debugImplementation 'com.squareup.leakcanary:leakcanary-android:2.10'

// 定義類(lèi)
class A
// 檢測(cè)的目標(biāo)對(duì)象
val obj = A()
val queue = ReferenceQueue<A>()
val weakObj = WeakReference(obj, queue)
// 觸發(fā)gc回收（注意：這樣的操作不一定可以觸發(fā)gc，具體如何觸發(fā)gc 在下面的源碼分析中有提到 leakcanary 是如何觸發(fā)gc的）
System.gc()

val tmp = queue.poll()
if (tmp === obj) {
    // 被回收
} else {
    // 未回收
}

internal class MainProcessAppWatcherInstaller : ContentProvider() {
  override fun onCreate(): Boolean {
    val application = context!!.applicationContext as Application
    AppWatcher.manualInstall(application)
    return true
  }
  //..
}

fun manualInstall(
  application: Application,
  retainedDelayMillis: Long = TimeUnit.SECONDS.toMillis(5), // 默認(rèn) 5s
  watchersToInstall: List<InstallableWatcher> = appDefaultWatchers(application) // 獲取默認(rèn)Watchers 下面詳細(xì)分析
) {
  // 檢查是否在主線程
  // 原理：Looper.getMainLooper().thread === Thread.currentThread()
  checkMainThread()
  // ...
  this.retainedDelayMillis = retainedDelayMillis
  // 初始化 Shark 庫(kù)
  if (application.isDebuggableBuild) {
    LogcatSharkLog.install()
  }
  // 這行代碼下面詳細(xì)分析
  LeakCanaryDelegate.loadLeakCanary(application)
  // 對(duì) watchers 遍歷調(diào)用 install 
  watchersToInstall.forEach {
    it.install()
  }
  // 給 installCause 賦值，代表已經(jīng)初始化
  installCause = RuntimeException("manualInstall() first called here")
}

interface InstallableWatcher {
  fun install()
  fun uninstall()
}

fun appDefaultWatchers(
  application: Application,
  reachabilityWatcher: ReachabilityWatcher = objectWatcher // 注意這個(gè) objectWatcher 很重要
): List<InstallableWatcher> {
  return listOf(
    ActivityWatcher(application, reachabilityWatcher), // 用于監(jiān)控activity內(nèi)存泄漏
    FragmentAndViewModelWatcher(application, reachabilityWatcher),// 用于監(jiān)控fragment,viewmodel 內(nèi)存泄漏
    RootViewWatcher(reachabilityWatcher),// 用于監(jiān)聽(tīng) rootview 內(nèi)存泄漏
    ServiceWatcher(reachabilityWatcher) // 用于監(jiān)聽(tīng) service 內(nèi)存泄漏
  )
}

val objectWatcher = ObjectWatcher(...)

internal object LeakCanaryDelegate {
  // 延遲初始化
  val loadLeakCanary by lazy {
    try {
      // 默認(rèn)加載 InternalLeakCanary 獲取其 INSTANCE 字段
      // InternalLeakCanary 是一個(gè) object class，編譯為 java 后會(huì)自動(dòng)生成 INSTANCE
      // 就是一個(gè)單例類(lèi) 這里是獲取其單例對(duì)象
      val leakCanaryListener = Class.forName("leakcanary.internal.InternalLeakCanary")
      leakCanaryListener.getDeclaredField("INSTANCE")
        .get(null) as (Application) -> Unit
    } catch (ignored: Throwable) {
      // 出現(xiàn)異常時(shí)返回 NoLeakCanary
      NoLeakCanary
    }
  }
  // (Application) -> Unit 函數(shù)類(lèi)型變量，接受一個(gè) application 作為參數(shù)
  // 內(nèi)部都是空實(shí)現(xiàn)
  object NoLeakCanary : (Application) -> Unit, OnObjectRetainedListener {
    override fun invoke(application: Application) {}
    override fun onObjectRetained() {}
  }
}

