Android智能指针

void testScope() {
    Sheep bigSheep; //局部对象
    {
        Sheep smallSheep; // 局部对象
    } // smallSheep的作用域结束
} // bigSheep的作用域结束

void testMemoryMap() {
    Sheep sheep; // 栈对象，testMemoryMap调用结束后自动释放
    Sheep* pSheep; // 堆对象，需要手动释放
    delete pSheep; // 释放pSheep指向的对象
    pSheep = 0; //将pSheep指向NULL，防止造成野指针
}

int32_t android_atomic_add(int32_t increment, volatile int32_t *ptr) // 加函数，返回旧值，*ptr = *ptr + increment

int32_t android_atomic_inc(volatile int32_t *addr) // 自增操作，返回旧值，*ptr = *ptr + 1

int32_t android_atomic_dec(volatile int32_t *addr) // 自减操作， 返回旧值，*ptr = *ptr - 1

int32_t android_atomic_and(int32_t value, volatile int32_t *ptr) // 位与操作，返回旧值，*ptr = *ptr & value

int32_t android_atomic_or(int32_t value, volatile int32_t *ptr) // 位或操作，返回旧值，*ptr = *ptr | value

int android_atomic_cmpxchg(int32_t old_value, int32_t new_value, volatile int32_t *ptr) // 如果*addr == oldvalue，就会执行*addr = new_value的操作，然后返回0，否则返回1

class Sheep: public RefBase { // 羊年，定义Sheep从RefBase派生
public:
    Sheep() : RefBase() { }// 可显示调用RefBase的构造，也可以不用
    virtual ~Sheep() { }// 最好声明为virtual，以便从Sheep派生
}; 
void testSheep() {
    Sheep* pSheep = new Sheep(); // new一个Sheep对象，这个是一个堆对象
    { // 限定sp的作用域
        sp<Sheep> spSheep(pSheep); // spSheep是一个栈对象
        { // 限定wp的作用域
            wp<Sheep> wpSheep(pSheep);
        } // 调用wp的析构函数
    } // 调用sp的析构函数，实际对象pSheep已释放，若再使用pSheep将会出错
}

RefBase::RefBase()
    : mRefs(new weakref_impl(this)) // 真正管理引用计数
{}
weakref_impl(RefBase* base)
    : mStrong(INITIAL_STRONG_VALUE) // 1<<28（268435456），为什么不是0？
    , mWeak(0)
    , mBase(base) // mBase指向实际对象
    , mFlags(0) // 这个标识很重要，指定是强应用控制还是弱引用控制
{}

void RefBase::extendObjectLifetime(int32_t mode)
{
    android_atomic_or(mode, &mRefs->mFlags);
}

template<typename T>
sp<T>::sp(T* other)
        : m_ptr(other) {
    if (other)
        other->incStrong(this);
}

void RefBase::incStrong(const void* id) const
{
    weakref_impl* const refs = mRefs;
    refs->incWeak(id); // 调用incWeak函数
    
    refs->addStrongRef(id); // 由DEBUG_REFS控制，release版本什么也不做
    const int32_t c = android_atomic_inc(&refs->mStrong); // 强引用数+1，c为旧值
    ALOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);
    if (c != INITIAL_STRONG_VALUE)  { //判断是否是第一次引用
        return;
    } // 第一次引用，refs->mStrong为1<<28 +1 (268435457）

    android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong); 
    // refs->mStrong为1
    refs->mBase->onFirstRef(); //第一次引用时调用
}

void RefBase::weakref_type::incWeak(const void* id)
{
    weakref_impl* const impl = static_cast<weakref_impl*>(this);
    impl->addWeakRef(id); // 由DEBUG_REFS控制，release版本什么也不做
    const int32_t c __unused = android_atomic_inc(&impl->mWeak); //弱引用数+1
    ALOG_ASSERT(c >= 0, "incWeak called on %p after last weak ref", this);
}

template<typename T>
wp<T>::wp(T* other)
    : m_ptr(other)
{
    if (other) m_refs = other->createWeak(this);
}

