Matrix-ResourceCanary解析

static std::optional<std::vector<LeakChain>>
execute_analyze(const char *hprof_path, const char *reference_key) {
    ...
    const int hprof_fd = open(hprof_path, O_RDONLY);
    ...
    HprofAnalyzer::SetErrorListener(analyzer_error_listener);
    HprofAnalyzer analyzer(hprof_fd);

    ...
    return analyzer.Analyze([reference_key](const HprofHeap &heap) {
        // 从hprof中获取到类com.tencent.matrix.resource.analyzer.model.DestroyedActivityInfo的class id
        // 实际上也是先从字符串池中找到字符串id，然后通过字符串id在LOAD CLASS中找到class id
        const object_id_t leak_ref_class_id = unwrap_optional(
                heap.FindClassByName(
                        "com.tencent.matrix.resource.analyzer.model.DestroyedActivityInfo"),
                return std::vector<object_id_t>());
        std::vector<object_id_t> leaks;
        // 获取到DestroyedActivityInfo类的所有实例id，来源是INSTANCE DUMP或者OBJECT ARRAY DUMP
        for (const object_id_t leak_ref: heap.GetInstances(leak_ref_class_id)) {
            // 获取到DestroyedActivityInfo#mKey的值，这是一个字符串对象，所以保存的是对象id
            // 字符串对象的value数组是一个基本类型数组，值会保存在PRIMITIVE ARRAY DUMP中
            const object_id_t key_string_id = unwrap_optional(
                    heap.GetFieldReference(leak_ref, "mKey"), continue);
            // 从INSTANCE DUMP中获取到字符串对象的数据，解析出value所对应的object id
            // 然后在PRIMITIVE ARRAY DUMP中进行解析，最后得到字符串的字面量
            const std::string &key_string = unwrap_optional(
                    heap.GetValueFromStringInstance(key_string_id), continue);
            // 如果解析出来的mKey的字面量不是发生泄露的那个Activity，则过滤掉
            if (key_string != reference_key)
                continue;
            // 获取到DestroyedActivityInfo#mActivityRef的值，这是一个弱引用
            const object_id_t weak_ref = unwrap_optional(
                    heap.GetFieldReference(leak_ref, "mActivityRef"), continue);
            // 获取到mActivityRef.referent的值，加入到leaks集合中
            const object_id_t leak = unwrap_optional(
                    heap.GetFieldReference(weak_ref, "referent"), continue);
            leaks.emplace_back(leak);
        }
        return leaks;
    });
}

std::vector<LeakChain>
HprofAnalyzerImpl::Analyze(
      const std::function<std::vector<object_id_t>(const HprofHeap &)> &leak_finder) {
  internal::heap::Heap heap;
  internal::reader::Reader reader(reinterpret_cast<const uint8_t *>(data_), data_size_);
  parser_->Parse(reader, heap, exclude_matcher_group_);
  // leak_finder(HprofHeap(new HprofHeapImpl(heap)))得到的就是leaks集合
  return Analyze(heap, leak_finder(HprofHeap(new HprofHeapImpl(heap))));
}

std::vector<LeakChain> HprofAnalyzerImpl::Analyze(const internal::heap::Heap &heap,
                                                const std::vector<object_id_t> &leaks) {
  const auto chains = ({
      const HprofHeap hprof_heap(new HprofHeapImpl(heap));
      // 解析出leaks的引用链数组
      internal::analyzer::find_leak_chains(heap, leaks);
  });
  // 将原始的引用链数组转为LeakChain对象
  std::vector<LeakChain> result;
  for (const auto&[_, chain]: chains) {
      const std::optional<LeakChain> leak_chain = BuildLeakChain(heap, chain);
      if (leak_chain.has_value()) result.emplace_back(leak_chain.value());
  }
  return std::move(result);
}

std::map<heap::object_id_t, std::vector<std::pair<heap::object_id_t, std::optional<heap::reference_t>>>>
find_leak_chains(const heap::Heap &heap, const std::vector<heap::object_id_t> &tracked) {

  /* Use Breadth-First Search algorithm to find all the references to tracked objects. */

  std::map<heap::object_id_t, std::vector<std::pair<heap::object_id_t, std::optional<heap::reference_t>>>> ret;

  for (const auto &leak: tracked) {
      // 保存对象id->ref_node_t的映射
      std::map<heap::object_id_t, ref_node_t> traversed;
      // 双端队列，BFS算法用到的结构
      std::deque<ref_node_t> waiting;

      // 从GC Root出发，构建引用链
      for (const heap::object_id_t gc_root: heap.GetGcRoots()) {
          ref_node_t node = {
                  .referent_id = gc_root,
                  .super = std::nullopt,
                  .depth = 0
          };
          traversed[gc_root] = node;
          // 将所有的GC Roots加入到waiting中
          waiting.push_back(node);
      }

      bool found = false;
      while (!waiting.empty()) {
          // waiting的队头数据
          const ref_node_t node = waiting.front();
          waiting.pop_front();
          const heap::object_id_t referrer_id = node.referent_id;
          // 判断整个hprof中是否存在引用者为referrer_id的引用关系
          // 这些引用关系构建时依靠于CLASS DUMP里面的static field、INSTANCE DUMP里面的值以及OBJECT ARRAY DUMP里面的值
          if (heap.GetLeakReferenceGraph().count(referrer_id) == 0) continue;
          // 依次遍历这些引用关系
          for (const auto &[referent, reference]: heap.GetLeakReferenceGraph().at(referrer_id)) {
              try {
                  // 这里判断深度是为了获取最短引用路径
                  // 如果traversed.at(referent)没有取到数据，会抛出out_of_range异常
                  if (traversed.at(referent).depth <= node.depth + 1) continue;
              } catch (const std::out_of_range &) {}
              // 构建下一层的引用链，super是用来溯源用的
              ref_node_t next_node = {
                      .referent_id = referent,
                      .super = ref_super_t{
                              .referrer_id = referrer_id,
                              .reference = reference
                      },
                      .depth = node.depth + 1
              };
              traversed[referent] = next_node;
              // 如果两个对象相等，说明找到了一条引用路径，此时跳转到traverse_complete，进行溯源
              if (leak == referent) {
                  found = true;
                  goto traverse_complete;
              } else {
                  waiting.push_back(next_node);
              }
          }
      }
      traverse_complete:
      if (found) {
          ret[leak] = std::vector<std::pair<heap::object_id_t, std::optional<heap::reference_t>>>();
          std::optional<heap::object_id_t> current = leak;
          std::optional<heap::reference_t> current_reference = std::nullopt;
          // 进行溯源，完成之后ret[leak]里面保存的是从leak开始，到GC ROOT结束的引用链
          while (current != std::nullopt) {
              ret[leak].push_back(std::make_pair(current.value(), current_reference));
              const auto &super = traversed.at(current.value()).super;
              if (super.has_value()) {
                  current = super.value().referrer_id;
                  current_reference = super.value().reference;
              } else {
                  current = std::nullopt;
              }
          }
          // 对这条引用链进行翻转，使其从GC ROOT开始
          std::reverse(ret[leak].begin(), ret[leak].end());
      }
  }

  return std::move(ret);
}