internal object InternalLeakCanary : (Application) -> Unit, OnObjectRetainedListener {
    override fun invoke(application: Application) {
      _application = application
      checkRunningInDebuggableBuild() // 檢查是否是 debug 模式
      // 對(duì) AppWatcher 的 objectWatcher 添加 listener
      AppWatcher.objectWatcher.addOnObjectRetainedListener(this)
      // 這個(gè)用于觸發(fā) gc 回收，下面會(huì)分析一下
      val gcTrigger = GcTrigger.Default
      // 獲取相關(guān)配置
      val configProvider = { LeakCanary.config }
      // 啟動(dòng)了一個(gè) HandlerThread
      val handlerThread = HandlerThread(LEAK_CANARY_THREAD_NAME)
      handlerThread.start()
      val backgroundHandler = Handler(handlerThread.looper)
      // 初始化堆轉(zhuǎn)儲(chǔ)對(duì)象，上面定義的一些變量也都傳入了進(jìn)去
      heapDumpTrigger = HeapDumpTrigger(
        application, backgroundHandler, AppWatcher.objectWatcher, gcTrigger,
        configProvider
      )
      // Leakcanary 對(duì) Application 的一個(gè)擴(kuò)展方法
      // 這里的作用是在 App 前后臺(tái)切換時(shí)執(zhí)行閉包中的邏輯 也就是調(diào)用堆轉(zhuǎn)儲(chǔ)的 onApplicationVisibilityChanged 方法
      application.registerVisibilityListener { applicationVisible ->
        this.applicationVisible = applicationVisible
        heapDumpTrigger.onApplicationVisibilityChanged(applicationVisible)
      }
      // 這個(gè)方法代碼比較簡(jiǎn)單利用 Application.registerActivityLifecycleCallbacks
      // 獲取處于激活狀態(tài)的 Activity 賦值給 resumedActivity
      registerResumedActivityListener(application)
      // 添加桌面快捷方式，也就是Leakcanary小黃鳥(niǎo)app圖標(biāo)，感興趣的可以看一下 這里就不詳細(xì)分析這個(gè)方法了
      addDynamicShortcut(application)
      // ...
    }

}

val objectWatcher = ObjectWatcher(
  // 返回一個(gè) Clock 對(duì)象
  clock = { SystemClock.uptimeMillis() },
  // Executor 對(duì)象
  checkRetainedExecutor = {
    // 切換到主線程延遲執(zhí)行, retainedDelayMillis 默認(rèn)是 5s
    mainHandler.postDelayed(it, retainedDelayMillis)
  },
  // 這個(gè)參數(shù)是 () -> Boolean 函數(shù)類(lèi)型，默認(rèn)是直接返回一個(gè) true
  isEnabled = { true }
)

// 注意這個(gè) fun interface 是 kotlin 在 1.4 引入的 函數(shù)式接口
// 接口中只能有一個(gè)未實(shí)現(xiàn)的方法
fun interface Clock {
  fun uptimeMillis(): Long
  // ...
}

clock = object : Clock{
    override fun uptimeMillis(): Long {
        SystemClock.uptimeMillis()
    }
}

class ActivityWatcher(
  private val application: Application,
  // 注意這里，傳進(jìn)來(lái)的是 AppWatcher 的 objectWatcher
  private val reachabilityWatcher: ReachabilityWatcher
) : InstallableWatcher {

  private val lifecycleCallbacks =
    object : Application.ActivityLifecycleCallbacks by noOpDelegate() {
      override fun onActivityDestroyed(activity: Activity) {
        // 核心就在這一行代碼里 這里也就是調(diào)用了 objectWatcher 的 expectWeaklyReachable 方法
        reachabilityWatcher.expectWeaklyReachable(
          activity, "${activity::class.java.name} received Activity#onDestroy() callback"
        )
      }
    }

  override fun install() {
    // 利用 Application 監(jiān)聽(tīng) Activity onDestory 生命周期方法
    application.registerActivityLifecycleCallbacks(lifecycleCallbacks)
  }

  override fun uninstall() {
    application.unregisterActivityLifecycleCallbacks(lifecycleCallbacks)
  }
}

// 保存監(jiān)控對(duì)象的 map
private val watchedObjects = mutableMapOf<String, KeyedWeakReference>()
// 用于弱引用關(guān)聯(lián)隊(duì)列
private val queue = ReferenceQueue<Any>()

