libflutter.so引擎崩溃异常堆栈分析

一、Flutter引擎崩溃

Flutter的引擎部分全部使用C/C++实现，为了减少包大小，所有的SO库在发布时都会去除符号表信息。和其他的JNI崩溃堆栈一样，我们上报的堆栈信息中只能看到内存地址偏移量等信息，例如如下崩溃：

image.png

可以看到，由于发布时去除了符号表信息，所以线上的异常我们只能看到内存的偏移量，无法看到C代码的堆栈，此时需要将flutter的对应引擎版本的符号表下载下来，然后对堆栈进行解析。

二、符号表下载

首先你需要找到你线上Flutter的版本对应的引擎版本，即/../flutter/bin/internal/engine.version，如1.17.5的引擎版本为：ee76268252c22f5c11e82a7b87423ca3982e51a7.然后去下载对应flutter引擎的符号表文件

image.png

看到该版本对应的所有构建产物，一般32位下载android-arm-release，64位下载android-arm64-release，android-x86是在模拟器上，一般不需要。

image.png

symbols.zip解压后的so即为带符号的libflutter.so：

截屏2021-02-24 下午5.16.27.png

三、NDK分析native crash

1.下载NDK
2.解压，cd进入到ndk目录
3.将Crash信息拷贝到新建的stacktrace.txt（注意需要带上行号，否则会无法正常输出解析后的堆栈信息）
stacktrace.txt

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Crash time: 2021-02-24 23:09:29
pid: 31835 (com.xxx.app.mall), tid: 31835 (ngdong.app.mall)

Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
    r0  00000000  r1  00007c5b  r2  00000006  r3  ff7f2198
    r4  ff7f21ac  r5  ff7f2190  r6  00007c5b  r7  0000016b
    r8  ff7f21a8  r9  ff7f2198  r10 ff7f21c8  r11 ff7f21b8
    ip  00007c5b  sp  ff7f2168  lr  f39d8e0b  pc  f39d8e1e

caused by: 
    SIGABRT(-1) Abort

backtrace:
    #00 pc 00056e1e  /apex/com.android.runtime/lib/bionic/libc.so (abort+165)
    #01 pc 00151a16  /data/data/com.qihoo.magicmutiple/Plugin/com.xxxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so
    #02 pc 0017b80e  /data/data/com.qihoo.magicmutiple/Plugin/com.xxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so
    #03 pc 001481e6  /data/data/com.qihoo.magicmutiple/Plugin/com.xxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so
    #04 pc 000dc51a  /apex/com.android.runtime/lib/libart.so

4.执行命令：
ndk-stack -sym ../path/symbols/armeabi-v7a -dump ../path/stacktrace.txt

image.png

5.获取到解析的结果

image.png

********** Crash dump: **********

#00 0x00056e1e /apex/com.android.runtime/lib/bionic/libc.so (abort+165)
#01 0x00151a16 /data/data/com.qihoo.magicmutiple/Plugin/com.xxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so

fml::LogMessage::~LogMessage()

/b/s/w/ir/cache/builder/src/out/android_release/../../flutter/fml/logging.cc:92:5

#02 0x0017b80e /data/data/com.qihoo.magicmutiple/Plugin/com.xxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so

std::__1::shared_ptr::get() const

/b/s/w/ir/cache/builder/src/out/android_release/../../third_party/libcxx/include/memory:3800:49
flutter::DartVMRef::operator->()

/b/s/w/ir/cache/builder/src/out/android_release/../../flutter/runtime/dart_vm_lifecycle.h:58:0

flutter::Shell::Create(flutter::TaskRunners, flutter::WindowData, flutter::Settings, std::__1::function > (flutter::Shell&)>, std::__1::function > (flutter::Shell&)>)

/b/s/w/ir/cache/builder/src/out/android_release/../../flutter/shell/common/shell.cc:270:0

#03 0x001481e6 /data/data/com.qihoo.magicmutiple/Plugin/com.xxx.app.mall/data/com.xxx.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so

std::__1::unique_ptr >::release()

/b/s/w/ir/cache/builder/src/out/android_release/../../third_party/libcxx/include/memory:2583:26

std::__1::unique_ptr >::operator=(std::__1::unique_ptr >&&)

/b/s/w/ir/cache/builder/src/out/android_release/../../third_party/libcxx/include/memory:2512:0

flutter::AndroidShellHolder::AndroidShellHolder(flutter::Settings, fml::jni::JavaObjectWeakGlobalRef, bool)

/b/s/w/ir/cache/builder/src/out/android_release/../../flutter/shell/platform/android/android_shell_holder.cc:110:0

std::__1::__unique_if::__unique_single std::__1::make_unique(flutter::Settings const&, fml::jni::JavaObjectWeakGlobalRef&, unsigned char&)

/b/s/w/ir/cache/builder/src/out/android_release/../../third_party/libcxx/include/memory:3003:0
flutter::AttachJNI(_JNIEnv*, _jclass*, _jobject*, unsigned char)

/b/s/w/ir/cache/builder/src/out/android_release/../../flutter/shell/platform/android/platform_view_android_jni.cc:153:0

#04 0x000dc51a /apex/com.android.runtime/lib/libart.so
Crash dump is completed

6.addr2line工具输出异常代码的行数

  #01 pc 00151a16  /data/data/com.qihoo.magicmutiple/Plugin/com.jingdong.app.mall/data/com.xxxx.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so
    #02 pc 0017b80e  /data/data/com.qihoo.magicmutiple/Plugin/com.xxxx.mall/data/com.jingdong.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so
    #03 pc 001481e6  /data/data/com.qihoo.magicmutiple/Plugin/com.xxxx.mall/data/com.jingdong.app.mall/files/aura/com.jd.lib.jdflutter/package_90040/lib/libflutter.so

解析步骤：
cd ../android-ndk-r21e/toolchains/aarch64-linux-android-4.9/prebuilt/darwin-x86_64/bin/aarch64-linux-android-addr2line

aarch64-linux-android-addr2line -e ../symbols/armeabi-v7a/libflutter.so -a 00151a16 0017b80e 001481e6

image.png

参考文章：
Flutter原理及美团的实践
libflutter.so崩溃堆栈还原