ContentProvider--stable参数

悠悠 2022-05-11 05:52 150阅读 0赞

先总结一下，在ActivityThread\#acquireProvider（...）获取IContentProvider时，stable参数不影响是否能取得这个IContentProvider。首先这个stable reCountf和unstable refCount在本地会保存一份，而且会保存在一个IBinder对象中，类型是ContentProviderConnection，在AMS中，ProcessRecord会保存该进程的所有ContentProviderConnection的Bn端。

无论是使用ContentResolver的insert，delete，update，query，首先都会去acquireProvider（...）或者acquireUnstableProvider（...）,而选择Unstable还是Stable，取决于你是做什么操作，就是选择insert还是delete或者update和query。其中query首先是去acquireUnstableProvider，在向AMS获取IContentProvider之前，会先在本地查询是否有保存这个authority对应的IContentProvider，如果有则不用向AMS获取。

insert，delete，update操作都是首先使用acquireProvider，就增加的是stable refCount。而只有query操作是例外，先是使用acquireUnstableProvider，如果使用获取到的IContentProvider去做query操作时，发现抛DeadObjectException，即目标CP所在进程已死。那么就使用acquireProvider重新获取IContentProvider，并增加stable refCount。

在完成insert，query等方法时，都会去调用releaseProvider方法，而这个方法就涉及到refCount的操作，refCount又分为stable和unstable。而releaseProvider并不一定会导致缓存的IContentProvider被remove和AMS中的ProcessRecord（客户端进程）中和ContentProviderRecord（目标ContentProvider在AMS中的代表）中的ContentProviderConnection会被移除。主要要看stable refCount和unstable refCount是否都为0，如果是则调用ActivityThread\#completeRemoveProvider（...）

ActivityThread的releaseProvider函数调用后，如果ProviderRefCount的unstableCount和stableCount同时为0，会导致completeRemoveProvider被调用，然后调用AMS的removeContentProvider移除对应的Content Provider Connection。如果ActivityThread的releaseProvider调用后，使得unstableCount或者stableCount从非0变为0，那么将调用refContentProvider(IBinder connection, int stable, int unstable)，以改变AMS中的ContentProviderConnection\#unstableCount或者stableCount。ContentProviderConnection中的unstableCount或者stableCount值最大为1。当refContentProvider的unstableCount或者stableCount为0，那么ContentProviderConnection中的unstableCount或者stableCount值也变为0。当refContentProvider的unstableCount或者stableCount>=1时, ContentProviderConnection中的unstableCount或者stableCount的值为1。

只有query同其他操作同时进行时，ContentProviderConnection的unstableCount和stableCount才会同时为1

在本地没有缓存IContentProvider时，从AMS中获取到IContentProvider后，会进行installProvider操作。installProvider 中会增加refCount，操作refCount的方法是ActivityThread\#incProviderRefLocked（）。

在目标CP进程死后，AMS会去调用removeDyingProviderLocked，其中会根据ContentProviderConnection的stableCount和unstableCount处理引用该CP的进程。如果stableCount不为0，则杀死该客户进程。如果stableCount为0，而unstableCount不为0，则通过ApplicationThread\#unstableProviderDied通知客户进程，并从ContentProviderRecord中移除该ContentProviderConnection。

![70][]

下面开始分析源码：

ContentResolver\#query（...）:

public final @Nullable Cursor query(final @NonNull Uri uri, @Nullable String[] projection,
                @Nullable String selection, @Nullable String[] selectionArgs,
                @Nullable String sortOrder, @Nullable CancellationSignal cancellationSignal) {
            Preconditions.checkNotNull(uri, "uri");
    //首先去使用unstable的方式获取IContentProvider。即向对应Connection的unstableRefCount加1
    //如果有缓存就直接在缓存拿，如果是首次获取，则向AMS获取。
            IContentProvider unstableProvider = acquireUnstableProvider(uri);
            if (unstableProvider == null) {
                return null;
            }
            IContentProvider stableProvider = null;
            Cursor qCursor = null;
            try {
                long startTime = SystemClock.uptimeMillis();
    
                ICancellationSignal remoteCancellationSignal = null;
                if (cancellationSignal != null) {
                    cancellationSignal.throwIfCanceled();
                    remoteCancellationSignal = unstableProvider.createCancellationSignal();
                    cancellationSignal.setRemote(remoteCancellationSignal);
                }
                try {
    //通过binder通信直接与目标CP通信并获取Cursor
                    qCursor = unstableProvider.query(mPackageName, uri, projection,
                            selection, selectionArgs, sortOrder, remoteCancellationSignal);
                } catch (DeadObjectException e) {
                    // The remote process has died...  but we only hold an unstable
                    // reference though, so we might recover!!!  Let's try!!!!
                    // This is exciting!!1!!1!!!!1
    //如果目标CP所在进程已死，则抛这异常，此时将通过该方法处理这个缓存的Bp
                    unstableProviderDied(unstableProvider);
    //通过stable的方式获取IContentProvider，即向对应的connection的stableRefCount加1
                    stableProvider = acquireProvider(uri);
                    if (stableProvider == null) {
                        return null;
                    }
                    qCursor = stableProvider.query(mPackageName, uri, projection,
                            selection, selectionArgs, sortOrder, remoteCancellationSignal);
                }
                if (qCursor == null) {
                    return null;
                }
    
