2020-05-15

重置應(yīng)用偏好，AMS和PMS deadlock,導(dǎo)致手機(jī)重啟

在Android Q中乏梁，今天遇到個(gè)死機(jī)重啟問題。在Setting中reset app preference會(huì)卡死蹋辅，過段時(shí)間胸私，手機(jī)重啟。抓了下log看看瘦陈，發(fā)現(xiàn)是PMS和AMS deadlock凝危，導(dǎo)致手機(jī)重啟。

從下面的log可以看出晨逝，android.fg蛾默、main、ActivityManager 阻塞了捉貌。

05-09 10:13:03.736  1146  1170 W Watchdog: *** WATCHDOG KILLING SYSTEM PROCESS: Blocked in handler on foreground thread (android.fg), Blocked in handler on main thread (main), Blocked in handler on ActivityManager (ActivityManager)
05-09 10:13:03.742  1146  1170 W Watchdog: android.fg annotated stack trace:
05-09 10:13:03.743  1146  1170 W Watchdog:     at com.android.server.am.ActivityManagerService.broadcastIntent(ActivityManagerService.java:15799)
05-09 10:13:03.744  1146  1170 W Watchdog:     - waiting to lock <0x0235fe7d> (a com.android.server.am.ActivityManagerService)
05-09 10:13:03.745  1146  1170 W Watchdog:     at android.app.ContextImpl.sendBroadcastAsUser(ContextImpl.java:1264)
05-09 10:13:03.746  1146  1170 W Watchdog:     at android.app.ContextImpl.sendBroadcastAsUser(ContextImpl.java:1236)
05-09 10:13:03.747  1146  1170 W Watchdog:     at com.android.server.usb.UsbPortManager.lambda$sendPortChangedBroadcastLocked$0$UsbPortManager(UsbPortManager.java:1016)
05-09 10:13:03.748  1146  1170 W Watchdog:     at com.android.server.usb.-$$Lambda$UsbPortManager$FUqGOOupcl6RrRkZBk-BnrRQyPI.run(Unknown Source:4)
05-09 10:13:03.749  1146  1170 W Watchdog:     at android.os.Handler.handleCallback(Handler.java:883)
05-09 10:13:03.749  1146  1170 W Watchdog:     at android.os.Handler.dispatchMessage(Handler.java:100)
05-09 10:13:03.750  1146  1170 W Watchdog:     at android.os.Looper.loop(Looper.java:214)
05-09 10:13:03.750  1146  1170 W Watchdog:     at android.os.HandlerThread.run(HandlerThread.java:67)
05-09 10:13:03.751  1146  1170 W Watchdog:     at com.android.server.ServiceThread.run(ServiceThread.java:44)
05-09 10:13:03.754  1146  1170 W Watchdog: main annotated stack trace:
05-09 10:13:03.755  1146  1170 W Watchdog:     at com.android.server.am.ActivityManagerService.broadcastIntent(ActivityManagerService.java:15799)
05-09 10:13:03.756  1146  1170 W Watchdog:     - waiting to lock <0x0235fe7d> (a com.android.server.am.ActivityManagerService)
05-09 10:13:03.756  1146  1170 W Watchdog:     at android.app.ContextImpl.sendBroadcastAsUser(ContextImpl.java:1225)
05-09 10:13:03.757  1146  1170 W Watchdog:     at com.android.server.BatteryService$7.run(BatteryService.java:617)
05-09 10:13:03.757  1146  1170 W Watchdog:     at android.os.Handler.handleCallback(Handler.java:883)
05-09 10:13:03.758  1146  1170 W Watchdog:     at android.os.Handler.dispatchMessage(Handler.java:100)
05-09 10:13:03.758  1146  1170 W Watchdog:     at android.os.Looper.loop(Looper.java:214)
05-09 10:13:03.759  1146  1170 W Watchdog:     at com.android.server.SystemServer.run(SystemServer.java:570)
05-09 10:13:03.759  1146  1170 W Watchdog:     at com.android.server.SystemServer.main(SystemServer.java:364)
05-09 10:13:03.760  1146  1170 W Watchdog:     at java.lang.reflect.Method.invoke(Native Method)
05-09 10:13:03.761  1146  1170 W Watchdog:     at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
05-09 10:13:03.761  1146  1170 W Watchdog:     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:958)
05-09 10:13:03.763  1146  1170 W Watchdog: ActivityManager annotated stack trace:
05-09 10:13:03.764  1146  1170 W Watchdog:     at com.android.server.am.BroadcastQueue.processNextBroadcast(BroadcastQueue.java:948)
05-09 10:13:03.765  1146  1170 W Watchdog:     - waiting to lock <0x0235fe7d> (a com.android.server.am.ActivityManagerService)
05-09 10:13:03.766  1146  1170 W Watchdog:     at com.android.server.am.BroadcastQueue$BroadcastHandler.handleMessage(BroadcastQueue.java:186)
05-09 10:13:03.766  1146  1170 W Watchdog:     at android.os.Handler.dispatchMessage(Handler.java:107)
05-09 10:13:03.766  1146  1170 W Watchdog:     at android.os.Looper.loop(Looper.java:214)
05-09 10:13:03.767  1146  1170 W Watchdog:     at android.os.HandlerThread.run(HandlerThread.java:67)
05-09 10:13:03.767  1146  1170 W Watchdog:     at com.android.server.ServiceThread.run(ServiceThread.java:44)
05-09 10:13:03.768  1146  1170 W Watchdog: *** GOODBYE!
05-09 10:13:03.769  1146  1170 I Process : Sending signal. PID: 1146 SIG: 9

