dependencies { 
    // debugImplementation because LeakCanary should only run in debug builds. 
    debugImplementation 'com.squareup.leakcanary:leakcanary-android:2.9.1' 
}

internal class MainProcessAppWatcherInstaller : ContentProvider() {
  override fun onCreate(): Boolean {
    val application = context!!.applicationContext as Application
    AppWatcher.manualInstall(application)
    return true
  }
  ...
 }

@UnsupportedAppUsage
private void handleBindApplication(AppBindData data) {
    ...
    // 這邊創(chuàng)建application，并會調(diào)用到application的attach()方法，最終調(diào)用到attachBaseContext()方法
    app = data.info.makeApplication(data.restrictedBackupMode, null);
    ...
    // don't bring up providers in restricted mode; they may depend on the
    // app's custom Application class
    if (!data.restrictedBackupMode) {
        if (!ArrayUtils.isEmpty(data.providers)) {
            //初始化Provider并且調(diào)用了Provider的onCreate()方法
            installContentProviders(app, data.providers);
        }
    }
    ...
    try {
        //調(diào)用了Application的onCreate()方法
        mInstrumentation.callApplicationOnCreate(app);
    } catch (Exception e) {
        if (!mInstrumentation.onException(app, e)) {
            throw new RuntimeException(
              "Unable to create application " + app.getClass().getName()
              + ": " + e.toString(), e);
        }
    }
    ...
}

<?xml version="1.0" encoding="utf-8"?>
<resources>
  <bool name="leak_canary_watcher_auto_install">false</bool>
</resources>

internal class MainProcessAppWatcherInstaller : ContentProvider() {
  override fun onCreate(): Boolean {
    val application = context!!.applicationContext as Application
    //這邊調(diào)用初始化的方法
    AppWatcher.manualInstall(application)
    return true
  }
  ...
 }

@JvmOverloads
fun manualInstall(
  application: Application,
  retainedDelayMillis: Long = TimeUnit.SECONDS.toMillis(5),
  watchersToInstall: List<InstallableWatcher> = appDefaultWatchers(application)
) {
  //先判斷是否是在主線程，如果不是在主線程則拋出異常
  checkMainThread()
  //判斷是否已經(jīng)初始化了，如果已經(jīng)初始化了則拋出異常，避免重復(fù)初始化
  if (isInstalled) {
    throw IllegalStateException(
      "AppWatcher already installed, see exception cause for prior install call", installCause
    )
  }
  //判斷設(shè)置的延遲時間是否小于0,這個時間是用來延遲檢測被觀察的對象是否已被釋放，
  //也就是說如果到了這個時間，對象仍沒有被釋放，那么可能出現(xiàn)了內(nèi)存泄漏
  check(retainedDelayMillis >= 0) {
    "retainedDelayMillis $retainedDelayMillis must be at least 0 ms"
  }
  this.retainedDelayMillis = retainedDelayMillis
  if (application.isDebuggableBuild) {
    LogcatSharkLog.install()
  }
  //初始化 InternalLeakCanary，并調(diào)用了InternalLeakCanary.invoke()方法，
  //這個類是用來檢查判斷對象是否被回收
  LeakCanaryDelegate.loadLeakCanary(application)
  //開啟監(jiān)聽器，也就是appDefaultWatchers(application)方法里面的
  watchersToInstall.forEach {
    it.install()
  }
  // Only install after we're fully done with init.
  installCause = RuntimeException("manualInstall() first called here")
}

fun appDefaultWatchers(
  application: Application,
  reachabilityWatcher: ReachabilityWatcher = objectWatcher
): List<InstallableWatcher> {
  return listOf(
    ActivityWatcher(application, reachabilityWatcher),
    FragmentAndViewModelWatcher(application, reachabilityWatcher),
    RootViewWatcher(reachabilityWatcher),
    ServiceWatcher(reachabilityWatcher)
  )
}

object AppWatcher {
 ...
/**
 * The [ObjectWatcher] used by AppWatcher to detect retained objects.
 * Only set when [isInstalled] is true.
 */
val objectWatcher = ObjectWatcher(
  clock = { SystemClock.uptimeMillis() },
  checkRetainedExecutor = {
    check(isInstalled) {
      "AppWatcher not installed"
    }
    mainHandler.postDelayed(it, retainedDelayMillis)
  },
  isEnabled = { true }
 )
 ...
}