                // Force query execution.  Might fail and throw a runtime exception here.
                qCursor.getCount();
                long durationMillis = SystemClock.uptimeMillis() - startTime;
                maybeLogQueryToEventLog(durationMillis, uri, projection, selection, sortOrder);
    
                // Wrap the cursor object into CursorWrapperInner object.
    //最终还是要使用stable的方式去获取一次，即必须会对stableRefCount进行加1
                CursorWrapperInner wrapper = new CursorWrapperInner(qCursor,
                        stableProvider != null ? stableProvider : acquireProvider(uri));
    //注意这里，那么下面则不会release这个stable的ref了，应该会在Cursor关闭之后才释放
                stableProvider = null;
                qCursor = null;//注意这里，提前置空，下面就不用close cursor了
                return wrapper;
            } catch (RemoteException e) {
                // Arbitrary and not worth documenting, as Activity
                // Manager will kill this process shortly anyway.
                return null;
            } finally {
                if (qCursor != null) {//注意上面已置空了，不会执行此处
                    qCursor.close();
                }
                if (cancellationSignal != null) {
                    cancellationSignal.setRemote(null);
                }
    //每次对ContentProvider操作完都会马上release，即对refCount减1
                if (unstableProvider != null) {//会被执行
                    releaseUnstableProvider(unstableProvider);
                }
                if (stableProvider != null) {//上面已置空，不会执行
                    releaseProvider(stableProvider);
                }
            }
        }

ContextImpl$ApplicationContentResolver\#acquireProvider,acquireUnstableProvider和acquireExistingProvider，都是直接调用ActivityThread的方法，其中acquireProvider,acquireUnstableProvider向AcitivityThread传递的参数的区别是stable参数分别是true和false:

@Override
            protected IContentProvider acquireProvider(Context context, String auth) {
                return mMainThread.acquireProvider(context,
                        ContentProvider.getAuthorityWithoutUserId(auth),
                        resolveUserIdFromAuthority(auth), true);
            }
    
    
            @Override
            protected IContentProvider acquireUnstableProvider(Context c, String auth) {
                return mMainThread.acquireProvider(c,
                        ContentProvider.getAuthorityWithoutUserId(auth),
                        resolveUserIdFromAuthority(auth), false);
            }
    
            @Override
            protected IContentProvider acquireExistingProvider(Context context, String auth) {
                return mMainThread.acquireExistingProvider(context,
                        ContentProvider.getAuthorityWithoutUserId(auth),
                        resolveUserIdFromAuthority(auth), true);
            }

接着分析AcitivityThread\#acquireProvider():

public final IContentProvider acquireProvider(
                Context c, String auth, int userId, boolean stable) {
    //首先去找缓存中是否已经有这个IContentProvider了，一般存储在ActivityThread 
    //ArrayMap<ProviderKey, ProviderClientRecord> mProviderMap
            final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
            if (provider != null) {
                return provider;//如果有缓存在直接返回该provider
            }
    
            // There is a possible race here.  Another thread may try to acquire
            // the same provider at the same time.  When this happens, we want to ensure
            // that the first one wins.
            // Note that we cannot hold the lock while acquiring and installing the
            // provider since it might take a long time to run and it could also potentially
            // be re-entrant in the case where the provider is in the same process.
            IActivityManager.ContentProviderHolder holder = null;
            try {
    //向AMS获取，把stable参数一并传过去
                holder = ActivityManagerNative.getDefault().getContentProvider(
                        getApplicationThread(), auth, userId, stable);
            } catch (RemoteException ex) {
            }
            if (holder == null) {
                Slog.e(TAG, "Failed to find provider info for " + auth);
                return null;
            }
            Slog.d(TAG, "holder:" + holder + ", holder.provider:" + holder.provider);
    
            // Install provider will increment the reference count for us, and break
            // any ties in the race.
    
            /// M: if provider is killed for some reasons when getContentProvider from AMS,
            /// M: restart the provider one time @{
            try {
    //如果是客户进程的话，install到本地，很明显这是第一次获取时才会去install，如果不是第一次
    //获取，那么必然会从缓存中获取到并直接返回。
                holder = installProvider(c, holder, holder.info,
                    true /*noisy*/, holder.noReleaseNeeded, stable);
            } catch (SecurityException sex) {
                try {
                     holder = ActivityManagerNative.getDefault().getContentProvider(
                             getApplicationThread(), auth, userId, stable);
                } catch (RemoteException ex) {
                }
    
                if (holder == null) {
                    Slog.e(TAG, "Failed to find provider info for " + auth);
                    return null;
                }
    
                holder = installProvider(c, holder, holder.info,
                    true /*noisy*/, holder.noReleaseNeeded, stable);
            }
            /// M: @}
            return holder.provider;
        }

