693 5688 F zygote : indirect_reference_table.cc:256] JNI ERROR (app bug): global reference table overflow (max=51200)
Line 208733: 08-22 20:40:45.255895 693 5688 F zygote : indirect_reference_table.cc:256] global reference table dump:
Line 208734: 08-22 20:40:45.255925 693 5688 F zygote : indirect_reference_table.cc:256] Last 10 entries (of 51200):
Line 208735: 08-22 20:40:45.255951 693 5688 F zygote : indirect_reference_table.cc:256] 51199: 0x15800aa8 java.lang.ref.WeakReference (referent is a android.os.BinderProxy)
Line 208736: 08-22 20:40:45.255973 693 5688 F zygote : indirect_reference_table.cc:256] 51198: 0x15800210 android.os.Binder
Line 208737: 08-22 20:40:45.256049 693 5688 F zygote : indirect_reference_table.cc:256] 51197: 0x15800078 java.lang.ref.WeakReference (referent is a android.os.BinderProxy)
Line 208738: 08-22 20:40:45.256077 693 5688 F zygote : indirect_reference_table.cc:256] 51196: 0x15640b88 com.android.server.wm.WindowState$DeathRecipient
Line 208739: 08-22 20:40:45.256100 693 5688 F zygote : indirect_reference_table.cc:256] 51195: 0x14ed0468 android.os.RemoteCallbackList$Callback
Line 208740: 08-22 20:40:45.256121 693 5688 F zygote : indirect_reference_table.cc:256] 51194: 0x14ed0450 android.os.RemoteCallbackList$Callback
Line 208741: 08-22 20:40:45.256144 693 5688 F zygote : indirect_reference_table.cc:256] 51193: 0x14ed0438 java.lang.ref.WeakReference (referent is a android.os.BinderProxy)
Line 208742: 08-22 20:40:45.256166 693 5688 F zygote : indirect_reference_table.cc:256] 51192: 0x14ed0420 android.app.LoadedApk$ServiceDispatcher$DeathMonitor
Line 208743: 08-22 20:40:45.256188 693 5688 F zygote : indirect_reference_table.cc:256] 51191: 0x14ed0408 java.lang.ref.WeakReference (referent is a android.os.BinderProxy)
Line 208744: 08-22 20:40:45.256209 693 5688 F zygote : indirect_reference_table.cc:256] 51190: 0x14ed03f0 java.lang.ref.WeakReference (referent is a android.os.BinderProxy)
Line 208745: 08-22 20:40:45.256230 693 5688 F zygote : indirect_reference_table.cc:256] Summary:
Line 208746: 08-22 20:40:45.256251 693 5688 F zygote : indirect_reference_table.cc:256] 37095 of android.os.RemoteCallbackList$Callback (37095 unique instances)
Line 208747: 08-22 20:40:45.256272 693 5688 F zygote : indirect_reference_table.cc:256] 12770 of java.lang.ref.WeakReference (12770 unique instances)
Line 208748: 08-22 20:40:45.256295 693 5688 F zygote : indirect_reference_table.cc:256] 313 of java.lang.Class (235 unique instances)
Line 208749: 08-22 20:40:45.256317 693 5688 F zygote : indirect_reference_table.cc:256] 232 of com.android.server.content.ContentService$ObserverNode$ObserverEntry (232 unique instances)
Line 208750: 08-22 20:40:45.256337 693 5688 F zygote : indirect_reference_table.cc:256] 184 of java.nio.DirectByteBuffer (173 unique instances)
Line 208751: 08-22 20:40:45.256359 693 5688 F zygote : indirect_reference_table.cc:256] 89 of com.android.server.am.ServiceRecord (89 unique instances)
Line 208752: 08-22 20:40:45.256381 693 5688 F zygote : indirect_reference_table.cc:256] 84 of android.os.Binder (84 unique instances)
Line 208753: 08-22 20:40:45.256403 693 5688 F zygote : indirect_reference_table.cc:256] 37 of com.android.server.am.PendingIntentRecord (37 unique instances)
Line 208754: 08-22 20:40:45.256424 693 5688 F zygote : indirect_reference_table.cc:256] 32 of com.android.server.job.JobServiceContext$JobCallback (32 unique instances)
Line 208755: 08-22 20:40:45.256445 693 5688 F zygote : indirect_reference_table.cc:256] 26 of com.android.server.am.ContentProviderConnection (26 unique instances)
Line 208756: 08-22 20:40:45.256467 693 5688 F zygote : indirect_reference_table.cc:256] 23 of com.android.server.am.ActivityManagerService$AppDeathRecipient (23 unique instances)