之后取出dropbox支鸡，看了下log，大致信息如下趁窃。

Process: system_server
Subject: Blocked in monitor com.android.server.am.ActivityManagerService on foreground thread (android.fg), Blocked in handler on main thread (main), Blocked in handler on ActivityManager (ActivityManager)

接下來搜索android.fg,log信息如下牧挣，線程狀態(tài)是Blocked狀態(tài)。根據(jù) - waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34這句log可以知道thread 34目前持有ActivityManagerService.this這個(gè)對(duì)象的鎖醒陆。

"android.fg" prio=5 tid=11 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x13343b80 self=0x6f792fe800
  | sysTid=1169 nice=0 cgrp=default sched=0/0 handle=0x6f26b09d50
  | state=S schedstat=( 19549844370 13678424454 84937 ) utm=1554 stm=400 core=4 HZ=100
  | stack=0x6f26a07000-0x6f26a09000 stackSize=1039KB
  | held mutexes=
  at com.android.server.am.ActivityManagerService.monitor(ActivityManagerService.java:17816)
  - waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34
  at com.android.server.Watchdog$HandlerChecker.run(Watchdog.java:260)
  at android.os.Handler.handleCallback(Handler.java:883)
  at android.os.Handler.dispatchMessage(Handler.java:100)
  at android.os.Looper.loop(Looper.java:214)
  at android.os.HandlerThread.run(HandlerThread.java:67)
  at com.android.server.ServiceThread.run(ServiceThread.java:44)

接下來先看下另外兩個(gè)線程main和ActivityManager浸踩。接下來搜索main，可以看到log信息如下统求，可以看到線程狀態(tài)也是Blocked狀態(tài)，根據(jù) waiting to lock <0x0dfda30d> (a android.util.ArrayMap) held by thread 10
at com.android.server.pm.PackageManagerService.resolveContentProviderInternal(PackageManagerService.java:9045)這個(gè)線程在ackageManagerService.java中進(jìn)入mPackages為鎖的同步代碼塊時(shí)進(jìn)入了阻塞狀態(tài)据块。