分析AMS\#getContentProvider（...）:

private final ContentProviderHolder getContentProviderImpl(IApplicationThread caller,
                String name, IBinder token, boolean stable, int userId) {
            ContentProviderRecord cpr;
            ContentProviderConnection conn = null;
            ProviderInfo cpi = null;
    
            synchronized(this) {
                long startTime = SystemClock.elapsedRealtime();
    
                ProcessRecord r = null;
                if (caller != null) {
                    r = getRecordForAppLocked(caller);
                    if (r == null) {
                        throw new SecurityException(
                                "Unable to find app for caller " + caller
                              + " (pid=" + Binder.getCallingPid()
                              + ") when getting content provider " + name);
                    }
                }
    
                boolean checkCrossUser = true;
    
                checkTime(startTime, "getContentProviderImpl: getProviderByName");
    
                // First check if this content provider has been published...
                cpr = mProviderMap.getProviderByName(name, userId);
    
                /// M: To debug for get content provider process info
                Slog.d(TAG, "getContentProviderImpl: from caller=" + caller + " (pid=" + Binder.getCallingPid() + ", userId=" + userId + ") to get content provider " + name + " cpr=" + cpr);
    
                // If that didn't work, check if it exists for user 0 and then
                // verify that it's a singleton provider before using it.
                if (cpr == null && userId != UserHandle.USER_OWNER) {
                    cpr = mProviderMap.getProviderByName(name, UserHandle.USER_OWNER);
                    if (cpr != null) {
                        cpi = cpr.info;
                        if (isSingleton(cpi.processName, cpi.applicationInfo,
                                cpi.name, cpi.flags)
                                && isValidSingletonCall(r.uid, cpi.applicationInfo.uid)) {
                            userId = UserHandle.USER_OWNER;
                            checkCrossUser = false;
                        } else {
                            cpr = null;
                            cpi = null;
                        }
                    }
                }
    
                boolean providerRunning = cpr != null;
    //如果目标CP进程已经在运行了，进入这里
                if (providerRunning) {
                    cpi = cpr.info;
                    String msg;
                    checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
                    if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, checkCrossUser))
                            != null) {
                        throw new SecurityException(msg);
                    }
                    checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");
    
                    if (r != null && cpr.canRunHere(r)) {
                        // This provider has been published or is in the process
                        // of being published...  but it is also allowed to run
                        // in the caller's process, so don't make a connection
                        // and just let the caller instantiate its own instance.
                        ContentProviderHolder holder = cpr.newHolder(null);
                        // don't give caller the provider object, it needs
                        // to make its own.
                        Slog.d(TAG, "getContentProviderImpl: holder.provider = null");
                        holder.provider = null;
                        return holder;
                    }
    
                    final long origId = Binder.clearCallingIdentity();
    
                    checkTime(startTime, "getContentProviderImpl: incProviderCountLocked");
    
                    // In this case the provider instance already exists, so we can
                    // return it right away.
    //和refCount，stable参数相关的就只有这里了。该方法主要是创建一个ContentProviderConnection
    //存到客户进程ProcessRecord和目标CP的ContentProviderRecord中，然后对该对象那个的refCount
    //加1，其中也有stableCount和unstableCount。后面接着分析该方法
                    conn = incProviderCountLocked(r, cpr, token, stable);
                    if (conn != null && (conn.stableCount+conn.unstableCount) == 1) {
                        if (cpr.proc != null && r.setAdj <= ProcessList.PERCEPTIBLE_APP_ADJ) {
                            // If this is a perceptible app accessing the provider,
                            // make sure to count it as being accessed and thus
                            // back up on the LRU list.  This is good because
                            // content providers are often expensive to start.
                            checkTime(startTime, "getContentProviderImpl: before updateLruProcess");
                            updateLruProcessLocked(cpr.proc, false, null);
                            checkTime(startTime, "getContentProviderImpl: after updateLruProcess");
                            Slog.d(TAG, "getContentProviderImpl: updateLruProcessLocked cpr.proc=" + cpr.proc);
                        }
                    }
    
                    if (cpr.proc != null) {
                        if (false) {
                            if (cpr.name.flattenToShortString().equals(
                                    "com.android.providers.calendar/.CalendarProvider2")) {
                                Slog.v(TAG, "****************** KILLING "
                                    + cpr.name.flattenToShortString());
                                Process.killProcess(cpr.proc.pid);
                            }
                        }
                        checkTime(startTime, "getContentProviderImpl: before updateOomAdj");
                        boolean success = updateOomAdjLocked(cpr.proc);
                        maybeUpdateProviderUsageStatsLocked(r, cpr.info.packageName, name);
                        checkTime(startTime, "getContentProviderImpl: after updateOomAdj");
                        if (DEBUG_PROVIDER) Slog.i(TAG_PROVIDER, "Adjust success: " + success);
                        // NOTE: there is still a race here where a signal could be
                        // pending on the process even though we managed to update its
                        // adj level.  Not sure what to do about this, but at least
                        // the race is now smaller.
                        if (!success) {
                            // Uh oh...  it looks like the provider's process
                            // has been killed on us.  We need to wait for a new
                            // process to be started, and make sure its death
                            // doesn't kill our process.
                            Slog.i(TAG, "Existing provider " + cpr.name.flattenToShortString()
                                    + " is crashing; detaching " + r);
                            boolean lastRef = decProviderCountLocked(conn, cpr, token, stable);
                            checkTime(startTime, "getContentProviderImpl: before appDied");
                            appDiedLocked(cpr.proc);
                            checkTime(startTime, "getContentProviderImpl: after appDied");
                            if (!lastRef) {
                                // This wasn't the last ref our process had on
                                // the provider...  we have now been killed, bail.
                                return null;
                            }
                            providerRunning = false;
                            conn = null;
                        }
    
