcherBuilder 类，配置了一些默认参数，利用建造者构建一个 RefWatcher 对象。

AndroidRefWatcherBuilder.listenerServiceClass

AndroidRefWatcherBuilder.java

public AndroidRefWatcherBuilder listenerServiceClass(
    Class listenerServiceClass) {
  return heapDumpListener(new ServiceHeapDumpListener(context, listenerServiceClass));
}

RefWatcherBuilder.java

/** @see HeapDump.Listener */
public final T heapDumpListener(HeapDump.Listener heapDumpListener) {
  this.heapDumpListener = heapDumpListener;
  return self();
}

DisplayLeakService.java

/**
 * Logs leak analysis results, and then shows a notification which will start {@link
 * DisplayLeakActivity}.
 *
 * You can extend this class and override {@link #afterDefaultHandling(HeapDump, AnalysisResult,
 * String)} to add custom behavior, e.g. uploading the heap dump.
 */
public class DisplayLeakService extends AbstractAnalysisResultService {}

listenerServiceClass() 方法绑定了一个后台服务 DisplayLeakService，这个服务主要用来分析内存泄漏结果并发送通知。你可以继承并重写这个类来进行一些自定义操作，比如上传分析结果等。

RefWatcherBuilder.excludedRefs

RefWatcherBuilder.java

public final T excludedRefs(ExcludedRefs excludedRefs) {
  this.excludedRefs = excludedRefs;
  return self();
}

AndroidExcludedRefs.java

/**
 * This returns the references in the leak path that can be ignored for app developers. This
 * doesn't mean there is no memory leak, to the contrary. However, some leaks are caused by bugs
 * in AOSP or manufacturer forks of AOSP. In such cases, there is very little we can do as app
 * developers except by resorting to serious hacks, so we remove the noise caused by those leaks.
 */
public static ExcludedRefs.Builder createAppDefaults() {
  return createBuilder(EnumSet.allOf(AndroidExcludedRefs.class));
}

public static ExcludedRefs.Builder createBuilder(EnumSet refs) {
  ExcludedRefs.Builder excluded = ExcludedRefs.builder();
  for (AndroidExcludedRefs ref : refs) {
    if (ref.applies) {
      ref.add(excluded);
      ((ExcludedRefs.BuilderWithParams) excluded).named(ref.name());
    }
  }
  return excluded;
}

excludedRefs() 方法定义了一些对于开发者可以忽略的路径，意思就是即使这里发生了内存泄漏，LeakCanary 也不会弹出通知。这大多是系统 Bug 导致的，无需用户进行处理。

AndroidRefWatcherBuilder.buildAndInstall

最后调用 buildAndInstall() 方法构建 RefWatcher 实例并开始监听 Activity 的引用：

AndroidRefWatcherBuilder.java

/**
 * Creates a {@link RefWatcher} instance and starts watching activity references (on ICS+).
 */
public RefWatcher buildAndInstall() {
  RefWatcher refWatcher = build();
  if (refWatcher != DISABLED) {
    LeakCanary.enableDisplayLeakActivity(context);
    ActivityRefWatcher.install((Application) context, refWatcher);
  }
  return refWatcher;
}

看一下主要的 build() 和 install() 方法：

RefWatcherBuilder.build

RefWatcherBuilder.java

/** Creates a {@link RefWatcher}. */
 public final RefWatcher build() {
   if (isDisabled()) {
     return RefWatcher.DISABLED;
   }

   ExcludedRefs excludedRefs = this.excludedRefs;
   if (excludedRefs == null) {
     excludedRefs = defaultExcludedRefs();
   }

   HeapDump.Listener heapDumpListener = this.heapDumpListener;
   if (heapDumpListener == null) {
     heapDumpListener = defaultHeapDumpListener();
   }

   DebuggerControl debuggerControl = this.debuggerControl;
   if (debuggerControl == null) {
     debuggerControl = defaultDebuggerControl();
   }

   HeapDumper heapDumper = this.heapDumper;
   if (heapDumper == null) {
     heapDumper = defaultHeapDumper();
   }

   WatchExecutor watchExecutor = this.watchExecutor;
   if (watchExecutor == null) {
     watchExecutor = defaultWatchExecutor();
   }

   GcTrigger gcTrigger = this.gcTrigger;
   if (gcTrigger == null) {
     gcTrigger = defaultGcTrigger();
   }

   return new RefWatcher(watchExecutor, debuggerControl, gcTrigger, heapDumper, heapDumpListener,
           excludedRefs);
 }

build() 方法利用建造者模式构建 RefWatcher 实例，看一下其中的主要参数：

• watchExecutor : 线程控制器，在 onDestroy() 之后并且主线程空闲时执行内存泄漏检测
• debuggerControl : 判断是否处于调试模式，调试模式中不会进行内存泄漏检测
• gcTrigger : 用于 GC，watchExecutor 首次检测到可能的内存泄漏，会主动进行 GC，GC 之后会再检测一次，仍然泄漏的判定为内存泄漏，进行后续操作
• heapDumper : dump 内存泄漏处的 heap 信息，写入 hprof 文件
• heapDumpListener : 解析完 hprof 文件并通知 DisplayLeakService 弹出提醒
• excludedRefs : 排除可以忽略的泄漏路径