class ActivityWatcher(
  private val application: Application,
  private val reachabilityWatcher: ReachabilityWatcher
) : InstallableWatcher {
  //回調(diào)，這個是向application.registerActivityLifecycleCallbacks注冊activity生命周期回調(diào)
  //這邊通過監(jiān)聽Activity的onDestroyed來觀察它的回收狀態(tài)
  private val lifecycleCallbacks =
    object : Application.ActivityLifecycleCallbacks by noOpDelegate() {
      override fun onActivityDestroyed(activity: Activity) {
        //一旦activity進(jìn)入到destory，則開始通過onActivityDestroyed觀察它的回收狀態(tài)
        reachabilityWatcher.expectWeaklyReachable(
          activity, "${activity::class.java.name} received Activity#onDestroy() callback"
        )
      }
    }
  override fun install() {
    application.registerActivityLifecycleCallbacks(lifecycleCallbacks)
  }
  override fun uninstall() {
    application.unregisterActivityLifecycleCallbacks(lifecycleCallbacks)
  }
}

private val fragmentDestroyWatchers: List<(Activity) -> Unit> = run {
  val fragmentDestroyWatchers = mutableListOf<(Activity) -> Unit>()
  //添加android.app.Fragment監(jiān)聽，創(chuàng)建AndroidOFragmentDestroyWatcher，并加入到集合中
  if (SDK_INT >= O) {
    fragmentDestroyWatchers.add(
      AndroidOFragmentDestroyWatcher(reachabilityWatcher)
    )
  }
  //添加 androidx.fragment.app.Fragment監(jiān)聽，
  //通過反射的方式創(chuàng)建AndroidXFragmentDestroyWatcher，并加入到集合中
  getWatcherIfAvailable(
    ANDROIDX_FRAGMENT_CLASS_NAME,
    ANDROIDX_FRAGMENT_DESTROY_WATCHER_CLASS_NAME,
    reachabilityWatcher
  )?.let {
    fragmentDestroyWatchers.add(it)
  }
  //添加android.support.v4.app.Fragment監(jiān)聽
  //通過反射的方式 創(chuàng)建 AndroidSupportFragmentDestroyWatcher，并加入到集合中
  getWatcherIfAvailable(
    ANDROID_SUPPORT_FRAGMENT_CLASS_NAME,
    ANDROID_SUPPORT_FRAGMENT_DESTROY_WATCHER_CLASS_NAME,
    reachabilityWatcher
  )?.let {
    fragmentDestroyWatchers.add(it)
  } 
  fragmentDestroyWatchers
}

private val lifecycleCallbacks =
  object : Application.ActivityLifecycleCallbacks by noOpDelegate() {
    override fun onActivityCreated(
      activity: Activity,
      savedInstanceState: Bundle?
    ) {
      for (watcher in fragmentDestroyWatchers) {
        watcher(activity)
      }
    }
  }

internal class AndroidXFragmentDestroyWatcher(
  private val reachabilityWatcher: ReachabilityWatcher
) : (Activity) -> Unit {
  private val fragmentLifecycleCallbacks = object : FragmentManager.FragmentLifecycleCallbacks() {
    override fun onFragmentCreated(
      fm: FragmentManager,
      fragment: Fragment,
      savedInstanceState: Bundle?
    ) {
      ViewModelClearedWatcher.install(fragment, reachabilityWatcher)
    }
    override fun onFragmentViewDestroyed(
      fm: FragmentManager,
      fragment: Fragment
    ) {
      val view = fragment.view
      if (view != null) {
        reachabilityWatcher.expectWeaklyReachable(
          view, "${fragment::class.java.name} received Fragment#onDestroyView() callback " +
          "(references to its views should be cleared to prevent leaks)"
        )
      }
    }
    override fun onFragmentDestroyed(
      fm: FragmentManager,
      fragment: Fragment
    ) {
      reachabilityWatcher.expectWeaklyReachable(
        fragment, "${fragment::class.java.name} received Fragment#onDestroy() callback"
      )
    }
  }
  override fun invoke(activity: Activity) {
    if (activity is FragmentActivity) {
      val supportFragmentManager = activity.supportFragmentManager
      supportFragmentManager.registerFragmentLifecycleCallbacks(fragmentLifecycleCallbacks, true)
      ViewModelClearedWatcher.install(activity, reachabilityWatcher)
    }
  }
}