                        /// M: Update cpr.proc's connProvider's process adj since it may have relation with A->B->C . @{
                        if (SystemProperties.get("ro.mtk_gmo_ram_optimize").equals("1")) {
                            if (success) {
                                for (int provi = cpr.proc.conProviders.size() - 1; provi >= 0 ; provi--) {
                                    ContentProviderConnection proviConn = cpr.proc.conProviders.get(provi);
    
                                    if (proviConn.stableCount > 0) {
                                        if (proviConn.provider.proc != null  && !proviConn.provider.proc.processName.equals("system")) {
                                            Slog.e(TAG, "getContentProviderImpl: Update provider " + cpr.proc + " conProviers's adj. conProviders.provider.proc=" + proviConn.provider.proc + " stableCount=" + proviConn.stableCount);
                                            updateOomAdjLocked(proviConn.provider.proc);
                                        }
                                    }
                                }
                            }
                        }
                        /// M: }@
    
                    }
                    /// M: cpr added to mProviderMap when start process, but cpr.proc will set until publish provider @{
                    /// We need to update provider adj if a provider process is acquired during launching
                    else {
                        if (SystemProperties.get("ro.mtk_gmo_ram_optimize").equals("1")) {
                            final int N = mLaunchingProviders.size();
                            int i;
                            ContentProviderRecord launchingCpr;
                            for (i = 0; i < N; i++) {
                                launchingCpr = mLaunchingProviders.get(i);
    
                                if (cpr == launchingCpr) {
                                    Slog.i(TAG, "getContentProviderImpl: updateOomAdjLocked for cpr=" + cpr + " launchingApp=" + cpr.launchingApp);
                                    updateOomAdjLocked(cpr.launchingApp);
                                    break;
                                }
                            }
                        }
                    }
                    /// M: }@
    
                    Binder.restoreCallingIdentity(origId);
                }
    
                boolean singleton;
    //如果目标CP进程还未运行，进入这里。没运行首先肯定是要先startProcessLocked
                if (!providerRunning) {
                    try {
                        checkTime(startTime, "getContentProviderImpl: before resolveContentProvider");
                        cpi = AppGlobals.getPackageManager().
                            resolveContentProvider(name,
                                STOCK_PM_FLAGS | PackageManager.GET_URI_PERMISSION_PATTERNS, userId);
                        checkTime(startTime, "getContentProviderImpl: after resolveContentProvider");
                    } catch (RemoteException ex) {
                        /// M: Debug for get content provider problem from PMS
                        Log.v(TAG, "getContentProviderImpl: resolveContentProvider() exception " + ex.getMessage(), ex);
                    }
                    if (cpi == null) {
                        /// M: Debug for get content provider problem from PMS
                        Log.v(TAG, "getContentProviderImpl: can't get cpi from packagemanager");
                        return null;
                    }
                    // If the provider is a singleton AND
                    // (it's a call within the same user || the provider is a
                    // privileged app)
                    // Then allow connecting to the singleton provider
                    singleton = isSingleton(cpi.processName, cpi.applicationInfo,
                            cpi.name, cpi.flags)
                            && isValidSingletonCall(r.uid, cpi.applicationInfo.uid);
                    if (singleton) {
                        userId = UserHandle.USER_OWNER;
                    }
                    cpi.applicationInfo = getAppInfoForUser(cpi.applicationInfo, userId);
                    checkTime(startTime, "getContentProviderImpl: got app info for user");
    
                    String msg;
                    checkTime(startTime, "getContentProviderImpl: before checkContentProviderPermission");
                    if ((msg = checkContentProviderPermissionLocked(cpi, r, userId, !singleton))
                            != null) {
                        throw new SecurityException(msg);
                    }
                    checkTime(startTime, "getContentProviderImpl: after checkContentProviderPermission");
    
                    if (!mProcessesReady && !mDidUpdate && !mWaitingUpdate
                            && !cpi.processName.equals("system")) {
                        // If this content provider does not run in the system
                        // process, and the system is not yet ready to run other
                        // processes, then fail fast instead of hanging.
                        throw new IllegalArgumentException(
                                "Attempt to launch content provider before system ready");
                    }
    
                    // Make sure that the user who owns this provider is running.  If not,
                    // we don't want to allow it to run.
                    if (!isUserRunningLocked(userId, false)) {
                        Slog.w(TAG, "Unable to launch app "
                                + cpi.applicationInfo.packageName + "/"
                                + cpi.applicationInfo.uid + " for provider "
                                + name + ": user " + userId + " is stopped");
                        return null;
                    }
    