RefBase::weakref_type* RefBase::createWeak(const void* id) const
{
    mRefs->incWeak(id); // incWeak函数前面分析过，最终的结果就是弱引用数+1
    return mRefs;
}

template<typename T>
wp<T>::~wp()
{
    if (m_ptr) m_refs->decWeak(this); // 调用decWeak函数
}

void RefBase::weakref_type::decWeak(const void* id)
{
    weakref_impl* const impl = static_cast<weakref_impl*>(this);
    impl->removeWeakRef(id);
    const int32_t c = android_atomic_dec(&impl->mWeak); // 弱引用数-1，c为旧值
    ALOG_ASSERT(c >= 1, "decWeak called on %p too many times", this);
    if (c != 1) return; //c为旧值，判断是否是最后一次弱引用
    // 记得前面我们说的，mFlags为0，我们并没有改变它
    if ((impl->mFlags&OBJECT_LIFETIME_WEAK) ==
            OBJECT_LIFETIME_STRONG) { 
        // 强引用控制，是否释放实际对象是根据强引用数
        if (impl->mStrong == INITIAL_STRONG_VALUE) {
            delete impl->mBase; // 根本就没有强引用引用实际对象，释放实际对象
        } else {
            delete impl; // 释放mRefs
        }
    } else {
        impl->mBase->onLastWeakRef(id); //最后一次弱引用时调用
        if ((impl->mFlags&OBJECT_LIFETIME_MASK) ==
                        OBJECT_LIFETIME_WEAK) {
            delete impl->mBase; //弱引用控制，释放实际对象
        }
    }
}

template<typename T>
sp<T>::~sp() {
    if (m_ptr)
        m_ptr->decStrong(this);
}

void RefBase::decStrong(const void* id) const
{
    weakref_impl* const refs = mRefs;
    refs->removeStrongRef(id); // 由DEBUG_REFS控制，release版本什么也不做
    const int32_t c = android_atomic_dec(&refs->mStrong); // 强引用数-1
    ALOG_ASSERT(c >= 1, "decStrong() called on %p too many times", refs);
    if (c == 1) { // c为旧值，c为1时，即强引用数为0
        refs->mBase->onLastStrongRef(id); //最后一次强引用结束时调用
        if ((refs->mFlags&OBJECT_LIFETIME_MASK) == 
                        OBJECT_LIFETIME_STRONG) {
            delete this; // 若是强引用控制，释放实际对象，调实际对象的析构函数
        }
    }
    refs->decWeak(id);
}

RefBase::~RefBase()
{
    if (mRefs->mStrong == INITIAL_STRONG_VALUE) {
        delete mRefs; // 没有强引用引用实际对象，释放mRefs
    } else {
        if ((mRefs->mFlags & OBJECT_LIFETIME_MASK) !=
                        OBJECT_LIFETIME_STRONG) {
            if (mRefs->mWeak == 0) {
                delete mRefs; // 释放mRefs指向的对象
            }
        }
    }
    // for debugging purposes, clear this.
    const_cast<weakref_impl*&>(mRefs) = NULL; // mRefs指向0，避免野指针
}

// 第一次强引用时回调
virtual void onFirstRef();
// 最后一次强引用时调用 
virtual void onLastStrongRef(const void* id); 
//由弱到强时调用，稍候介绍
virtual bool onIncStrongAttempted(uint32_t flags, const void* id); 
// 最后一次弱引用时调用
virtual void onLastWeakRef(const void* id);

void testPromote() {
    {
        Sheep* pSheep = new Sheep();
        wp<Sheep> wpSheep(pSheep);
        sp<Sheep> spSheep = wpSheep.promote();
    }
}

template<typename T>
sp<T> wp<T>::promote() const
{
    sp<T> result;
    if (m_ptr && m_refs->attemptIncStrong(&result)) {
        result.set_pointer(m_ptr);
    }
    return result;
}

bool RefBase::weakref_type::attemptIncStrong(const void* id)
{
    incWeak(id); // 前面分析过，弱引用数+1；我们的实例中，此时弱引用数为2
    
    weakref_impl* const impl = static_cast<weakref_impl*>(this);
    int32_t curCount = impl->mStrong;