PackageManagerService.java中代碼

    private ProviderInfo resolveContentProviderInternal(String name, int flags, int userId) {
        if (!sUserManager.exists(userId)) return null;
        flags = updateFlagsForComponent(flags, userId, name);
        final int callingUid = Binder.getCallingUid();
        final ProviderInfo providerInfo = mComponentResolver.queryProvider(name, flags, userId);
        if (providerInfo == null) {
            return null;
        }
        if (!mSettings.isEnabledAndMatchLPr(providerInfo, flags, userId)) {
            return null;
        }
        synchronized (mPackages) {
            final PackageSetting ps = mSettings.mPackages.get(providerInfo.packageName);
            final ComponentName component =
                    new ComponentName(providerInfo.packageName, providerInfo.name);
            if (filterAppAccessLPr(ps, callingUid, component, TYPE_PROVIDER, userId)) {
                return null;
            }
            return providerInfo;
        }
    }

Log信息

"main" prio=5 tid=1 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x72831908 self=0x700f5c5c00
  | sysTid=1152 nice=-2 cgrp=default sched=0/0 handle=0x7010b31ed0
  | state=S schedstat=( 18586425702 3677321603 20776 ) utm=1405 stm=452 core=2 HZ=100
  | stack=0x7fe8ddc000-0x7fe8dde000 stackSize=8192KB
  | held mutexes=
  at com.android.server.pm.ComponentResolver.queryProvider(ComponentResolver.java:289)
  - waiting to lock <0x0dfda30d> (a android.util.ArrayMap) held by thread 10
  at com.android.server.pm.PackageManagerService.resolveContentProviderInternal(PackageManagerService.java:9045)
  at com.android.server.pm.PackageManagerService.resolveContentProvider(PackageManagerService.java:9038)
  at com.android.server.am.ActivityManagerService.checkContentProviderAccess(ActivityManagerService.java:6598)
  at com.android.server.am.ActivityManagerService$LocalService.checkContentProviderAccess(ActivityManagerService.java:18035)
  at com.android.server.content.ContentService.notifyChange(ContentService.java:408)
  at android.content.ContentResolver.notifyChange(ContentResolver.java:2387)
  at com.android.providers.settings.SettingsProvider$SettingsRegistry$MyHandler.handleMessage(SettingsProvider.java:3244)
  at android.os.Handler.dispatchMessage(Handler.java:107)
  at android.os.Looper.loop(Looper.java:214)
  at com.android.server.SystemServer.run(SystemServer.java:570)
  at com.android.server.SystemServer.main(SystemServer.java:364)
  at java.lang.reflect.Method.invoke(Native method)
  at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:958)

接下來搜索"ActivityManager"码邻，可以搜索到下面log×砑伲可以看到線程狀態(tài)是Blocked狀態(tài)像屋，根據(jù)這行l(wèi)og waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34。我們知道ActivityManager也阻塞在thread 34.

"ActivityManager" prio=5 tid=20 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x133475e0 self=0x6f201f3c00
  | sysTid=1179 nice=-2 cgrp=default sched=0/0 handle=0x6f1cc7dd50
  | state=S schedstat=( 3150670929 981176628 9232 ) utm=222 stm=92 core=1 HZ=100
  | stack=0x6f1cb7b000-0x6f1cb7d000 stackSize=1039KB
  | held mutexes=
  at com.android.server.am.BroadcastQueue.processNextBroadcast(BroadcastQueue.java:948)
  - waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34
  at com.android.server.am.BroadcastQueue$BroadcastHandler.handleMessage(BroadcastQueue.java:186)
  at android.os.Handler.dispatchMessage(Handler.java:107)
  at android.os.Looper.loop(Looper.java:214)
  at android.os.HandlerThread.run(HandlerThread.java:67)
  at com.android.server.ServiceThread.run(ServiceThread.java:44)