                    ComponentName comp = new ComponentName(cpi.packageName, cpi.name);
                    checkTime(startTime, "getContentProviderImpl: before getProviderByClass");
                    cpr = mProviderMap.getProviderByClass(comp, userId);
                    checkTime(startTime, "getContentProviderImpl: after getProviderByClass");
                    final boolean firstClass = cpr == null;
                    if (firstClass) {
                        final long ident = Binder.clearCallingIdentity();
                        try {
                            checkTime(startTime, "getContentProviderImpl: before getApplicationInfo");
                            ApplicationInfo ai =
                                AppGlobals.getPackageManager().
                                    getApplicationInfo(
                                            cpi.applicationInfo.packageName,
                                            STOCK_PM_FLAGS, userId);
                            checkTime(startTime, "getContentProviderImpl: after getApplicationInfo");
                            if (ai == null) {
                                Slog.w(TAG, "No package info for content provider "
                                        + cpi.name);
                                return null;
                            }
                            ai = getAppInfoForUser(ai, userId);
                            cpr = new ContentProviderRecord(this, cpi, ai, comp, singleton);
                        } catch (RemoteException ex) {
                            // pm is in same process, this will never happen.
                        } finally {
                            Binder.restoreCallingIdentity(ident);
                        }
                    }
    
                    checkTime(startTime, "getContentProviderImpl: now have ContentProviderRecord");
    
                    if (r != null && cpr.canRunHere(r)) {
                        // If this is a multiprocess provider, then just return its
                        // info and allow the caller to instantiate it.  Only do
                        // this if the provider is the same user as the caller's
                        // process, or can run as root (so can be in any process).
                        return cpr.newHolder(null);
                    }
    
                    if (DEBUG_PROVIDER) Slog.w(TAG_PROVIDER, "LAUNCHING REMOTE PROVIDER (myuid "
                                + (r != null ? r.uid : null) + " pruid " + cpr.appInfo.uid + "): "
                                + cpr.info.name + " callers=" + Debug.getCallers(6));
    
                    // This is single process, and our app is now connecting to it.
                    // See if we are already in the process of launching this
                    // provider.
                    final int N = mLaunchingProviders.size();
                    int i;
                    for (i = 0; i < N; i++) {
                        if (mLaunchingProviders.get(i) == cpr) {
                            break;
                        }
                    }
    
                    // If the provider is not already being launched, then get it
                    // started.
                    if (i >= N) {
                        final long origId = Binder.clearCallingIdentity();
    
                        try {
                            // Content provider is now in use, its package can't be stopped.
                            try {
                                checkTime(startTime, "getContentProviderImpl: before set stopped state");
                                AppGlobals.getPackageManager().setPackageStoppedState(
                                        cpr.appInfo.packageName, false, userId);
                                checkTime(startTime, "getContentProviderImpl: after set stopped state");
                            } catch (RemoteException e) {
                            } catch (IllegalArgumentException e) {
                                Slog.w(TAG, "Failed trying to unstop package "
                                        + cpr.appInfo.packageName + ": " + e);
                            }
    
                            // Use existing process if already started
                            checkTime(startTime, "getContentProviderImpl: looking for process record");
                            ProcessRecord proc = getProcessRecordLocked(
                                    cpi.processName, cpr.appInfo.uid, false);
                            if (proc != null && proc.thread != null) {
                                /// M: Add pubProviders check for schedule install to avoid init
                                ///    content provider twice
                                ///    (It may run schedule install while process launching)
                                if (DEBUG_PROVIDER || true) Slog.d(TAG_PROVIDER,
                                        "Installing in existing process " + proc);
                                if (!proc.pubProviders.containsKey(cpi.name)) {
                                    checkTime(startTime, "getContentProviderImpl: scheduling install");
                                    proc.pubProviders.put(cpi.name, cpr);
                                    try {
                                        proc.thread.scheduleInstallProvider(cpi);
                                    } catch (RemoteException e) {
                                    }
                                }
                            } else {
                                checkTime(startTime, "getContentProviderImpl: before start process");
                                proc = startProcessLocked(cpi.processName,
                                        cpr.appInfo, false, 0, "content provider",
                                        new ComponentName(cpi.applicationInfo.packageName,
                                                cpi.name), false, false, false);
                                checkTime(startTime, "getContentProviderImpl: after start process");
                                if (proc == null) {
                                    Slog.w(TAG, "Unable to launch app "
                                            + cpi.applicationInfo.packageName + "/"
                                            + cpi.applicationInfo.uid + " for provider "
                                            + name + ": process is bad");
                                    return null;
                                }
                            }
                            cpr.launchingApp = proc;
                            mLaunchingProviders.add(cpr);
                        } finally {
                            Binder.restoreCallingIdentity(origId);
                        }
                    }
    
                    checkTime(startTime, "getContentProviderImpl: updating data structures");
    