Line 208757: 08-22 20:40:45.256489 693 5688 F zygote : indirect_reference_table.cc:256] 23 of com.android.server.display.DisplayManagerService$CallbackRecord (23 unique instances)
Line 208758: 08-22 20:40:45.256512 693 5688 F zygote : indirect_reference_table.cc:256] 14 of com.android.server.wm.WindowState$DeathRecipient (14 unique instances)
Line 208759: 08-22 20:40:45.256533 693 5688 F zygote : indirect_reference_table.cc:256] 14 of android.app.LoadedApk$ServiceDispatcher$DeathMonitor (14 unique instances)
Line 208760: 08-22 20:40:45.256560 693 5688 F zygote : indirect_reference_table.cc:256] 13 of com.android.server.accessibility.AccessibilityManagerService$RemoteAccessibilityConnection (13 unique instances)
Line 208761: 08-22 20:40:45.256583 693 5688 F zygote : indirect_reference_table.cc:256] 10 of com.android.server.wm.Session (5 unique instances)
Line 208762: 08-22 20:40:45.256605 693 5688 F zygote : indirect_reference_table.cc:256] 8 of com.android.server.am.ActivityRecord$Token (8 unique instances)JNI 全局引用java对象泄露，跟踪泄露class 对象使用流程，分析泄露原因。
frameworks/base/core/java/android/os/RemoteCallbackList.java
114 public boolean register(E callback, Object cookie) {
115 synchronized (mCallbacks) {
116 if (mKilled) {
117 return false;
118 }
119 // Flag unusual case that could be caused by a leak. b/36778087
120 logExcessiveCallbacks();
121 IBinder binder = callback.asBinder();
122 try {
123 Callback cb = new Callback(callback, cookie);
124 binder.linkToDeath(cb, 0);
125 mCallbacks.put(binder, cb);
126 return true;
127 } catch (RemoteException e) {
128 return false;
129 }
130 }
131 }上面的register函数如果参数callback为相同的对象，反复调用该函数，则存在cb泄露的情况，恰好在WallpaperManagerService服务中存在此情况：
frameworks/base/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
public ParcelFileDescriptor getWallpaper(String callingPkg, IWallpaperManagerCallback cb,
1697 final int which, Bundle outParams, int wallpaperUserId) {
1698 final int hasPrivilege = mContext.checkCallingOrSelfPermission(
1699 android.Manifest.permission.READ_WALLPAPER_INTERNAL);
1700 //OS : modify by zhuwei XOSLAUNCHE-1649 2017-11-17 start
1701 //add !specialPkg
1702 boolean specialPkg = callingPkg != null && callingPkg.equals("com.transsion.XOSLauncher");
1703 if (hasPrivilege != PackageManager.PERMISSION_GRANTED
1704 && !specialPkg) {
1705 //OS : add by zhuwei XOSLAUNCHE-1649 2017-11-17 end
1706 enforceCallingOrSelfPermissionAndAppOp(android.Manifest.permission.READ_EXTERNAL_STORAGE,
1707 callingPkg, Binder.getCallingUid(), "read wallpaper");
1708 }
1709
1710 wallpaperUserId = ActivityManager.handleIncomingUser(Binder.getCallingPid(),
1711 Binder.getCallingUid(), wallpaperUserId, false, true, "getWallpaper", null);
1712
1713 if (which != FLAG_SYSTEM && which != FLAG_LOCK) {
1714 throw new IllegalArgumentException("Must specify exactly one kind of wallpaper to read");
1715 }
1716
1717 synchronized (mLock) {
1718 final SparseArray<WallpaperData> whichSet =
1719 (which == FLAG_LOCK) ? mLockWallpaperMap : mWallpaperMap;
1720 WallpaperData wallpaper = whichSet.get(wallpaperUserId);
1721 if (wallpaper == null) {
1722 // There is no established wallpaper imagery of this type (expected
1723 // only for lock wallpapers; a system WallpaperData is established at
1724 // user switch)
1725 return null;
1726 }
1727 try {
1728 if (outParams != null) {
1729 outParams.putInt("width", wallpaper.width);
1730 outParams.putInt("height", wallpaper.height);
1731 }
1732 if (cb != null) {
1733 wallpaper.callbacks.register(cb);
1734 }
1735 if (!wallpaper.cropFile.exists()) {
1736 return null;
1737 }
1738 return ParcelFileDescriptor.open(wallpaper.cropFile, MODE_READ_ONLY);
1739 } catch (FileNotFoundException e) {
1740 /* Shouldn't happen as we check to see if the file exists */
1741 Slog.w(TAG, "Error getting wallpaper", e);
1742 }
1743 return null;
1744 }
1745 }当反复调用getWallpaper方法时，就会存在RemoteCallbackList$Callback泄露情况，通过脚本切换壁纸尝试重现此问题.