接下來我們搜索一下thread 34的log边篮〖狠海可以看到thread 34也是Blocked狀態(tài)奏甫。根據(jù)waiting to lock <0x0dfda30d> (a android.util.ArrayMap) held by thread 10這行l(wèi)og，我們知道thread 34被thread 10阻塞了凌受。

"PackageManager" prio=5 tid=34 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x1334b238 self=0x6f201d8000
  | sysTid=1197 nice=-2 cgrp=default sched=0/0 handle=0x6f0dca1d50
  | state=S schedstat=( 472019375 664779689 999 ) utm=28 stm=18 core=6 HZ=100
  | stack=0x6f0db9f000-0x6f0dba1000 stackSize=1039KB
  | held mutexes=
  at com.android.server.pm.PackageManagerService.getInstantAppPackageName(PackageManagerService.java:7256)
  - waiting to lock <0x0dfda30d> (a android.util.ArrayMap) held by thread 10
  at com.android.server.pm.PackageManagerService.queryIntentReceiversInternal(PackageManagerService.java:8319)
  at com.android.server.pm.PackageManagerService.queryIntentReceivers(PackageManagerService.java:8308)
  at com.android.server.am.ActivityManagerService.collectReceiverComponents(ActivityManagerService.java:14883)
  at com.android.server.am.ActivityManagerService.broadcastIntentLocked(ActivityManagerService.java:15535)
  at com.android.server.am.ActivityManagerService.broadcastIntentLocked(ActivityManagerService.java:15042)
  at com.android.server.am.ActivityManagerService.broadcastIntent(ActivityManagerService.java:15825)
  - locked <0x0cdd7d88> (a com.android.server.am.ActivityManagerService)
  at com.android.server.pm.PackageManagerService.lambda$postPreferredActivityChangedBroadcast$24(PackageManagerService.java:20440)
  at com.android.server.pm.-$$Lambda$PackageManagerService$Yfnee_CTmno9dIMhv8Cxk-LIk7w.run(lambda:-1)
  at android.os.Handler.handleCallback(Handler.java:883)
  at android.os.Handler.dispatchMessage(Handler.java:100)
  at android.os.Looper.loop(Looper.java:214)
  at android.os.HandlerThread.run(HandlerThread.java:67)
  at com.android.server.ServiceThread.run(ServiceThread.java:44)

接下來我們總結(jié)一下阵子，“android.fg” thread 11被thread34 阻塞，thread 34被thread 10阻塞胜蛉∧咏”main“ thread 1被thread 10阻塞。"ActivityManager" thread 20 被thread 34阻塞誊册，而thread 34又被thread 10阻塞领突。從中我們可以看到最終都是被thread 10阻塞。接下來我們看下thread 10的log案怯。從這句log waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34可以看出thread 10被thread 34阻塞君旦，而thread 34又被thread 10阻塞。這很明顯是deadlock問題嘲碱，PMS和AMS 死鎖了金砍。從thread 10的log中，我們可以知道這個(gè)線程是執(zhí)行reset app preference方法的線程悍汛。所以我們從這里開始分析捞魁。com.android.server.pm.PackageManagerService.resetApplicationPreferences(PackageManagerService.java:20672)