private val listener = OnRootViewAddedListener { rootView ->
  val trackDetached = when(rootView.windowType) {
    PHONE_WINDOW -> {
      when (rootView.phoneWindow?.callback?.wrappedCallback) {
        // Activities are already tracked by ActivityWatcher
        // activity不需要重復(fù)注冊
        is Activity -> false
        //監(jiān)聽dialog，這邊還需要判斷下資源文件里面的配置信息是否是打開的
        is Dialog -> {
          // Use app context resources to avoid NotFoundException
          // https://github.com/square/leakcanary/issues/2137
          val resources = rootView.context.applicationContext.resources
          resources.getBoolean(R.bool.leak_canary_watcher_watch_dismissed_dialogs)
        }
        // Probably a DreamService
        // 其他情況都打開
        else -> true
      }
    }
    // Android widgets keep detached popup window instances around.
    POPUP_WINDOW -> false
    TOOLTIP, TOAST, UNKNOWN -> true
  }
  if (trackDetached) {
    rootView.addOnAttachStateChangeListener(object : OnAttachStateChangeListener {
      val watchDetachedView = Runnable {
        reachabilityWatcher.expectWeaklyReachable(
          rootView, "${rootView::class.java.name} received View#onDetachedFromWindow() callback"
        )
      }
      override fun onViewAttachedToWindow(v: View) {
        //當(dāng)顯示時移除內(nèi)存監(jiān)聽器
        mainHandler.removeCallbacks(watchDetachedView)
      }
      override fun onViewDetachedFromWindow(v: View) {
        //當(dāng)view從界面上移除時時，就執(zhí)行監(jiān)聽，通過Handler.post()
        mainHandler.post(watchDetachedView)
      }
    })
  }
}
override fun install() {
  //使用三方庫的Curtains來對view進(jìn)行狀態(tài)的監(jiān)聽
  Curtains.onRootViewsChangedListeners += listener
}

//存放即將stop的service
private val servicesToBeDestroyed = WeakHashMap<IBinder, WeakReference<Service>>()
private val activityThreadClass by lazy { Class.forName("android.app.ActivityThread") }
//通過反射的方式調(diào)用ActivityThread里面的currentActivityThread方法，也就是取到ActivityThread對象
private val activityThreadInstance by lazy {
  activityThreadClass.getDeclaredMethod("currentActivityThread").invoke(null)!!
}
//通過反射方式從ActivityThread取出mServices
private val activityThreadServices by lazy {
  val mServicesField =
    activityThreadClass.getDeclaredField("mServices").apply { isAccessible = true }
  @Suppress("UNCHECKED_CAST")
  mServicesField[activityThreadInstance] as Map<IBinder, Service>
}
override fun install() {
  //做一些檢查
  checkMainThread()
  check(uninstallActivityThreadHandlerCallback == null) {
    "ServiceWatcher already installed"
  }
  check(uninstallActivityManager == null) {
    "ServiceWatcher already installed"
  }
  try {
    //hook ActivityThread里面的mH，也就是Handler，并替換里面的mCallBack
    swapActivityThreadHandlerCallback { mCallback ->
      //還原h(huán)ook的mCallback，uninstall()時使用
      uninstallActivityThreadHandlerCallback = {
        swapActivityThreadHandlerCallback {
          mCallback
        }
      }
      //返回需要替換的mCallback，在這里面監(jiān)聽handler消息，
      Handler.Callback { msg ->
        // https://github.com/square/leakcanary/issues/2114
        // On some Motorola devices (Moto E5 and G6), the msg.obj returns an ActivityClientRecord
        // instead of an IBinder. This crashes on a ClassCastException. Adding a type check
        // here to prevent the crash.
        if (msg.obj !is IBinder) {
          return@Callback false
        }
        //如果收到了Service的Stop的消息，表示service要結(jié)束了，
        //此時調(diào)用onServicePreDestroy，將當(dāng)前service加入到servicesToBeDestroyed集合里面去
        if (msg.what == STOP_SERVICE) {
          val key = msg.obj as IBinder
          activityThreadServices[key]?.let {
            onServicePreDestroy(key, it)
          }
        }
        //繼續(xù)處理消息
        mCallback?.handleMessage(msg) ?: false
      }
    }
    //這邊hook ActivityManagerService
    swapActivityManager { activityManagerInterface, activityManagerInstance ->
      uninstallActivityManager = {
        swapActivityManager { _, _ ->
          activityManagerInstance
        }
      }
      //使用動態(tài)代理的方式
      Proxy.newProxyInstance(
        activityManagerInterface.classLoader, arrayOf(activityManagerInterface)
      ) { _, method, args ->
        //如果執(zhí)行serviceDoneExecuting方法時，則調(diào)用onServiceDestroyed()
        //方法來觀察service的內(nèi)存回收情況
        if (METHOD_SERVICE_DONE_EXECUTING == method.name) {
          val token = args!![0] as IBinder
          if (servicesToBeDestroyed.containsKey(token)) {
            onServiceDestroyed(token)
          }
        }
        try {
          if (args == null) {
            method.invoke(activityManagerInstance)
          } else {
            method.invoke(activityManagerInstance, *args)
          }
        } catch (invocationException: InvocationTargetException) {
          throw invocationException.targetException
        }
      }
    }
  } catch (ignored: Throwable) {
    SharkLog.d(ignored) { "Could not watch destroyed services" }
  }
}

