pid: 2065, tid: 3206, name: InputReader >>> system_server <<< signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x58 x0 0000000000000000 x1 0000007f9f87275b x2 0000007f83bfcea0 x3 0000000000000000 x4 0000007f83bfd10c x5 0000007f83bfd114 x6 0000007f83bfd110 x7 0000007f83bfd10c x8 0000007f83bfcec8 x9 00000000ffffff80 x10 00000000ffffffd0 x11 0000007f83bfce70 x12 0000007f83bfcea0 x13 0000007f83bfcf10 x14 0008aa18c8000000 x15 003b9aca00000000 x16 0000007f9f30ad98 x17 0000007f9f2a81d0 x18 0000007f85822400 x19 0000000000000000 x20 0000007f83bfcea0 x21 0000007f9f87275b x22 d77f856b24575433 x23 0000000000000000 x24 d77f856b24575433 x25 0000007f858cc9dc x26 0000007f916f3dc0 x27 0000000000000006 x28 d77f856b24575433 x29 0000007f83bfcdd0 x30 0000007f9f2a0eb4 sp 0000007f83bfcd80 pc 0000007f9f2a8200 pstate 0000000060000000 v0 ffffff80ffffffd00000007f83bfce70 v1 0000007f83bfcea00000007f83bfcf10 v2 0000000000000000000000003f801e57 v3 0000000000000000000000003f801111 v4 00000000000000000000000000000000 v5 00000000000000000000000000000000 v6 00000000000000000000000000000000 v7 00000000000000000000000000000000 v8 00000000000000000000000000000000 v9 00000000000000000000000000000000 v10 00000000000000000000000000000000 v11 00000000000000000000000000000000 v12 00000000000000000000000000000000 v13 00000000000000000000000000000000 v14 00000000000000000000000000000000 v15 00000000000000000000000000000000 v16 00000000000000000000000000000000 v17 000000000000000000000000ebad8081 v18 000000000000000000000000ebad8082 v19 00000000000000000000000000000000 v20 000000000000000000000000ebad8084 v21 000000000000000000000000ebad8085 v22 000000000000000000000000ebad8086 v23 000000000000000000000000ebad8087 v24 000000000000000000000000ebad8088 v25 000000000000000000000000ebad8089 v26 000000000000000000000000ebad808a v27 000000000000000000000000ebad808b v28 000000000000000000000000ebad808c v29 000000000000000000000000ebad808d v30 000000000000000000000000ebad808e v31 000000000000000000000000ebad808f fpsr 00000013 fpcr 00000000
backtrace: #00 pc 000000000005f200 /system/lib64/libc.so (vfscanf+48) #01 pc 0000000000057eb0 /system/lib64/libc.so (fscanf+116) #02 pc 000000000001fff0 /system/lib64/libinput.so (_ZNK7android12KeyLayoutMap6mapKeyEiiPiPj+172) #03 pc 000000000002750c /system/lib64/libinputflinger.so (_ZNK7android8EventHub6mapKeyEiiiiPiS1_Pj+400) #04 pc 000000000003ea78 /system/lib64/libinputflinger.so (_ZN7android19KeyboardInputMapper10processKeyElbii+120) #05 pc 000000000003a688 /system/lib64/libinputflinger.so (_ZN7android11InputDevice7processEPKNS_8RawEventEm+308) #06 pc 000000000003958c /system/lib64/libinputflinger.so (_ZN7android11InputReader19processEventsLockedEPKNS_8RawEventEm+216) #07 pc 0000000000039398 /system/lib64/libinputflinger.so (_ZN7android11InputReader8loopOnceEv+248) #08 pc 000000000003c2e8 /system/lib64/libinputflinger.so (_ZN7android17InputReaderThread10threadLoopEv+20) #09 pc 000000000001242c /system/lib64/libutils.so (_ZN7android6Thread11_threadLoopEPv+272) #10 pc 00000000000a0ab8 /system/lib64/libandroid_runtime.so (_ZN7android14AndroidRuntime15javaThreadShellEPv+116) #11 pc 00000000000684f0 /system/lib64/libc.so (_ZL15__pthread_startPv+196) #12 pc 000000000001de40 /system/lib64/libc.so (__start_thread+16)

dump對應行號：

[email protected]:~/mi/D2-NEW$ vi frameworks/native/services/inputflinger/EventHub.cpp +477 [email protected]:~/mi/D2-NEW$ aarch64-linux-android-addr2line -f -e out/target/product/midolite/symbols/system/lib64/libinput.so 1fff0 _ZNK7android12KeyLayoutMap6mapKeyEiiPiPj /proc/self/cwd/frameworks/native/libs/input/KeyLayoutMap.cpp:107

檢視對應的提交：

[email protected]:~/mi/D2-NEW/frameworks/native$ git blame -L 100,110 libs/input/KeyLayoutMap.cpp 6d0d04c2 (chenyanting 2016-10-17 12:22:30 +0800 100) #endif 6d0d04c2 (chenyanting 2016-10-17 12:22:30 +0800 101) *outKeyCode = AKEYCODE_UNKNOWN; 6d0d04c2 (chenyanting 2016-10-17 12:22:30 +0800 102) *outFlags = 0; 6d0d04c2 (chenyanting 2016-10-17 12:22:30 +0800 103) return NAME_NOT_FOUND; 6d0d04c2 (chenyanting 2016-10-17 12:22:30 +0800 104) } ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 105) #if 1 ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 106) fd = fopen("/sys/class/switch/h2w/state", "r"); ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 107) fscanf(fd, "%d", &switch_state); ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 108) fclose(fd); ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 109) ALOGD("swtich state=%d \n", switch_state); ca3de184 (Clare Guo 2016-11-15 17:08:29 +0800 110) #endif

修復方法：

107 if(fd != NULL) {
108 fscanf(fd, "%d", &switch_state );
109 fclose(fd );
110 ALOGD("swtich state=%d \n", switch_state);
111 }

沒有/sys/class/switch/h2w/state節點．open失敗了．導致fscanf crash