"Binder:1152_2" prio=5 tid=10 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x133439f8 self=0x6f7de2e000
  | sysTid=1166 nice=0 cgrp=default sched=0/0 handle=0x6f28b57d50
  | state=S schedstat=( 7163637231 3095463661 25055 ) utm=517 stm=198 core=0 HZ=100
  | stack=0x6f28a61000-0x6f28a63000 stackSize=991KB
  | held mutexes=
  at com.android.server.am.ActivityManagerService.getContentProviderImpl(ActivityManagerService.java:6841)
  - waiting to lock <0x0cdd7d88> (a com.android.server.am.ActivityManagerService) held by thread 34
  at com.android.server.am.ActivityManagerService.getContentProviderExternalUnchecked(ActivityManagerService.java:7392)
  at com.android.server.am.ActivityManagerService.getProviderMimeType(ActivityManagerService.java:7812)
  at android.content.ContentResolver.getType(ContentResolver.java:746)
  at android.content.Intent.resolveType(Intent.java:7592)
  at android.content.Intent.resolveTypeIfNeeded(Intent.java:7614)
  at com.android.server.pm.PackageManagerService$PackageManagerInternalImpl.queryIntentActivities(PackageManagerService.java:24778)
  at com.android.server.pm.Settings.applyDefaultPreferredActivityLPw(Settings.java:3349)
  at com.android.server.pm.Settings.applyDefaultPreferredActivityLPw(Settings.java:3310)
  at com.android.server.pm.Settings.readDefaultPreferredActivitiesLPw(Settings.java:3466)
  at com.android.server.pm.Settings.applyDefaultPreferredAppsLPw(Settings.java:3212)
  at com.android.server.pm.PackageManagerService.resetApplicationPreferences(PackageManagerService.java:20672)
  - locked <0x0dfda30d> (a android.util.ArrayMap)
  at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:3059)
  at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:4084)
  at android.os.Binder.execTransactInternal(Binder.java:1021)
  at android.os.Binder.execTransact(Binder.java:994)

打開PackageManagerService.java的代碼看下，沒什么有用的信息离咐，接下來我們看下Settings.java文件谱俭。從這個(gè)方法中下面黑體代碼可以知道，這個(gè)是"etc/preferred-apps"目錄下有文件的話才會(huì)執(zhí)行到下面的死鎖代碼
File preferredDir = new File(Environment.getRootDirectory(), "etc/preferred-apps");

而"etc/preferred-apps"下面主要是Google GMS應(yīng)用內(nèi)置的配置文件宵蛀。也就是說這個(gè)目錄下面沒有文件的話昆著，那就不會(huì)死鎖。換個(gè)說法就是這個(gè)死鎖是Google搞出來的术陶。

 void applyDefaultPreferredAppsLPw(int userId) {
        // First pull data from any pre-installed apps.
        final PackageManagerInternal pmInternal =
                LocalServices.getService(PackageManagerInternal.class);
        for (PackageSetting ps : mPackages.values()) {
            if ((ps.pkgFlags&ApplicationInfo.FLAG_SYSTEM) != 0 && ps.pkg != null
                    && ps.pkg.preferredActivityFilters != null) {
                ArrayList<PackageParser.ActivityIntentInfo> intents
                        = ps.pkg.preferredActivityFilters;
                for (int i=0; i<intents.size(); i++) {
                    PackageParser.ActivityIntentInfo aii = intents.get(i);
                    applyDefaultPreferredActivityLPw(pmInternal, aii, new ComponentName(
                                    ps.name, aii.activity.className), userId);
                }
            }
        }

        // Read preferred apps from .../etc/preferred-apps directory.
        File preferredDir = new File(Environment.getRootDirectory(), "etc/preferred-apps");
        if (!preferredDir.exists() || !preferredDir.isDirectory()) {
            return;
        }
        if (!preferredDir.canRead()) {
            Slog.w(TAG, "Directory " + preferredDir + " cannot be read");
            return;
        }

        // Iterate over the files in the directory and scan .xml files
        for (File f : preferredDir.listFiles()) {
            if (!f.getPath().endsWith(".xml")) {
                Slog.i(TAG, "Non-xml file " + f + " in " + preferredDir + " directory, ignoring");
                continue;
            }
            if (!f.canRead()) {
                Slog.w(TAG, "Preferred apps file " + f + " cannot be read");
                continue;
            }

            if (PackageManagerService.DEBUG_PREFERRED) Log.d(TAG, "Reading default preferred " + f);
            InputStream str = null;
            try {
                str = new BufferedInputStream(new FileInputStream(f));
                XmlPullParser parser = Xml.newPullParser();
                parser.setInput(str, null);