                    // Make sure the provider is published (the same provider class
                    // may be published under multiple names).
                    if (firstClass) {
                        mProviderMap.putProviderByClass(comp, cpr);
                    }
    
                    mProviderMap.putProviderByName(name, cpr);
                    conn = incProviderCountLocked(r, cpr, token, stable);
                    if (conn != null) {
                        conn.waiting = true;
                    }
                }
                checkTime(startTime, "getContentProviderImpl: done!");
            }
    
            // Wait for the provider to be published...
            synchronized (cpr) {
                while (cpr.provider == null) {
                    if (cpr.launchingApp == null) {
                        Slog.w(TAG, "Unable to launch app "
                                + cpi.applicationInfo.packageName + "/"
                                + cpi.applicationInfo.uid + " for provider "
                                + name + ": launching app became null");
                        EventLog.writeEvent(EventLogTags.AM_PROVIDER_LOST_PROCESS,
                                UserHandle.getUserId(cpi.applicationInfo.uid),
                                cpi.applicationInfo.packageName,
                                cpi.applicationInfo.uid, name);
                        return null;
                    }
                    try {
                        if (DEBUG_MU) Slog.v(TAG_MU,
                                "Waiting to start provider " + cpr
                                + " launchingApp=" + cpr.launchingApp);
                        if (conn != null) {
                            conn.waiting = true;
                        }
                        cpr.wait();
                    } catch (InterruptedException ex) {
                    } finally {
                        if (conn != null) {
                            conn.waiting = false;
                        }
                    }
                }
            }
            return cpr != null ? cpr.newHolder(conn) : null;
        }

分析AMS\#incProviderCountLocked（...）:

ContentProviderConnection incProviderCountLocked(ProcessRecord r,
                final ContentProviderRecord cpr, IBinder externalProcessToken, boolean stable) {
            if (r != null) {
                for (int i=0; i<r.conProviders.size(); i++) {//循环查看ProcessRecord
                    ContentProviderConnection conn = r.conProviders.get(i);
                    if (conn.provider == cpr) {//如果该进程有跟目标CP的connection，就直接加1
                        if (DEBUG_PROVIDER) Slog.v(TAG_PROVIDER,
                                "Adding provider requested by "
                                + r.processName + " from process "
                                + cpr.info.processName + ": " + cpr.name.flattenToShortString()
                                + " scnt=" + conn.stableCount + " uscnt=" + conn.unstableCount);
    //增加引用
                        if (stable) {
                            conn.stableCount++;
                            conn.numStableIncs++;
                        } else {
                            conn.unstableCount++;
                            conn.numUnstableIncs++;
                        }
                        return conn;//如果该进程有跟目标CP的connection,直接返回
                    }
                }
    //如果客户Process没有与目标CP的connection，则创建一个
                ContentProviderConnection conn = new ContentProviderConnection(cpr, r);
                if (stable) {//增加引用
                    conn.stableCount = 1;
                    conn.numStableIncs = 1;
                } else {
                    conn.unstableCount = 1;
                    conn.numUnstableIncs = 1;
                }
                cpr.connections.add(conn);//加到目标CP的ContentProviderRecord中
                r.conProviders.add(conn);//加到客户进程的ProcessRecord中
                startAssociationLocked(r.uid, r.processName, cpr.uid, cpr.name, cpr.info.processName);//这个不清楚干什么用，暂时先不研究
                return conn;
            }
            cpr.addExternalProcessHandleLocked(externalProcessToken);
            return null;
        }

分析ActivityThread\#installProvider（...）:

private IActivityManager.ContentProviderHolder installProvider(Context context,
                IActivityManager.ContentProviderHolder holder, ProviderInfo info,
                boolean noisy, boolean noReleaseNeeded, boolean stable) {
            ContentProvider localProvider = null;
            IContentProvider provider;
    //这里在目标CP进程中才会进入，因为客户进程中holder不为空，目标CP进程在此创建CP实例的
            if (holder == null || holder.provider == null) {
                if (DEBUG_PROVIDER || noisy) {
                    Slog.d(TAG, "Loading provider " + info.authority + ": "
                            + info.name);
                }
                Context c = null;
                ApplicationInfo ai = info.applicationInfo;
                Slog.d(TAG, "installProvider: context.getPackageName()=" + context.getPackageName());
                if (context.getPackageName().equals(ai.packageName)) {
                    c = context;
                } else if (mInitialApplication != null &&
                        mInitialApplication.getPackageName().equals(ai.packageName)) {
                    c = mInitialApplication;
                } else {
                    try {
                        c = context.createPackageContext(ai.packageName,
                                Context.CONTEXT_INCLUDE_CODE);
                    } catch (PackageManager.NameNotFoundException e) {
                        // Ignore
                    }
                }
                if (c == null) {
                    Slog.w(TAG, "Unable to get context for package " +
                          ai.packageName +
                          " while loading content provider " +
                          info.name);
                    return null;
                }
                try {
                    final java.lang.ClassLoader cl = c.getClassLoader();
                    localProvider = (ContentProvider)cl.
                        loadClass(info.name).newInstance();
                    provider = localProvider.getIContentProvider();
                    if (provider == null) {
                        Slog.e(TAG, "Failed to instantiate class " +
                              info.name + " from sourceDir " +
                              info.applicationInfo.sourceDir);
                        return null;
                    }
                    if (DEBUG_PROVIDER) Slog.v(
                        TAG, "Instantiating local provider " + info.name);
                    // XXX Need to create the correct context for this provider.
                    localProvider.attachInfo(c, info);
                } catch (java.lang.Exception e) {
                    if (!mInstrumentation.onException(null, e)) {
                        throw new RuntimeException(
                                "Unable to get provider " + info.name
                                + ": " + e.toString(), e);
                    }
                    return null;
                }
            } else {
                provider = holder.provider;
                if (DEBUG_PROVIDER) Slog.v(TAG, "Installing external provider " + info.authority + ": "
                        + info.name);
            }
    