@Synchronized override fun expectWeaklyReachable(
  watchedObject: Any, // 傳入的 activity（已經(jīng) onDestory）
  description: String // 描述
) {
  if (!isEnabled()) { // 默認(rèn) isEnabled 返回 true，不會(huì)進(jìn)入這個(gè) if
    return
  }
  // 這個(gè)代碼比較簡(jiǎn)單 我就簡(jiǎn)單說(shuō)下作用
  // 當(dāng) watchedObject 成功被回收會(huì)添加進(jìn) queue 中，這個(gè)方法就是將添加到 queue 中的對(duì)象
  // 從 watchedObjects 中移除，被移除的說(shuō)明沒(méi)有發(fā)生內(nèi)存泄漏
  removeWeaklyReachableObjects()
  // 生成id （相當(dāng)于對(duì)象的身份證）
  val key = UUID.randomUUID()
    .toString()
  // 獲取時(shí)間戳
  val watchUptimeMillis = clock.uptimeMillis()
  // 將對(duì)象以及一些信息包裝為 KeyedWeakReference
  val reference =
    KeyedWeakReference(watchedObject, key, description, watchUptimeMillis, queue)
  // ...
  // 包裝好的對(duì)象放入 watchedObjects 這個(gè) map 中
  watchedObjects[key] = reference
  // checkRetainedExecutor 別忘了，就是切換到主線程延遲 5s 執(zhí)行
  checkRetainedExecutor.execute {
    // 主線程調(diào)用
    moveToRetained(key)
  }
}

class KeyedWeakReference(
  referent: Any, // 監(jiān)控對(duì)象，這里是 onDestory 的 Activity
  val key: String, // UUID 身份證
  val description: String, // 描述
  val watchUptimeMillis: Long, // 時(shí)間
  referenceQueue: ReferenceQueue<Any> // 當(dāng) referent 被回收會(huì)添加到這個(gè)隊(duì)列中
) : WeakReference<Any>(referent, referenceQueue)
//最后調(diào)用了 WeakReference 的雙參數(shù)構(gòu)造器

@Synchronized private fun moveToRetained(key: String) {
  // 再次嘗試從 queue 中獲取回收成功的對(duì)象，從 watcherObjects 中移除
  removeWeaklyReachableObjects()
  val retainedRef = watchedObjects[key]
  if (retainedRef != null) { // 如果還可以獲取到代表回收失敗 發(fā)生了內(nèi)存泄漏
    retainedRef.retainedUptimeMillis = clock.uptimeMillis()
    // 遍歷 onObjectRetainedListeners 對(duì)象調(diào)用其 onObjectRetained 方法
    onObjectRetainedListeners.forEach { it.onObjectRetained() }
  }
}

// 又調(diào)用了 scheduleRetainedObjectCheck 方法
override fun onObjectRetained() = scheduleRetainedObjectCheck()

fun scheduleRetainedObjectCheck() {
  if (this::heapDumpTrigger.isInitialized) {
    // 又調(diào)用到了 堆轉(zhuǎn)儲(chǔ) 對(duì)象里的 scheduleRetainedObjectCheck 方法
    heapDumpTrigger.scheduleRetainedObjectCheck()
  }
}

fun scheduleRetainedObjectCheck(
  delayMillis: Long = 0L
) {
  val checkCurrentlyScheduledAt = checkScheduledAt
  if (checkCurrentlyScheduledAt > 0) {
    return
  }
  checkScheduledAt = SystemClock.uptimeMillis() + delayMillis
  // backgroundHandler 前面看過(guò)了 是一個(gè) HandlerThread 這里是放到子線程執(zhí)行
  backgroundHandler.postDelayed({
    checkScheduledAt = 0
    // 重點(diǎn)是這個(gè)方法
    checkRetainedObjects()
  }, delayMillis)
}

private fun checkRetainedObjects() {
  val iCanHasHeap = HeapDumpControl.iCanHasHeap()