LeakCanary.enableDisplayLeakActivity

接下来就是最核心的 install() 方法，这里就开始观察 Activity 的引用了。在这之前还执行了一步操作，LeakCanary.enableDisplayLeakActivity(context); ：

public static void enableDisplayLeakActivity(Context context) {
  setEnabled(context, DisplayLeakActivity.class, true);
}

最后执行到 LeakCanaryInternals#setEnabledBlocking ：

public static void setEnabledBlocking(Context appContext, Class componentClass,
    boolean enabled) {
  ComponentName component = new ComponentName(appContext, componentClass);
  PackageManager packageManager = appContext.getPackageManager();
  int newState = enabled ? COMPONENT_ENABLED_STATE_ENABLED : COMPONENT_ENABLED_STATE_DISABLED;
  // Blocks on IPC.
  packageManager.setComponentEnabledSetting(component, newState, DONT_KILL_APP);
}

这里启用了 DisplayLeakActivity 并且显示应用图标。注意，这是指的不是你自己的应用图标，是一个单独的 LeakCanary 的应用，用于展示内存泄露历史的，入口函数是 DisplayLeakActivity，在 AndroidManifest.xml 中可以看到默认情况下 android:enabled="false" :

ActivityRefWatcher.install

ActivityRefWatcher.java

public static void install(Application application, RefWatcher refWatcher) {
  new ActivityRefWatcher(application, refWatcher).watchActivities();
}

public void watchActivities() {
  // Make sure you don't get installed twice.
  stopWatchingActivities();
  application.registerActivityLifecycleCallbacks(lifecycleCallbacks);
}

watchActivities() 方法中先解绑生命周期回调注册 lifecycleCallbacks，再重新绑定，避免重复绑定。lifecycleCallbacks 监听了 Activity 的各个生命周期，在 onDestroy() 中开始检测当前 Activity 的引用。

private final Application.ActivityLifecycleCallbacks lifecycleCallbacks =
    new Application.ActivityLifecycleCallbacks() {
      @Override public void onActivityCreated(Activity activity, Bundle savedInstanceState) {
      }

      @Override public void onActivityStarted(Activity activity) {
      }

      @Override public void onActivityResumed(Activity activity) {
      }

      @Override public void onActivityPaused(Activity activity) {
      }

      @Override public void onActivityStopped(Activity activity) {
      }

      @Override public void onActivitySaveInstanceState(Activity activity, Bundle outState) {
      }

      @Override public void onActivityDestroyed(Activity activity) {
        ActivityRefWatcher.this.onActivityDestroyed(activity);
      }
    };

    void onActivityDestroyed(Activity activity) {
      refWatcher.watch(activity);
    }

下面着重分析 RefWatcher 是如何检测 Activity 的。

RefWatcher.watch

调用 RefWatcher#watch 检测 Activity。 RefWatcher.java

/**
 * Identical to {@link #watch(Object, String)} with an empty string reference name.
 *
 * @see #watch(Object, String)
 */
public void watch(Object watchedReference) {
  watch(watchedReference, "");
}

/**
 * Watches the provided references and checks if it can be GCed. This method is non blocking,
 * the check is done on the {@link WatchExecutor} this {@link RefWatcher} has been constructed
 * with.
 *
 * @param referenceName An logical identifier for the watched object.
 */
public void watch(Object watchedReference, String referenceName) {
  if (this == DISABLED) {
    return;
  }
  checkNotNull(watchedReference, "watchedReference");
  checkNotNull(referenceName, "referenceName");
  final long watchStartNanoTime = System.nanoTime();
  String key = UUID.randomUUID().toString();
  retainedKeys.add(key);
  final KeyedWeakReference reference =
      new KeyedWeakReference(watchedReference, key, referenceName, queue);

  ensureGoneAsync(watchStartNanoTime, reference);
}

watch() 方法的参数是 Object ，LeakCanary 并不仅仅是针对 Android 的，它可以检测任何对象的内存泄漏，原理都是一致的。

这里出现了几个新面孔，先来了解一下各自是什么：

• retainedKeys : 一个 Set 集合，每个检测的对象都对应着一个唯一的 key，存储在 retainedKeys 中
• KeyedWeakReference : 自定义的弱引用，持有检测对象和对用的 key 值

final class KeyedWeakReference extends WeakReference