一次Launcher崩溃如何让整个车机瘫痪：从BLASTSyncEngine冲突到system_server级联锁阻塞的深度复盘

时间轴                    事件
─────────────────────────────────────────────────────────────
20:06:29.084             [导火索] Launcher崩溃
                         IllegalStateException: Can't sync on 2 engines simultaneously
                         崩溃位置: 内嵌天气组件 → WindowOrganizer.applySyncTransaction()
                              │
                              │ ~4秒 (进程垂死挣扎)
                              ▼
20:06:33.330             [第一块骨牌] Launcher进程死亡
                         同时触发两路binderDied回调:
                         ├── Thread 141: TaskOrganizerController$DeathRecipient.binderDied()
                         └── Thread 144: ActivityManagerService$AppDeathRecipient.binderDied()
                              │
                              │ Thread 141: 获取WM锁 → 清理Task → 触发截图
                              ▼
20:06:33~34              [阻塞核心] Thread 141 持WM锁，调用SurfaceControl.captureLayers()
                         → CountDownLatch.await() 等待SurfaceFlinger返回
                         → 但SurfaceFlinger CPU占用51%，根本忙不过来
                              │
                              │ Thread 144: 持AMS锁，等WM锁 → 被141阻塞
                              │ 25+线程: 等WM锁或AMS锁 → 全部排队
                              ▼
20:06:32.849             [ANR #1触发] SystemUI主线程卡在HardwareRenderer.syncAndDrawFrame
                         (渲染管线也被SurfaceFlinger过载拖垮)
                              │
20:06:54.117             [ANR #1报告] MainBottomCarSystemBar无响应 (5001ms)
20:06:54.125             SystemUI被kill → 屏幕黑屏
                              │
20:06:55.779             [ANR #2] system_server主线程被锁链阻塞
                         MainTopCarSystemBar无响应 (5829ms)
─────────────────────────────────────────────────────────────

// BLASTSyncEngine.java (Android 12 AOSP)
void addToSync(WindowContainer wc) {
    if (wc.mSyncGroup != null && wc.mSyncGroup != this) {
        // 这个WindowContainer已经在另一个SyncGroup中了！
        throw new IllegalStateException(
            "Can't sync on 2 engines simultaneously");
    }
    wc.mSyncGroup = this;
    // ...
}

java.lang.IllegalStateException: Can't sync on 2 engines simultaneously
    at android.window.IWindowOrganizerController$Stub$Proxy.applySyncTransaction(...)
    at android.window.WindowOrganizer.applySyncTransaction(WindowOrganizer.java:77)
    at <Launcher内嵌天气组件>.run(...)
 
Caused by: android.os.RemoteException: Remote stack trace:
    at com.android.server.wm.WindowContainer.setSyncGroup(WindowContainer.java:3569)
    at com.android.server.wm.BLASTSyncEngine$SyncGroup.addToSync(BLASTSyncEngine.java:141)

"Binder:2048_8" tid=141 TimedWaiting
  at java.util.concurrent.CountDownLatch.await(CountDownLatch.java:278)
  at android.view.SurfaceControl$SyncScreenCaptureListener.waitForScreenshot(...)
  at android.view.SurfaceControl.captureLayers(SurfaceControl.java:2569)
  at com.android.server.wm.TaskSnapshotController.createTaskSnapshot(...)
  at com.android.server.wm.TaskSnapshotController.snapshotTasks(...)
  at com.android.server.wm.TaskFragment.startPausing(...)
  at com.android.server.wm.ActivityRecord.finishIfPossible(...)
  at com.android.server.wm.Task.performClearTask(Task.java:1664)
  at com.android.server.wm.ActivityTaskManagerService.removeTask(...)
  - locked <0x09ea2fee> (WindowManagerGlobalLock)          ← 持有WM锁！
  at com.android.server.wm.TaskOrganizerController$TaskOrganizerState.dispose(...)
  at com.android.server.wm.TaskOrganizerController$DeathRecipient.binderDied(...)
  - locked <0x09ea2fee> (WindowManagerGlobalLock)          ← 获取WM锁

CPU使用情况 (8核设备):
─────────────────────────────────────
导航应用:       75%  (54%U + 20%K)    ← NOA正在退出
SurfaceFlinger:  51%  (24%U + 27%K)    ← 忙到冒烟
3D车模渲染:      44%  (32%U + 12%K)    ← 3D模型还在渲染
语音助手:       42%  (33%U + 8.8%K)   ← 一直在跑
system_server:   37%  (21%U + 16%K)    ← 自己也很忙
 
