Android Layer 创建与销毁流程分析

基于 Android 15 / 16 AOSP 源码分析

一、系统架构概览

1.1 继承层次结构

RefBase (引用计数基类)
  └── Layer (基础 Layer 类)

1.2 关键文件位置

Native C++ 层:

frameworks/native/services/surfaceflinger/Layer.h / Layer.cpp
frameworks/native/services/surfaceflinger/SurfaceFlinger.h / SurfaceFlinger.cpp
frameworks/native/services/surfaceflinger/FrontEnd/LayerHandle.cpp
frameworks/native/services/surfaceflinger/FrontEnd/LayerLifecycleManager.cpp
frameworks/native/services/surfaceflinger/FrontEnd/RequestedLayerState.cpp

Java Framework 层:

frameworks/base/core/java/android/view/SurfaceControl.java
frameworks/base/core/java/android/view/SurfaceSession.java

JNI 桥接层:

frameworks/base/core/jni/android_view_SurfaceControl.cpp

1.3 Frontend 与 Legacy 架构

Android 15 使用 Frontend 架构来管理 Layer 生命周期，将状态管理与具体的 Layer 对象解耦：

─────────────────────────────────────────────────────────────┐
│                    Frontend Layer                           │
│  ├── LayerLifecycleManager  // 生命周期管理                 │
│  ├── RequestedLayerState    // 请求状态 (决定何时销毁)      │
│  └── LayerSnapshot          // 快照状态                     │
└─────────────────────────────────────────────────────────────┘

1.4 LayerHandle 引用机制

LayerHandle 持有 Layer 的强引用（sp<Layer>），这是防止 Layer 过早销毁的核心：

// LayerHandle.cpp
LayerHandle::LayerHandle(const sp<android::SurfaceFlinger>& flinger,
                         const sp<android::Layer>& layer)  // 强引用
      : mFlinger(flinger), mLayer(layer), ...

只要 Handle 存在，Layer 就不会被销毁。当 Handle 析构时，会通知 SurfaceFlinger：

LayerHandle::~LayerHandle() {
    if (mFlinger) {
        mFlinger->onHandleDestroyed(mLayer, mLayerId);
    }
}

二、Layer 创建流程

2.1 Java Framework 层

SurfaceControl.java - Builder 模式创建

// frameworks/base/core/java/android/view/SurfaceControl.java
public final class SurfaceControl implements Parcelable {

    public static class Builder {
        public SurfaceControl build() {
            return new SurfaceControl(...);
        }
    }

    private SurfaceControl(SurfaceSession session, String name, ...) {
        // 调用 JNI 创建 native SurfaceControl
        mNativeObject = nativeCreate(session, name, w, h, format, flags, 
                                      parentObject, metadata);
    }

    private static native long nativeCreate(SurfaceSession session, 
                                            String name, int w, int h, 
                                            int format, int flags, 
                                            long parentObject, Parcel metadata);
}

2.2 JNI 层 → Native Client 层

// frameworks/base/core/jni/android_view_SurfaceControl.cpp
static jlong nativeCreate(JNIEnv* env, jclass clazz, jobject sessionObj,
                          jstring nameStr, ...) {
    // 获取 SurfaceComposerClient
    sp<SurfaceComposerClient> client = android_view_SurfaceSession_getClient(env, sessionObj);

    // 创建 native SurfaceControl
    sp<SurfaceControl> surface;
    status_t err = client->createSurfaceChecked(name, w, h, format, &surface, flags, parent, metadata);
    if (err == NAME_NOT_FOUND) {
        jniThrowException(env, "java/lang/IllegalArgumentException", NULL);
        return 0;
    } else if (err != NO_ERROR) {
        jniThrowException(env, OutOfResourcesException, statusToString(err).c_str());
        return 0;
    }

    surface->incStrong((void *)nativeCreate);
    return reinterpret_cast<jlong>(surface.get());
}


status_t SurfaceComposerClient::createSurfaceChecked(const String8& name, uint32_t w, uint32_t h,
                                                     PixelFormat format,
                                                     sp<SurfaceControl>* outSurface, int32_t flags,
                                                     const sp<IBinder>& parentHandle,
                                                     LayerMetadata metadata,
                                                     uint32_t* outTransformHint) {
    status_t err = mStatus;

    if (mStatus == NO_ERROR) {
        gui::CreateSurfaceResult result;
        binder::Status status = mClient->createSurface(std::string(name.c_str()), flags,
                                                       parentHandle, std::move(metadata), &result);
        err = statusTFromBinderStatus(status);
        if (outTransformHint) {
            *outTransformHint = result.transformHint;
        }
        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
        if (err == NO_ERROR) {
            *outSurface = new SurfaceControl(this, result.handle, result.layerId,
                                             toString(result.layerName), w, h, format,
                                             result.transformHint, flags);
        }
    }
    return err;
}