            IActivityManager.ContentProviderHolder retHolder;
    
            synchronized (mProviderMap) {
                if (DEBUG_PROVIDER) Slog.v(TAG, "Checking to add " + provider
                        + " / " + info.name);
                IBinder jBinder = provider.asBinder();
    //如果是目标CP进程这里就会成立
                if (localProvider != null) {
                    ComponentName cname = new ComponentName(info.packageName, info.name);
                    ProviderClientRecord pr = mLocalProvidersByName.get(cname);
                    if (pr != null) {
                        if (DEBUG_PROVIDER) {
                            Slog.v(TAG, "installProvider: lost the race, "
                                    + "using existing local provider");
                        }
                        provider = pr.mProvider;
                    } else {
                        holder = new IActivityManager.ContentProviderHolder(info);
                        holder.provider = provider;
                        holder.noReleaseNeeded = true;
                        pr = installProviderAuthoritiesLocked(provider, localProvider, holder);
                        mLocalProviders.put(jBinder, pr);
                        mLocalProvidersByName.put(cname, pr);
                    }
                    retHolder = pr.mHolder;
                } else {//客户进程进入这里
                    ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
                    if (prc != null) {//因为是首次查询，一般都没有缓存，所以直接跳到else
                        if (DEBUG_PROVIDER) {
                            Slog.v(TAG, "installProvider: lost the race, updating ref count");
                        }
                        // We need to transfer our new reference to the existing
                        // ref count, releasing the old one...  but only if
                        // release is needed (that is, it is not running in the
                        // system process).
                        if (!noReleaseNeeded) {
                            incProviderRefLocked(prc, stable);
                            try {
                                ActivityManagerNative.getDefault().removeContentProvider(
                                        holder.connection, stable);
                            } catch (RemoteException e) {
                                //do nothing content provider object is dead any way
                            }
                        }
                    } else {//一般进入这里
                        ProviderClientRecord client = installProviderAuthoritiesLocked(
                                provider, localProvider, holder);
                        if (noReleaseNeeded) {
                            prc = new ProviderRefCount(holder, client, 1000, 1000);
                        } else {
    //创建时根据stable参数初始化。即分别对stableCount和unstableCount初始化
                            prc = stable
                                    ? new ProviderRefCount(holder, client, 1, 0)
                                    : new ProviderRefCount(holder, client, 0, 1);
                        }
    //把一个跟ref相关的对象存起来，以Bp端作为key。installProvider除了创建ref相关对象，还会把一个
    //ProviderClientRecord放到ArrayMap<ProviderKey, ProviderClientRecord> mProviderMap
                        mProviderRefCountMap.put(jBinder, prc);
                    }
                    retHolder = prc.holder;
                }
            }
    
            return retHolder;
        }

分析ActivityThread\#acquireExistingProvider：

public final IContentProvider acquireExistingProvider(
                Context c, String auth, int userId, boolean stable) {
            synchronized (mProviderMap) {
                final ProviderKey key = new ProviderKey(auth, userId);
                final ProviderClientRecord pr = mProviderMap.get(key);
                if (pr == null) {
                    return null;
                }
    
                IContentProvider provider = pr.mProvider;
                IBinder jBinder = provider.asBinder();
                if (!jBinder.isBinderAlive()) {
                    // The hosting process of the provider has died; we can't
                    // use this one.
                    Log.i(TAG, "Acquiring provider " + auth + " for user " + userId
                            + ": existing object's process dead");
                    handleUnstableProviderDiedLocked(jBinder, true);
                    return null;
                }
    
                // Only increment the ref count if we have one.  If we don't then the
                // provider is not reference counted and never needs to be released.
    //在installProvider方法中分析过，在向AMS获取provider时，会创建一个ProviderRefCount
                ProviderRefCount prc = mProviderRefCountMap.get(jBinder);
                if (prc != null) {
    //对缓存中provider引用加1，那么是对stableCount还是unstableCount加1，那就看acquire时传入的参
    //数了
                    incProviderRefLocked(prc, stable);
                }
                return provider;
            }
        }