  val config = configProvider()
  // ...
  // 獲取仍然存在于 map 中沒(méi)有被回收的對(duì)象數(shù)量
  var retainedReferenceCount = objectWatcher.retainedObjectCount
  // 如果有再執(zhí)行一次 gc
  if (retainedReferenceCount > 0) {
    gcTrigger.runGc() // gc 操作，注意這里的實(shí)現(xiàn) 后面會(huì)貼源碼
    retainedReferenceCount = objectWatcher.retainedObjectCount // 再次獲取數(shù)量
  }
  // 里面是對(duì)app 是否在前臺(tái)，存活對(duì)象數(shù)量的判斷，retainedVisibleThreshold 默認(rèn)是 5
  if (checkRetainedCount(retainedReferenceCount, config.retainedVisibleThreshold)) return
  
  val now = SystemClock.uptimeMillis()
  val elapsedSinceLastDumpMillis = now - lastHeapDumpUptimeMillis
  // 判斷上次堆轉(zhuǎn)儲(chǔ)時(shí)間間隔是否小于 60s
  if (elapsedSinceLastDumpMillis < WAIT_BETWEEN_HEAP_DUMPS_MILLIS) {
    onRetainInstanceListener.onEvent(DumpHappenedRecently)
    showRetainedCountNotification(
      objectCount = retainedReferenceCount,
      contentText = application.getString(R.string.leak_canary_notification_retained_dump_wait)
    )
    // 小于60s 就延遲對(duì)應(yīng)時(shí)間在重新執(zhí)行該方法
    scheduleRetainedObjectCheck(
      delayMillis = WAIT_BETWEEN_HEAP_DUMPS_MILLIS - elapsedSinceLastDumpMillis
    )
    return
  }
  
  dismissRetainedCountNotification()
  val visibility = if (applicationVisible) "visible" else "not visible"
  // 開(kāi)始堆轉(zhuǎn)儲(chǔ)
  dumpHeap(
    retainedReferenceCount = retainedReferenceCount,
    retry = true,
    reason = "$retainedReferenceCount retained objects, app is $visibility"
  )
}

object Default : GcTrigger {
  override fun runGc() {
    // 這段執(zhí)行g(shù)c的代碼 leakcanary 注釋中表示是借鑒于 Android 系統(tǒng)源碼片段
    // System.gc() 并不是每次執(zhí)行都能觸發(fā)gc，而 Runtime gc() 更容易觸發(fā)
    // 這里的源碼細(xì)節(jié)值得借鑒
    Runtime.getRuntime().gc()
    enqueueReferences()
    System.runFinalization()
  }
  // ...
}

private fun dumpHeap(
  retainedReferenceCount: Int,
  retry: Boolean,
  reason: String
) {
  // 注意這個(gè) directoryProvider 并不是 ContentProvider 只是一個(gè)普通類(lèi)
  val directoryProvider =
    InternalLeakCanary.createLeakDirectoryProvider(InternalLeakCanary.application)
  // 新建堆轉(zhuǎn)儲(chǔ)文件，內(nèi)部包含一些權(quán)限、目錄等等邏輯判斷 比較簡(jiǎn)單就不貼代碼了
  // 生成文件名：fileName = SimpleDateFormat("yyyy-MM-dd_HH-mm-ss_SSS'.hprof'", Locale.US).format(Date())
  val heapDumpFile = directoryProvider.newHeapDumpFile()

  val durationMillis: Long
  if (currentEventUniqueId == null) {
    currentEventUniqueId = UUID.randomUUID().toString()
  }
  try {
    // 通知欄 Event
    InternalLeakCanary.sendEvent(DumpingHeap(currentEventUniqueId!!))
    // ...
    durationMillis = measureDurationMillis {
      // 這里是堆轉(zhuǎn)儲(chǔ)核心
      configProvider().heapDumper.dumpHeap(heapDumpFile)
    }
    // 觸發(fā)后面的分析方法
    InternalLeakCanary.sendEvent(HeapDump(currentEventUniqueId!!, heapDumpFile, durationMillis, reason))
  } catch (throwable: Throwable) {
    // 堆轉(zhuǎn)儲(chǔ)失敗
    InternalLeakCanary.sendEvent(HeapDumpFailed(currentEventUniqueId!!, throwable, retry))
    if (retry) { // 重試則延遲再執(zhí)行一次方法
      scheduleRetainedObjectCheck(
        delayMillis = WAIT_AFTER_DUMP_FAILED_MILLIS
      )
    }
    // 通知欄展示
    showRetainedCountNotification(
      objectCount = retainedReferenceCount,
      contentText = application.getString(
        R.string.leak_canary_notification_retained_dump_failed
      )
    )
    return
  }
}