2.3 SurfaceFlinger 创建 Layer

// frameworks/native/services/surfaceflinger/Client.cpp
binder::Status Client::createSurface(const std::string& name, int32_t flags,
                                     const sp<IBinder>& parent, const gui::LayerMetadata& metadata,
                                     gui::CreateSurfaceResult* outResult) {
    // We rely on createLayer to check permissions.
    sp<IBinder> handle;
    LayerCreationArgs args(mFlinger.get(), sp<Client>::fromExisting(this), name.c_str(),
                           static_cast<uint32_t>(flags), std::move(metadata));
    args.parentHandle = parent;
    const status_t status = mFlinger->createLayer(args, *outResult);
    return binderStatusFromStatusT(status);
}


// frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::createLayer(LayerCreationArgs& args, gui::CreateSurfaceResult& outResult) {
    status_t result = NO_ERROR;
    // 创建 Layer 对象并获取 LayerHandle
    sp<Layer> layer;
    result = createBufferStateLayer(args, &outResult.handle, &layer);

    sp<Layer> parent = LayerHandle::getLayer(args.parentHandle.promote());
    result = addClientLayer(args, outResult.handle, layer, parent, &outTransformHint);

    outResult.transformHint = static_cast<int32_t>(outTransformHint);
    outResult.layerId = layer->sequence;
    outResult.layerName = String16(layer->getDebugName());
    return result;
}


status_t SurfaceFlinger::createBufferStateLayer(LayerCreationArgs& args, sp<IBinder>* handle,
                                                sp<Layer>* outLayer) {
    *outLayer = getFactory().createBufferStateLayer(args);
    *handle = (*outLayer)->getHandle();
    return NO_ERROR;
}

2.4 Layer 构造与 Handle 生成

// frameworks/native/services/surfaceflinger/Layer.cpp
Layer::Layer(const surfaceflinger::LayerCreationArgs& args)
      : sequence(args.sequence),
        mFlinger(sp<SurfaceFlinger>::fromExisting(args.flinger)),
        mName(base::StringPrintf("%s#%d", args.name.c_str(), sequence)),
        mWindowType(...) {
    ALOGV("Creating Layer %s", getDebugName());
    // 初始化状态...
}

// 获取 LayerHandle
sp<IBinder> Layer::getHandle() {
    Mutex::Autolock _l(mLock);
    if (mGetHandleCalled) {
        ALOGE("Get handle called twice");
        return nullptr;
    }
    mGetHandleCalled = true;
    mHandleAlive = true;  // 标记 handle 存活

    // 创建 LayerHandle，持有 Layer 的强引用
    return sp<LayerHandle>::make(mFlinger, sp<Layer>::fromExisting(this));
}

2.5 LayerHandle 结构

// frameworks/native/services/surfaceflinger/FrontEnd/LayerHandle.cpp
LayerHandle::LayerHandle(const sp<android::SurfaceFlinger>& flinger,
                         const sp<android::Layer>& layer)
      : mFlinger(flinger), 
        mLayer(layer),  // 强引用
        mLayerId(static_cast<uint32_t>(layer->getSequence())) {}