分析ActivityThread\#incProviderRefLocked：

private final void incProviderRefLocked(ProviderRefCount prc, boolean stable) {
            if (stable) {//如果是stable方式获取，则进入这里
    //每次都会对本地的refCount加1
                prc.stableCount += 1;
    //在加1后等于1，即这是首次对该Provider做stable引用
                if (prc.stableCount == 1) {
                    // We are acquiring a new stable reference on the provider.
                    int unstableDelta;
                    if (prc.removePending) {
                        // We have a pending remove operation, which is holding the
                        // last unstable reference.  At this point we are converting
                        // that unstable reference to our new stable reference.
                        unstableDelta = -1;
                        // Cancel the removal of the provider.
                        if (DEBUG_PROVIDER) {
                            Slog.v(TAG, "incProviderRef: stable "
                                    + "snatched provider from the jaws of death");
                        }
                        prc.removePending = false;
                        // There is a race! It fails to remove the message, which
                        // will be handled in completeRemoveProvider().
                        mH.removeMessages(H.REMOVE_PROVIDER, prc);
                    } else {
                        unstableDelta = 0;
                    }
                    try {
                        if (DEBUG_PROVIDER) {
                            Slog.v(TAG, "incProviderRef Now stable - "
                                    + prc.holder.info.name + ": unstableDelta="
                                    + unstableDelta);
                        }
    //首次stable引用才会触发AMS#refContentProvider方法，第二次对同一provider做stable引用
    //则只在本地增加引用数
                        ActivityManagerNative.getDefault().refContentProvider(
                                prc.holder.connection, 1, unstableDelta);
                    } catch (RemoteException e) {
                        //do nothing content provider object is dead any way
                    }
                }
            } else {//如果是unstable方式获取则进入这里
    //每次都会对本地的refCount加1
                prc.unstableCount += 1;
    //在加1后等于1，即这是首次对该Provider做unstable引用。和stable类似的属性
                if (prc.unstableCount == 1) {
                    // We are acquiring a new unstable reference on the provider.
                    if (prc.removePending) {
                        // Oh look, we actually have a remove pending for the
                        // provider, which is still holding the last unstable
                        // reference.  We just need to cancel that to take new
                        // ownership of the reference.
                        if (DEBUG_PROVIDER) {
                            Slog.v(TAG, "incProviderRef: unstable "
                                    + "snatched provider from the jaws of death");
                        }
                        prc.removePending = false;
                        mH.removeMessages(H.REMOVE_PROVIDER, prc);
                    } else {
                        // First unstable ref, increment our count in the
                        // activity manager.
                        try {
                            if (DEBUG_PROVIDER) {
                                Slog.v(TAG, "incProviderRef: Now unstable - "
                                        + prc.holder.info.name);
                            }
    //首次unstable引用才会触发AMS#refContentProvider方法，第二次对同一provider做unstable引用
    //则只在本地增加引用数
                            ActivityManagerNative.getDefault().refContentProvider(
                                    prc.holder.connection, 0, 1);
                        } catch (RemoteException e) {
                            //do nothing content provider object is dead any way
                        }
                    }
                }
            }
        }

由上面的分析可以得知，每次acquireProvider，无论是去本地缓存取，还是去AMS获取，都会对本地的ProviderRefCount加1，而只有首次对Provider进行stable或者首次unstable引用才会去触发AMS中和refCount有关的方法。当然AMS\#getContentProvider（）中就有和refCount有关的重要逻辑。

分析AMS\#refContentProvider（...）:

public boolean refContentProvider(IBinder connection, int stable, int unstable) {
            ContentProviderConnection conn;
            try {
                conn = (ContentProviderConnection)connection;
            } catch (ClassCastException e) {
                String msg ="refContentProvider: " + connection
                        + " not a ContentProviderConnection";
                Slog.w(TAG, msg);
                throw new IllegalArgumentException(msg);
            }
            if (conn == null) {
                throw new NullPointerException("connection is null");
            }
    
            synchronized (this) {
                if (stable > 0) {
                    conn.numStableIncs += stable;
                }
                stable = conn.stableCount + stable;
                if (stable < 0) {
                    throw new IllegalStateException("stableCount < 0: " + stable);
                }
    
                if (unstable > 0) {
                    conn.numUnstableIncs += unstable;
                }
                unstable = conn.unstableCount + unstable;
                if (unstable < 0) {
                    throw new IllegalStateException("unstableCount < 0: " + unstable);
                }
    
                if ((stable+unstable) <= 0) {
                    throw new IllegalStateException("ref counts can't go to zero here: stable="
                            + stable + " unstable=" + unstable);
                }
                conn.stableCount = stable;
                conn.unstableCount = unstable;
                return !conn.dead;
            }
        }

看这方法也没干什么，只是对传过来的ContentProviderConnection的Bp端的字段变量进行赋值。而没有将该Bp端存起来

下面分析releaseProvider相关和AMS\#removeDyingProviderLocked，前面分析了创建一个对引用加1，下面的是对引用减一和销毁，还有研究目标CP所在进程死后，stable参数对AMS处理和目标CP关联的客户进程的影响。

那么这个stableCount

[70]: /images/20220511/398308c3aef64b00b4d2f162cc492d4a.png