ObjectWatcher:
@Synchronized override fun expectWeaklyReachable(
  watchedObject: Any,
  description: String
) {
  //這邊在前面初始化的時候默認(rèn)傳進(jìn)來是true，因此會繼續(xù)往下執(zhí)行下面的代碼
  if (!isEnabled()) {
    return
  }
  //這邊會先先處理下，將被回收的對象從watchedObjects這個待觀察的集合里面移除
  removeWeaklyReachableObjects()
  //創(chuàng)建一個隨機(jī)的UUID，用來當(dāng)做待觀察對象的key，方便從watchedObjects這個map取值
  val key = UUID.randomUUID()
    .toString()
  // 獲取當(dāng)前的時間，自系統(tǒng)開機(jī)到現(xiàn)在的一個時間
  val watchUptimeMillis = clock.uptimeMillis()
  //創(chuàng)建弱引用對象，也就是WeakReference
  val reference =
    KeyedWeakReference(watchedObject, key, description, watchUptimeMillis, queue)
  SharkLog.d {
    "Watching " +
      (if (watchedObject is Class<*>) watchedObject.toString() else "instance of ${watchedObject.javaClass.name}") +
      (if (description.isNotEmpty()) " ($description)" else "") +
      " with key $key"
  }
  //把對象放入到待觀察集合里面去
  watchedObjects[key] = reference
  //執(zhí)行延時操作，默認(rèn)延時5秒，去檢查對象是否回收
  checkRetainedExecutor.execute {
    moveToRetained(key)
  }
}

private fun removeWeaklyReachableObjects() {
  // WeakReferences are enqueued as soon as the object to which they point to becomes weakly
  // reachable. This is before finalization or garbage collection has actually happened.
  var ref: KeyedWeakReference?
  //通過迭代遍歷的方式，判斷queue里面時候有被回收的對象
  do {
    ref = queue.poll() as KeyedWeakReference?
    if (ref != null) {
      //如果對象被回收了 ，則講弱引用從待觀察的map里面移除
      watchedObjects.remove(ref.key)
    }
  } while (ref != null)
}

@Synchronized private fun moveToRetained(key: String) {
  removeWeaklyReachableObjects()
  val retainedRef = watchedObjects[key]
  if (retainedRef != null) {
    retainedRef.retainedUptimeMillis = clock.uptimeMillis()
    onObjectRetainedListeners.forEach { it.onObjectRetained() }
  }
}

AppWatcher
  -> manualIstall()
    -> LeakCanaryDelegate.loadLeakCanary(application)
      -> InternalLeakCanary
       -> invoke()

internal object InternalLeakCanary : (Application) -> Unit, OnObjectRetainedListener {
    ...
    override fun invoke(application: Application) {
      _application = application
      checkRunningInDebuggableBuild()
      //添加監(jiān)聽，因為InternalLeakCanary實現(xiàn)了OnObjectRetainedListener接口，因此直接傳this
      AppWatcher.objectWatcher.addOnObjectRetainedListener(this)
      ...
    }
    ...
}

internal object InternalLeakCanary : (Application) -> Unit, OnObjectRetainedListener {
    ...
    //回調(diào)到這個方法，然后又調(diào)用了scheduleRetainedObjectCheck
    override fun onObjectRetained() = scheduleRetainedObjectCheck()
    fun scheduleRetainedObjectCheck() {
      //先判斷heapDumpTrigger是否有初始化了，
      if (this::heapDumpTrigger.isInitialized) {
        heapDumpTrigger.scheduleRetainedObjectCheck()
      }
    }
    ...   
}