系统负载: 56.64 / 25.76 / 14.55
（8核设备，1分钟负载56.64——正常应该<8.0）

                    SurfaceFlinger (CPU 51%, 忙碌中...)
                            ▲
                            │ CountDownLatch.await()
                            │ (等截图返回)
                            │
┌─────────────────────────────────────────────────────────────────┐
│  Thread 141 (Binder:2048_8)                                     │
│  持有: WindowManagerGlobalLock (WM锁)                            │
│  状态: TimedWaiting                                              │
│  在做: TaskOrganizerController$DeathRecipient.binderDied()       │
│        → removeTask() → snapshotTasks() → captureLayers()       │
└───────────┬────────────────────┬──────────────┬─────────────────┘
            │                    │              │
            ▼                    ▼              ▼
   ┌────────────────┐  ┌──────────────┐  ┌──────────────────┐
   │ Thread 144     │  │ Thread 10    │  │ Thread 13        │
   │ Binder:2048_B  │  │ Binder:2048_2│  │ android.ui       │
   │                │  │              │  │                  │
   │ 持有: AMS锁    │  │ 持有: A11y锁 │  │ 等WM锁           │
   │ 等: WM锁       │  │ 等: WM锁     │  │                  │
   └───────┬────────┘  └──────┬───────┘  └──────────────────┘
           │                  │
           ▼                  ▼
  ┌────────────────┐  ┌──────────────────────┐
  │ Thread 12      │  │ Thread 1 (main)      │
  │ android.fg     │  │                      │
  │ Thread 15      │  │ 等: A11y锁           │
  │ android.display│  │ ← ANR!               │
  │                │  └──────────────────────┘
  │ 等: AMS锁      │
  └────────────────┘
 
  以及: Thread 142, 145, 146 (等WM锁)
        Thread 9, 143 (等A11y锁)
        android.anim (等WM锁)
        ... 共25+线程被阻塞

Thread 141: 持有WM锁 → 等SurfaceFlinger (不是在等某个锁)
Thread 144: 持有AMS锁 → 等WM锁 (单向等待)
Main thread: 等A11y锁 → ... (单向等待)

Subject: Input dispatching timed out
  MainBottomCarSystemBar (server) is not responding. Waited 5001ms for MotionEvent

"main" prio=5 tid=1 Native
  at android.graphics.HardwareRenderer.nSyncAndDrawFrame(Native method)
  at android.graphics.HardwareRenderer.syncAndDrawFrame(HardwareRenderer.java:457)
  at android.view.ThreadedRenderer.draw(ThreadedRenderer.java:634)
  at android.view.ViewRootImpl.draw(ViewRootImpl.java:4646)
  at android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:3439)

Subject: Input dispatching timed out
  MainTopCarSystemBar (server) is not responding. Waited 5829ms for MotionEvent

Subject: Input dispatching timed out (... MainTopCarSystemBar ... Waited 5829ms ...)
 
"main" prio=5 tid=1 Blocked
  - waiting to lock <0x031741dd> (a java.lang.Object) held by thread 10

"Binder:2048_2" tid=10 Blocked
  - waiting to lock <0x09ea2fee> (WindowManagerGlobalLock) held by thread 141
  - locked <0x031741dd>  ← 这就是主线程在等的锁

"Binder:2048_8" tid=141 TimedWaiting
  at java.util.concurrent.CountDownLatch.await(...)
  at android.view.SurfaceControl.captureLayers(...)
  ...
  - locked <0x09ea2fee> (WindowManagerGlobalLock)  ← 持有WM锁

binderDied() → dispose() → removeTask() → ... → snapshotTasks() → captureLayers() → await()

┌──────────────────────────────────────────────────────────┐
│                    系统环境 (放大器)                        │
│  NOA导航(75%CPU) + 3D车模(44%) + 语音(42%)                │
│  → SurfaceFlinger过载(51%) → 系统负载56.64 (8核)          │
└────────────────────────┬─────────────────────────────────┘
                         │ 使得截图操作超时
                         ▼
┌─────────────┐    ┌───────────────┐    ┌──────────────────┐
│ BLASTSync   │    │ 持锁做同步     │    │ 级联锁阻塞       │
│ 竞态冲突     │───→│ 截图 (设计缺陷)│───→│ 25+线程被堵      │
│ (触发源)     │    │               │    │ (灾难性后果)     │
└─────────────┘    └───────────────┘    └──────────────────┘
  Launcher崩溃       Thread 141持        SystemUI ANR → kill
  进程死亡           WM锁等SF            system_server ANR
                                        前排屏黑屏

// 方案：防御性编程，避免未捕获异常导致进程崩溃
try {
    windowOrganizer.applySyncTransaction(transaction, callback);
} catch (IllegalStateException e) {
    Log.w(TAG, "SyncTransaction conflict, scheduling retry", e);
    handler.postDelayed(() -> retrySyncTransaction(transaction, callback), 100);
}

// TaskSnapshotController.java - 在进程死亡清理路径中跳过截图
public void snapshotTasks(ArraySet<Task> tasks) {
    for (Task task : tasks) {
        // 进程已死，截图毫无意义
        if (isTaskProcessDead(task)) {
            Slog.i(TAG, "Skipping snapshot for dead process task: " + task);
            continue;
        }
        snapshotTask(task);
    }
}

// SurfaceControl.java - 为截图增加超时
public ScreenshotHardwareBuffer waitForScreenshot() {
    boolean completed = mLatch.await(3, TimeUnit.SECONDS);
    if (!completed) {
        Slog.e(TAG, "Screenshot capture timeout, SF may be overloaded");
        return null;
    }
    return mResultBuffer;
}