    while (curCount > 0 && curCount != INITIAL_STRONG_VALUE) {
        if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mStrong) == 0) {
            break;
        }
        curCount = impl->mStrong;
    }
    
    if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
        if ((impl->mFlags&OBJECT_LIFETIME_WEAK) ==
                        OBJECT_LIFETIME_STRONG) {
                ……
            while (curCount > 0) {
                if (android_atomic_cmpxchg(curCount, curCount + 1,
                        &impl->mStrong) == 0) { // 强引用控制，强引用数+1
                    break;
                }
                curCount = impl->mStrong;
            }
             ……
        } else {
            …… // 弱引用控制，强引用数 +1
            curCount = android_atomic_inc(&impl->mStrong); 
        }
    }
    ……
    return true; // 由弱变强成功
}

template <class T>
class LightRefBase
{
public:
    inline LightRefBase() : mCount(0) { }
    inline void incStrong(__attribute__((unused)) const void* id) const {
        android_atomic_inc(&mCount);
    }
    inline void decStrong(__attribute__((unused)) const void* id) const {
        if (android_atomic_dec(&mCount) == 1) {
            delete static_cast<const T*>(this);
        }
    }
    inline int32_t getStrongCount() const {
        return mCount;
    }

    typedef LightRefBase<T> basetype;

protected:
    inline ~LightRefBase() { }
……
private:
    mutable volatile int32_t mCount;
};

class Goat: public LightRefBase<Goat> {
public:
    Goat() {
        ALOGD("Goat::Goat constructor invoked this=%p \n", this);
    }
private:
    friend class LightRefBase<Goat> ;
    ~Goat() {
        ALOGD("Goat::Goat destructor invoked this=%p \n", this);
    }
};

void testGoat() {
    Goat* pGoat = new Goat(); //初始时mCount为0
    ALOGD("Goat:: before sp ref, mCount=%d", pGoat->getStrongCount());
    {
        sp<Goat> spGoat(pGoat); // 调用pGoat的incStrong函数，mCount为1
    }
// spGoat的作用域结束，调用pGoat的decStrong函数，mCount为0，delete掉pGoat
}

--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1056,6 +1056,12 @@ void SurfaceFlinger::handleTransaction(uint32_t transactionFlags)
 {
     ATRACE_CALL();
 
+    // here we keep a copy of the drawing state (that is the state that's
+    // going to be overwritten by handleTransactionLocked()) outside of
+    // mStateLock so that the side-effects of the State assignment
+    // don't happen with mStateLock held (which can cause deadlocks).
+    State drawingState(mDrawingState);
+
     Mutex::Autolock _l(mStateLock);
     const nsecs_t now = systemTime();
     mDebugInTransaction = now;

struct State {
    LayerVector layersSortedByZ;
    DefaultKeyedVector< wp<IBinder>, DisplayDeviceState> displays;
};
……
class LayerVector : public SortedVector< sp<Layer> > {
public:
    LayerVector();
    LayerVector(const LayerVector& rhs);
    virtual int do_compare(const void* lhs, const void* rhs) const;
};

template<typename T>
void sp<T>::force_set(T* other) {
    other->forceIncStrong(this);
    m_ptr = other; // 若m-ptr之前指向其他的对象，则其他对象的m-ptr不为0
}

void testForceSet() {
    {
        sp<Sheep> spSheep(new Sheep());
        spSheep.force_set(new Sheep());
    }
}

void testForceSet() {
    {
        sp<Sheep> spSheep; // spSheep的m_ptr并没有指向实际的对象
        spSheep.force_set(new Sheep());
    }
}

--- a/include/utils/StrongPointer.h
+++ b/include/utils/StrongPointer.h
@@ -187,7 +187,12 @@ sp<T>& sp<T>::operator =(U* other) {
 
 template<typename T>
 void sp<T>::force_set(T* other) {
-    other->forceIncStrong(this);
+    if (m_ptr) {
+        m_ptr->decStrong(this);
+    }
+    if (other) {
+        other->forceIncStrong(this);
+    }
     m_ptr = other;
 }