fun scheduleRetainedObjectCheck(
  delayMillis: Long = 0L
) {
  val checkCurrentlyScheduledAt = checkScheduledAt
  //如果之前的子線程任務(wù)來沒開始執(zhí)行則返回，也就是就是下面的backgroundHandler.postDelayed
  if (checkCurrentlyScheduledAt > 0) {
    return
  }
  checkScheduledAt = SystemClock.uptimeMillis() + delayMillis
  //讓子線程延時去delayMillis執(zhí)行，通過上面的調(diào)用鏈進(jìn)入此方法則delayMillis為0，因此會馬上執(zhí)行
  backgroundHandler.postDelayed({
    //子線程任務(wù)開始執(zhí)行，就將checkScheduledAt設(shè)置為0，以便下一次出現(xiàn)內(nèi)存泄漏時能還能進(jìn)來
    checkScheduledAt = 0
    checkRetainedObjects()
  }, delayMillis)
}

private fun checkRetainedObjects() {
  ...
  //看下此時待觀察的集合里面還有多少個沒有被分析的弱引用對象
  //也就是retainedUptimeMillis != -1L 的對象的個數(shù)
  //并且在調(diào)用retainedObjectCount.get()的時候，還會再調(diào)用一次removeWeaklyReachableObjects()，嘗試再次移除一遍
  var retainedReferenceCount = objectWatcher.retainedObjectCount
  //如果此時還有泄漏對象，則調(diào)用gc，并重新再獲取一次數(shù)量
  if (retainedReferenceCount > 0) {
    gcTrigger.runGc()
    retainedReferenceCount = objectWatcher.retainedObjectCount
  }
  //這邊判斷應(yīng)用是出于前臺還是后臺，
  //如果是在前臺，則個數(shù)達(dá)到5個時才dump，如果應(yīng)用在后臺則只要有一個都會進(jìn)行dump
  if (checkRetainedCount(retainedReferenceCount, config.retainedVisibleThreshold)) return
  val now = SystemClock.uptimeMillis()
  val elapsedSinceLastDumpMillis = now - lastHeapDumpUptimeMillis
  //如果這個時間與上次dump的時間過短，則會重新調(diào)用scheduleRetainedObjectCheck，
  //并延遲執(zhí)行，這個延遲的時間 = 60s - 時間差，避免兩次dump的時間過短，影響使用
  if (elapsedSinceLastDumpMillis < WAIT_BETWEEN_HEAP_DUMPS_MILLIS) {
    onRetainInstanceListener.onEvent(DumpHappenedRecently)
    showRetainedCountNotification(
      objectCount = retainedReferenceCount,
      contentText = application.getString(R.string.leak_canary_notification_retained_dump_wait)
    )
    scheduleRetainedObjectCheck(
      delayMillis = WAIT_BETWEEN_HEAP_DUMPS_MILLIS - elapsedSinceLastDumpMillis
    )
    return
  }
  dismissRetainedCountNotification()
  val visibility = if (applicationVisible) "visible" else "not visible"
  //這邊開始進(jìn)行dump
  dumpHeap(
    retainedReferenceCount = retainedReferenceCount,
    retry = true,
    reason = "$retainedReferenceCount retained objects, app is $visibility"
  )
}

private fun dumpHeap(
  retainedReferenceCount: Int,
  retry: Boolean,
  reason: String
) {
    ...
    val heapDumpUptimeMillis = SystemClock.uptimeMillis()
    ...
    //執(zhí)行dump，并計算dump的時間
    durationMillis = measureDurationMillis {
      //執(zhí)行dump，這邊就不分析了，感興趣可以自行點進(jìn)去看下
      configProvider().heapDumper.dumpHeap(heapDumpFile)
    }
    ...
    //dump之后處理以分析的對象
    objectWatcher.clearObjectsWatchedBefore(heapDumpUptimeMillis)
}

/**
 * Clears all [KeyedWeakReference] that were created before [heapDumpUptimeMillis] (based on
 * [clock] [Clock.uptimeMillis])
 */
@Synchronized fun clearObjectsWatchedBefore(heapDumpUptimeMillis: Long) {
  //從待觀察集合里面過濾出時間小于等于當(dāng)前dump時間的弱引用
  val weakRefsToRemove =
    watchedObjects.filter { it.value.watchUptimeMillis <= heapDumpUptimeMillis }
  //遍歷執(zhí)行clear，將時間設(shè)置為-1，這個在下次觸發(fā)執(zhí)行checkRetainedObjects，里面不會重復(fù)判斷
  weakRefsToRemove.values.forEach { it.clear() }
  //然后從待觀察列表里面移除
  watchedObjects.keys.removeAll(weakRefsToRemove.keys)
}