                int type;
                while ((type = parser.next()) != XmlPullParser.START_TAG
                        && type != XmlPullParser.END_DOCUMENT) {
                    ;
                }

                if (type != XmlPullParser.START_TAG) {
                    Slog.w(TAG, "Preferred apps file " + f + " does not have start tag");
                    continue;
                }
                if (!"preferred-activities".equals(parser.getName())) {
                    Slog.w(TAG, "Preferred apps file " + f
                            + " does not start with 'preferred-activities'");
                    continue;
                }
                readDefaultPreferredActivitiesLPw(parser, userId);
            } catch (XmlPullParserException e) {
                Slog.w(TAG, "Error reading apps file " + f, e);
            } catch (IOException e) {
                Slog.w(TAG, "Error reading apps file " + f, e);
            } finally {
                if (str != null) {
                    try {
                        str.close();
                    } catch (IOException e) {
                    }
                }
            }
        }
    }

接下來我們進(jìn)入這里看一下代碼

at com.android.server.pm.PackageManagerService$PackageManagerInternalImpl.queryIntentActivities(PackageManagerService.java:24778)

從上面的堆棧信息我們可以知道死鎖發(fā)生在下面這個(gè)方法的intent.resolveTypeIfNeeded(mContext.getContentResolver())方法內(nèi)凑懂，這個(gè)方法通過調(diào)用activity manager service來獲取到它的type。在獲取com.android.server.am.ActivityManagerService.this時(shí)阻塞了梧宫，發(fā)生了死鎖接谨。

       public List<ResolveInfo> queryIntentActivities(
                Intent intent, int flags, int filterCallingUid, int userId) {
            final String resolvedType = intent.resolveTypeIfNeeded(mContext.getContentResolver());
            return PackageManagerService.this
                    .queryIntentActivitiesInternal(intent, resolvedType, flags, filterCallingUid,
                            userId, false /*resolveForStart*/, true /*allowDynamicSplits*/);
        }

在這里我們可以避免調(diào)用ActiviytManagerService來查詢type，可以通過intent.getType()來直接獲取type塘匣，來避免這個(gè)死鎖的發(fā)生脓豪。當(dāng)然如果重要的話，需用通過preferred-activity 聲明來定義 mime 類型忌卤。從Settings.java的3310行代碼可知扫夜，這段代碼沒有設(shè)置intent type，現(xiàn)在intent的type為null。

            if (doScheme) {
                Uri.Builder builder = new Uri.Builder();
                builder.scheme(scheme);
                Intent finalIntent = new Intent(intent);
                finalIntent.setData(builder.build());
                applyDefaultPreferredActivityLPw(pmInternal, finalIntent, flags, cn,
                        scheme, null, null, null, userId);
            }

所以最后的修改方法就是避免調(diào)用intent.resolveTypeIfNeeded()方法笤闯，重定義一個(gè)queryIntentActivities（）方法堕阔，通過intent.getType()來獲取mime type。patch如下颗味。

From 3fa88533316995c52d29a14df600e477f83c04d9 Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Mon, 18 Nov 2019 13:43:11 -0800
Subject: [PATCH] DO NOT MERGE Avoids deadlock when applying preferred activities

Prior to this change, we were resolving the mime type of a given intent
while holding the package lock. With this change, we instead rely on the
preferred-activity declaration to define the mime type if it's
important, removing need for an activity manager service call and the
potential for deadlock.