object AndroidDebugHeapDumper : HeapDumper {
  override fun dumpHeap(heapDumpFile: File) {
    // 利用 Android 本身的 Debug dumpHprofData 方法實(shí)現(xiàn)
    Debug.dumpHprofData(heapDumpFile.absolutePath)
  }
}

private val fragmentDestroyWatchers: List<(Activity) -> Unit> = run {
  // 注意這個(gè) list 的類(lèi)型，item 是函數(shù)式變量，相當(dāng)于方法可以直接調(diào)用
  val fragmentDestroyWatchers = mutableListOf<(Activity) -> Unit>()
  
  // sdk26 以上添加 AndroidOFragmentDestroyWatcher
  if (SDK_INT >= O) {
    fragmentDestroyWatchers.add(
      // reachabilityWatcher 是老朋友 objectWatcher 了
      AndroidOFragmentDestroyWatcher(reachabilityWatcher)
    )
  }
  // 通過(guò)反射獲取 AndroidXFragmentDestroyWatcher
  // 對(duì)應(yīng) androidX 的 fragment
  getWatcherIfAvailable(
    ANDROIDX_FRAGMENT_CLASS_NAME, // "androidx.fragment.app.Fragment"
    ANDROIDX_FRAGMENT_DESTROY_WATCHER_CLASS_NAME, // "AndroidXFragmentDestroyWatcher"
    reachabilityWatcher
  )?.let {
    fragmentDestroyWatchers.add(it)
  }
  
  // 通過(guò)反射獲取 AndroidSupportFragmentDestroyWatcher
  // 對(duì)應(yīng)之前的 android support 包下的 Fragment
  getWatcherIfAvailable(
    ANDROID_SUPPORT_FRAGMENT_CLASS_NAME, // "android.support.v4.app.Fragment"
    ANDROID_SUPPORT_FRAGMENT_DESTROY_WATCHER_CLASS_NAME, // "AndroidSupportFragmentDestroyWatcher"
    reachabilityWatcher
  )?.let {
    fragmentDestroyWatchers.add(it)
  }
  // 返回
  fragmentDestroyWatchers
}

internal class AndroidXFragmentDestroyWatcher(
  private val reachabilityWatcher: ReachabilityWatcher
) : (Activity) -> Unit {
  
  // 和上面的 AndroidOFragmentDestroyWatcher 一樣 就不貼代碼了
  private val fragmentLifecycleCallbacks = // ...

  override fun invoke(activity: Activity) {
    if (activity is FragmentActivity) {
      // 和 AndroidOFragmentDestroyWatcher 的原理是一樣的
      val supportFragmentManager = activity.supportFragmentManager
      supportFragmentManager.registerFragmentLifecycleCallbacks(fragmentLifecycleCallbacks, true)
      // 注意這里，多了一個(gè)針對(duì) ViewModel 的處理
      ViewModelClearedWatcher.install(activity, reachabilityWatcher)
    }
  }
}

// 注意這是一個(gè) ViewModel 的子類(lèi)
internal class ViewModelClearedWatcher(
  storeOwner: ViewModelStoreOwner,
  private val reachabilityWatcher: ReachabilityWatcher
) : ViewModel() {

  companion object {
    // 外部調(diào)用的 install 方法
    fun install(
      storeOwner: ViewModelStoreOwner, // 這里也就是 activity
      reachabilityWatcher: ReachabilityWatcher // objectWatcher
    ) {
      // 相當(dāng)于再 Activity onCreate 方法中又創(chuàng)建了一個(gè) ViewModel
      val provider = ViewModelProvider(storeOwner, object : Factory {
        @Suppress("UNCHECKED_CAST")
        override fun <T : ViewModel?> create(modelClass: Class<T>): T =
          ViewModelClearedWatcher(storeOwner, reachabilityWatcher) as T
      })
      provider.get(ViewModelClearedWatcher::class.java)
    }
  }
  