重要：LayerHandle 持有 Layer 的强引用（sp<Layer>），只要 handle 存在，Layer 就不会被销毁。

2.6 Layer 创建流程图

┌─────────────────────────────────────────────────────────────────────┐
│                         Application Layer                           │
│  SurfaceView / Window / ViewRootImpl                                │
└────────────────────────────┬────────────────────────────────────────┘
                             │ new SurfaceControl.Builder().build()
                             ▼
┌─────────────────────────────────────────────────────────────────────┐
│                      Java Framework Layer                           │
│  SurfaceControl.java                                                 │
│  ├── Builder.build()                                                 │
│  ├── SurfaceControl() 构造函数                                       │
│  └── nativeCreate() ─────────────────────────────┐                  │
└──────────────────────────────────────────────────┼──────────────────┘
                                                   │ JNI
                                                   ▼
┌─────────────────────────────────────────────────────────────────────┐
│                          JNI Layer                                   │
│  android_view_SurfaceControl.cpp                                     │
│  ├── nativeCreate()                                                  │
│  └── SurfaceComposerClient::createSurfaceChecked() ───┐             │
└───────────────────────────────────────────────────────┼─────────────┘
                                                        │
                                                        ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    Native Client Layer                              │
│  SurfaceComposerClient.cpp                                           │
│  ├── createSurfaceChecked()                                          │
│  └── mClient->createSurface() ────────────────────────┐             │
│      (ISurfaceComposerClient Binder 代理)              │             │
└───────────────────────────────────────────────────────┼─────────────┘
                                                        │ Binder IPC
                                                        ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    SurfaceFlinger Service                           │
│  SurfaceFlinger.cpp                                                  │
│  ├── Client::createSurface()                                         │
│  ├── SurfaceFlinger::createLayer()                                   │
│  │   ├── createBufferStateLayer()                                    │
│  └── 返回 LayerHandle (IBinder) ──────────────────────┐             │
└───────────────────────────────────────────────────────┼─────────────┘
                                                        │
                                                        ▼
┌─────────────────────────────────────────────────────────────────────┐
│  ├── LayerHandle (IBinder) → 持有 Layer 强引用                      │
│  └── RequestedLayerState → Frontend 状态管理                        │
└─────────────────────────────────────────────────────────────────────┘

三、Layer 销毁流程（核心）

3.1 销毁必要条件

Frontend 架构下，Layer 销毁必须同时满足以下两个条件：

// RequestedLayerState.cpp
bool RequestedLayerState::canBeDestroyed() const {
    return !handleAlive && parentId == UNASSIGNED_LAYER_ID;
}

handleAlive == false: Handle 引用已释放（客户端不再持有引用，防止野指针）。
parentId == UNASSIGNED_LAYER_ID: 已从层级树移除（Reparent null，确保不再参与合成）。

3.2 条件1：Handle 引用释放

Java 层触发：

// SurfaceControl.java
public void release() {
    if (mNativeObject != 0) {
        mFreeNativeResources.run();  // 触发 native 资源释放
        mNativeObject = 0;
    }
}

Native 层处理：
当客户端释放 Handle 时，最终触发 SurfaceFlinger::onHandleDestroyed：

LayerHandle::~LayerHandle() {
    if (mFlinger) {
        // 析构时通知 SurfaceFlinger
        mFlinger->onHandleDestroyed(mLayer, mLayerId);
    }
}

// SurfaceFlinger.cpp
void SurfaceFlinger::onHandleDestroyed(sp<Layer>& layer, uint32_t layerId) {
    {
        ftl::FakeGuard guard(kMainThreadContext);
        mTransactionHandler.onLayerDestroyed(layerId);
    }

    std::scoped_lock<std::mutex> lock(mCreatedLayersLock);
    mDestroyedHandles.emplace_back(layerId, layer->getDebugName());

    Mutex::Autolock stateLock(mStateLock);
    layer->onHandleDestroyed();  // 设置 mHandleAlive = false
    mBufferCountTracker.remove(layerId);
    layer.clear();  // 释放 Layer 的强引用
    setTransactionFlags(eTransactionFlushNeeded | eTransactionNeeded);
}

// Layer.h
bool onHandleDestroyed() { return mHandleAlive = false; }

3.3 条件2：Reparent Null

Java 层触发：

// SurfaceControl.java
public Transaction reparent(@NonNull SurfaceControl sc, @Nullable SurfaceControl newParent) {
    long otherObject = 0;
    if (newParent != null) {
        otherObject = newParent.mNativeObject;
    }
    nativeReparent(mNativeObject, sc.mNativeObject, otherObject);
    return this;
}

// Transaction.remove() 同时执行 reparent(null) + release()
public Transaction remove(@NonNull SurfaceControl sc) {
    reparent(sc, null);  // 从层级树移除
    sc.release();        // 释放 handle
    return this;
}