Fixes: 143105100
Test: Manual; sideload to /system/etc/preferred-apps/ and reset app preferences
Change-Id: Ia87b7ecbd7987ef654fb0fc2bda942cd6a9c00a7
---

diff --git a/core/java/android/content/pm/PackageManagerInternal.java b/core/java/android/content/pm/PackageManagerInternal.java
index 28d9152..30a3bd4 100644
--- a/core/java/android/content/pm/PackageManagerInternal.java
+++ b/core/java/android/content/pm/PackageManagerInternal.java
@@ -415,6 +415,17 @@
             @ResolveInfoFlags int flags, int filterCallingUid, int userId);
 
     /**
+     * Retrieve all activities that can be performed for the given intent.
+     * @param filterCallingUid The results will be filtered in the context of this UID instead
+     * of the calling UID.
+     * @see PackageManager#queryIntentActivities(Intent, int)
+     */
+    public abstract List<ResolveInfo> queryIntentActivities(
+            Intent intent, @Nullable String resolvedType, @ResolveInfoFlags int flags,
+            int filterCallingUid, int userId);
+
+
+    /**
      * Retrieve all services that can be performed for the given intent.
      * @see PackageManager#queryIntentServices(Intent, int)
      */
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index d7d7345..54051ba 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -24520,6 +24520,12 @@
         public List<ResolveInfo> queryIntentActivities(
                 Intent intent, int flags, int filterCallingUid, int userId) {
             final String resolvedType = intent.resolveTypeIfNeeded(mContext.getContentResolver());
+            return queryIntentActivities(intent, resolvedType, flags, filterCallingUid, userId);
+        }
+
+        @Override
+        public List<ResolveInfo> queryIntentActivities(
+                Intent intent, String resolvedType, int flags, int filterCallingUid, int userId) {
             return PackageManagerService.this
                     .queryIntentActivitiesInternal(intent, resolvedType, flags, filterCallingUid,
                             userId, false /*resolveForStart*/, true /*allowDynamicSplits*/);
diff --git a/services/core/java/com/android/server/pm/Settings.java b/services/core/java/com/android/server/pm/Settings.java
index 3bc2236..4ecfbfe 100644
--- a/services/core/java/com/android/server/pm/Settings.java
+++ b/services/core/java/com/android/server/pm/Settings.java
@@ -3337,7 +3337,8 @@
             int flags, ComponentName cn, String scheme, PatternMatcher ssp,
             IntentFilter.AuthorityEntry auth, PatternMatcher path, int userId) {
         final List<ResolveInfo> ri =
-                pmInternal.queryIntentActivities(intent, flags, Binder.getCallingUid(), 0);
+                pmInternal.queryIntentActivities(