  // 反射 activity 中的 ViewModelStore 中的 mMap 字段
  // 這里面存儲(chǔ)著 activity 中創(chuàng)建的 ViewModel
  private val viewModelMap: Map<String, ViewModel>? = try {
    val mMapField = ViewModelStore::class.java.getDeclaredField("mMap")
    mMapField.isAccessible = true
    mMapField[storeOwner.viewModelStore] as Map<String, ViewModel>
  } catch (ignored: Exception) {
    null
  }
  
  // ViewModel 銷(xiāo)毀時(shí)觸發(fā)的方法
  override fun onCleared() {
    viewModelMap?.values?.forEach { viewModel ->
      // 進(jìn)行檢測(cè)
      reachabilityWatcher.expectWeaklyReachable(
        viewModel, "${viewModel::class.java.name} received ViewModel#onCleared() callback"
      )
    }
  }
}

internal class AndroidSupportFragmentDestroyWatcher(
  private val reachabilityWatcher: ReachabilityWatcher
) : (Activity) -> Unit {
  // 還是和上面一樣的
  private val fragmentLifecycleCallbacks = // ...

  override fun invoke(activity: Activity) {
    if (activity is FragmentActivity) {
      // AndroidSupport 包的 api
      val supportFragmentManager = activity.supportFragmentManager
      supportFragmentManager.registerFragmentLifecycleCallbacks(fragmentLifecycleCallbacks, true)
    }
  }
}

class ServiceWatcher(private val reachabilityWatcher: ReachabilityWatcher) : InstallableWatcher {
    override fun install() {
      checkMainThread() // 檢測(cè)主線程
      // ...
      try {
        // 重點(diǎn) 1: 反射 ActivityThread 的 mH 中的 mCallback
        // 也就是 Handler 的 mCallback
        swapActivityThreadHandlerCallback { mCallback ->
          uninstallActivityThreadHandlerCallback = {
            swapActivityThreadHandlerCallback {
              mCallback
            }
          }
          Handler.Callback { msg ->
            if (msg.obj !is IBinder) {
              return@Callback false
            }
            if (msg.what == STOP_SERVICE) { // AMS Service onDestory 的 message 的 what
              val key = msg.obj as IBinder
              // 注意這個(gè) activityThreadServices
              // 這個(gè)是反射獲取的 ActivityThread 中的 mServices 字段是 Map<IBinder, Service> 類(lèi)型
              // 這個(gè)字段存放所有啟動(dòng)的 Service
              activityThreadServices[key]?.let {
                // 這里是將要銷(xiāo)毀的 Service 進(jìn)行存儲(chǔ)
                // key 是 IBinder 對(duì)象
                onServicePreDestroy(key, it)
              }
            }
            mCallback?.handleMessage(msg) ?: false
          }
        }
        // 重點(diǎn) 2：反射獲取 AMS （ActivityManagerService）
        swapActivityManager { activityManagerInterface, activityManagerInstance ->
          uninstallActivityManager = {
            swapActivityManager { _, _ ->
              activityManagerInstance
            }
          }
          // 對(duì) AMS 進(jìn)行動(dòng)態(tài)代理 
          Proxy.newProxyInstance(
            activityManagerInterface.classLoader, arrayOf(activityManagerInterface)
          ) { _, method, args ->
            // 判斷方法名是否是 serviceDoneExecuting 
            if (METHOD_SERVICE_DONE_EXECUTING == method.name) {
              // 獲取 IBinder 對(duì)象
              val token = args!![0] as IBinder
              // 從上面存儲(chǔ)的 service 容器中查看是否存在對(duì)應(yīng) service
              if (servicesToBeDestroyed.containsKey(token)) {
                // 進(jìn)行內(nèi)存泄漏檢測(cè)
                onServiceDestroyed(token)
              }
            }
            // ...
          }
        }
      } 
      // ...
    }
    
    private fun onServiceDestroyed(token: IBinder) {
      // 從 servicesToBeDestroyed 中移除
      servicesToBeDestroyed.remove(token)?.also { serviceWeakReference ->
        serviceWeakReference.get()?.let { service ->
          // 利用 objectWatcher 進(jìn)行內(nèi)存泄漏檢測(cè)
          reachabilityWatcher.expectWeaklyReachable(
            service, "${service::class.java.name} received Service#onDestroy() callback"
          )
        }
      }
    }
}