强大的测试组居然测出不少android框架级的bug,其中有一个现象如下:
故事是这样发生的,当焦点放在地址栏时,会弹出SearchDialog,而在下方会有一个popup window用于显示访问历史,这是输入法也会冒出来,此时,如果隐藏掉输入法(比如按输入法的关闭按钮,或者在listview处滑动)再按back键,重点来了,按back键之后快速滑动浏览器页面,奇迹发生了,浏览器居然被一大块白板给遮盖了!!!
起初发现该问题是还是偶发的,但任何一个偶发现象都有其必然规律,终于在不懈的尝试与分析下,发现了上面的必现路径。
有事解一个问题真的需要运气,比如这次,我发现,当白板出现时,按menu退出浏览器,这是发现,浏览器再临死前还是留下了凶手的一些蛛丝马迹:
01-21 13:14:24.507: ERROR/WindowManager(3834): Activity com.android.browser.BrowserActivity has leaked window android.widget.PopupWindow$PopupViewContainer@48326088 that was originally added here 01-21 13:14:24.507: ERROR/WindowManager(3834): android.view.WindowLeaked: Activity com.android.browser.BrowserActivity has leaked window android.widget.PopupWindow$PopupViewContainer@48326088 that was originally added here 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.view.ViewRoot.<init>(ViewRoot.java:247) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.view.WindowManagerImpl.addView(WindowManagerImpl.java:148) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.view.WindowManagerImpl.addView(WindowManagerImpl.java:91) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.view.Window$LocalWindowManager.addView(Window.java:424) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.widget.PopupWindow.invokePopup(PopupWindow.java:828) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.widget.PopupWindow.showAsDropDown(PopupWindow.java:740) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.widget.AutoCompleteTextView.showDropDown(AutoCompleteTextView.java:1207) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.widget.AutoCompleteTextView$ResizePopupRunnable.run(AutoCompleteTextView.java:1452) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.os.Handler.handleCallback(Handler.java:587) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.os.Handler.dispatchMessage(Handler.java:92) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.os.Looper.loop(Looper.java:123) 01-21 13:14:24.507: ERROR/WindowManager(3834): at android.app.ActivityThread.main(ActivityThread.java:4627) 01-21 13:14:24.507: ERROR/WindowManager(3834): at java.lang.reflect.Method.invokeNative(Native Method) 01-21 13:14:24.507: ERROR/WindowManager(3834): at java.lang.reflect.Method.invoke(Method.java:521) 01-21 13:14:24.507: ERROR/WindowManager(3834): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:876) 01-21 13:14:24.507: ERROR/WindowManager(3834): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:634) 01-21 13:14:24.507: ERROR/WindowManager(3834): at dalvik.system.NativeStart.main(Native Method)
android.widget.AutoCompleteTextView.showDropDown(AutoCompleteTextView.java:1207)01-21 13:14:24.507: ERROR/WindowManager(3834): at android.widget.AutoCompleteTextView$ResizePopupRunnable.run(AutoCompleteTextView.java:1452)
AutoCompleteTextView!!
多么可疑!
毕竟AutoCompleteTextView生活在SearchDialog的世界中,而死者致死的白板多么像一个popupwindow啊,而且死者临死前竟也指出了凶手的手段(AutoCompleteTextView.showDropDown)。
深入AutoCompleteTextView.showDropDown家中调查发现,他平日便是靠着剪裁各种大小的白板(mPopup.setWindowLayoutMode(widthSpec, heightSpec))为生 。在他家偷偷装上摄像头,发现
(noInputMethod == true && !mPopup.isShowing())二者一起出现的时候,浏览器必死!看来是漏网之鱼!
凶手出现了,漏洞找到了,亡羊补牢,为时不晚,于是,法规上增加一条:当mPopup没有显示,并且输入法也不存在的时候,禁止AutoCompleteTextView制造高度大于0 的白板:
if (mPopup.isShowing()) {
……
}else{
if(noInputMethod == true) heightSpec = 0;
else if(……){
}else{
}
}
这样浏览器从此果然没有再被害。
看来google的法规还有待完善啊,其实这种解法仅仅是解决了出口,源头没有封堵。
比如,看这个接口:
private class PopupTouchInterceptor implements OnTouchListener { public boolean onTouch(View v, MotionEvent event) { final int action = event.getAction(); if (action == MotionEvent.ACTION_DOWN && mPopup != null && mPopup.isShowing()) { postDelayed(mResizePopupRunnable, EXPAND_LIST_TIMEOUT); } else if (action == MotionEvent.ACTION_UP) { removeCallbacks(mResizePopupRunnable); } return false; } }
其实问题就出在这,当popupwindow还显示的时候,你触碰TP,他会收到ACTION_DOWN事件,并在250ms后执行showDropDown的动作,但问题就在于,ACTION_DOWN之后,AutoCompleteTextView已经不存在了,本来需要的ACTION_UP事件现在肯定收不到了,这就出现了无法在250ms内将发出去的事件收回,“刀下留人”也来不及了!