+                        intent, intent.getType(), flags, Binder.getCallingUid(), 0);
         if (PackageManagerService.DEBUG_PREFERRED) {
             Log.d(TAG, "Queried " + intent + " results: " + ri);
         }
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
  • 人面猴
    序言：七十年代末超陆，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子脱衙，更是在濱河造成了極大的恐慌侥猬，老刑警劉巖，帶你破解...
    沈念sama閱讀 223,002評(píng)論 6贊 519
  • 死咒
    序言：濱河連續(xù)發(fā)生了三起死亡事件捐韩，死亡現(xiàn)場(chǎng)離奇詭異退唠，居然都是意外死亡，警方通過查閱死者的電腦和手機(jī)荤胁，發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 95,357評(píng)論 3贊 400
  • 救了他兩次的神仙讓他今天三更去死
    文/潘曉璐 我一進(jìn)店門瞧预，熙熙樓的掌柜王于貴愁眉苦臉地迎上來，“玉大人仅政，你說我怎么就攤上這事垢油。” “怎么了圆丹？”我有些...
    開封第一講書人閱讀 169,787評(píng)論 0贊 365
  • 道士緝兇錄：失蹤的賣姜人
    文/不壞的土叔 我叫張陵滩愁，是天一觀的道長(zhǎng)。 經(jīng)常有香客問我辫封，道長(zhǎng)硝枉，這世上最難降的妖魔是什么？ 我笑而不...
    開封第一講書人閱讀 60,237評(píng)論 1贊 300
  • ?港島之戀（遺憾婚禮）
    正文 為了忘掉前任倦微，我火速辦了婚禮妻味，結(jié)果婚禮上，老公的妹妹穿的比我還像新娘欣福。我一直安慰自己责球，他們只是感情好，可當(dāng)我...
    茶點(diǎn)故事閱讀 69,237評(píng)論 6贊 398
  • 惡毒庶女頂嫁案：這布局不是一般人想出來的
    文/花漫 我一把揭開白布拓劝。 她就那樣靜靜地躺著雏逾，像睡著了一般。 火紅的嫁衣襯著肌膚如雪郑临。 梳的紋絲不亂的頭發(fā)上校套，一...
    開封第一講書人閱讀 52,821評(píng)論 1贊 314
  • 城市分裂傳說
    那天，我揣著相機(jī)與錄音牧抵，去河邊找鬼。 笑死，一個(gè)胖子當(dāng)著我的面吹牛犀变，可吹牛的內(nèi)容都是我干的妹孙。 我是一名探鬼主播，決...
    沈念sama閱讀 41,236評(píng)論 3贊 424
  • 雙鴛鴦連環(huán)套：你想象不到人心有多黑
    文/蒼蘭香墨 我猛地睜開眼获枝，長(zhǎng)吁一口氣：“原來是場(chǎng)噩夢(mèng)啊……” “哼蠢正！你這毒婦竟也來了？” 一聲冷哼從身側(cè)響起省店，我...
    開封第一講書人閱讀 40,196評(píng)論 0贊 277
  • 萬榮殺人案實(shí)錄
    序言：老撾萬榮一對(duì)情侶失蹤嚣崭，失蹤者是張志新（化名）和其女友劉穎，沒想到半個(gè)月后懦傍，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體雹舀，經(jīng)...
    沈念sama閱讀 46,716評(píng)論 1贊 320
  • ?護(hù)林員之死
    正文 獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點(diǎn)故事閱讀 38,794評(píng)論 3贊 343
  • ?白月光啟示錄
    正文 我和宋清朗相戀三年粗俱，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了说榆。 大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
    茶點(diǎn)故事閱讀 40,928評(píng)論 1贊 353
  • 活死人
    序言：一個(gè)原本活蹦亂跳的男人離奇死亡寸认，死狀恐怖签财，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情偏塞，我是刑警寧澤唱蒸，帶...
    沈念sama閱讀 36,583評(píng)論 5贊 351
  • ?日本核電站爆炸內(nèi)幕
    正文 年R本政府宣布，位于F島的核電站灸叼，受9級(jí)特大地震影響神汹，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜怜姿，卻給世界環(huán)境...
    茶點(diǎn)故事閱讀 42,264評(píng)論 3贊 336
  • 男人毒藥：我在死后第九天來索命
    文/蒙蒙 一慎冤、第九天 我趴在偏房一處隱蔽的房頂上張望。 院中可真熱鬧沧卢，春花似錦蚁堤、人聲如沸。這莊子的主人今日做“春日...
    開封第一講書人閱讀 32,755評(píng)論 0贊 25
  • 一樁弒父案披诗，背后竟有這般陰謀
    文/蒼蘭香墨 我抬頭看了看天上的太陽。三九已至立磁，卻和暖如春呈队，著一層夾襖步出監(jiān)牢的瞬間，已是汗流浹背唱歧。 一陣腳步聲響...
    開封第一講書人閱讀 33,869評(píng)論 1贊 274
  • 情欲美人皮
    我被黑心中介騙來泰國(guó)打工宪摧， 沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留粒竖，地道東北人。 一個(gè)月前我還...
    沈念sama閱讀 49,378評(píng)論 3贊 379
  • 代替公主和親
    正文 我出身青樓几于，卻偏偏與公主長(zhǎng)得像蕊苗，于是被迫代替她去往敵國(guó)和親。 傳聞我的和親對(duì)象是個(gè)殘疾皇子沿彭，可洞房花燭夜當(dāng)晚...
    茶點(diǎn)故事閱讀 45,937評(píng)論 2贊 361