Native 层处理（LayerLifecycleManager）：

bool SurfaceFlinger::commit(PhysicalDisplayId pacesetterId,
                            const scheduler::FrameTargets& frameTargets) {
    bool mustComposite = mMustComposite.exchange(false);
    if (mLayerLifecycleManagerEnabled) {
        mustComposite |=
                updateLayerSnapshots(vsyncId, pacesetterFrameTarget.frameBeginTime().ns(),
                                        flushTransactions, transactionsAreEmpty);
    }
}

bool SurfaceFlinger::updateLayerSnapshots(VsyncId vsyncId, nsecs_t frameTimeNs,
                                          bool flushTransactions, bool& outTransactionsAreEmpty) {
    mLayerLifecycleManager.applyTransactions(update.transactions);
    mLayerLifecycleManager.onHandlesDestroyed(update.destroyedHandles);
    mLayerLifecycleManager.commitChanges();
}

void LayerLifecycleManager::onHandlesDestroyed(...) {
    for (const auto& [layerId, name] : destroyedHandles) {
        layer.handleAlive = false;
        if (!layer.canBeDestroyed()) continue; // 不满足条件，跳过

        layer.changes |= RequestedLayerState::Changes::Destroyed;
        layersToBeDestroyed.emplace_back(layerId);
    }
    // 处理父子关系断开，子节点可能被级联销毁
}

3.4 RefBase 引用计数与销毁深层机制

除了 Frontend 的状态判断，Legacy Layer 的实际析构依赖于 RefBase 的强引用计数归零。以下引用必须全部释放：

引用来源	引用位置	释放方式
客户端 SurfaceControl	LayerHandle → sp<Layer>	release() 或 GC
父 Layer	mCurrentChildren	reparent(null)
Transaction	mLayerStates	apply() 或取消

当 onHandleDestroyed 触发 layer.clear() 并从树中移除后，引用计数归零，触发：
Layer::onLastRef() → ~Layer() 析构函数（清理 BufferQueue、纹理等资源）。

3.5 完整销毁流程图

┌─────────────────────────────────────────────────────────────────────────────┐
│                        Layer 销毁触发                                        │
├─────────────────────────────────────────────────────────────────────────────┤
│   ┌─────────────────────┐         ┌─────────────────────┐                  │
│   │  路径A: Handle 释放  │         │  路径B: Reparent    │                  │
│   │ SurfaceControl      │         │ Transaction.reparent│                  │
│   │ .release() / GC     │         │ (null)              │                  │
│   └──────────┬──────────┘         └──────────┬──────────┘                  │
│              │                               │                              │
│              ▼                               ▼                              │
│   ┌─────────────────────────────────────────────────────────────────┐      │
│   │              SurfaceFlinger::onHandleDestroyed()                 │      │
│   │  1. layer->onHandleDestroyed() → mHandleAlive = false           │      │
│   │  2. layer.clear()  // 释放强引用                                │      │
│   └─────────────────────────────────────────────────────────────────┘      │
│                              │                                              │
│                              ▼                                              │
│   ┌─────────────────────────────────────────────────────────────────┐      │
│   │         LayerLifecycleManager::onHandlesDestroyed()             │      │
│   │  // 核心：检查销毁条件                                           │      │
│   │  if (!layer.canBeDestroyed()) continue;                         │      │
│   │  // canBeDestroyed() = !handleAlive && parentId == UNASSIGNED   │      │
│   └─────────────────────────────────────────────────────────────────┘      │
│                              │                                              │
│                              ▼                                              │
│   ┌─────────────────────────────────────────────────────────────────┐      │
│   │                    实际销毁处理                                  │      │
│   │  1. LayerLifecycleManager::commitChanges()                      │      │
│   │  2. listener->onLayerDestroyed(layer)                           │      │
│   │  3. Layer::~Layer() 析构函数执行                                │      │
│   └─────────────────────────────────────────────────────────────────┘      │
└─────────────────────────────────────────────────────────────────────────────┘

四、常见泄漏场景与调试建议

4.1 常见泄漏场景

未 reparent null: SurfaceControl.release() 已调用，但 Layer 仍在父 Layer 的 children 列表中（parentId != UNASSIGNED_LAYER_ID）。
Java 层引用未释放: Java SurfaceControl 对象未被 GC，导致 Native Handle 一直存在（handleAlive == true）。
Transaction 未完成: Transaction 队列中有未提交的事务，持有 Layer 引用，延迟了销毁流程。

4.2 调试与分析建议

日志分析:

adb logcat | grep -E "Layer::(create|destroy|onFirstRef|onLastRef)"

SurfaceFlinger 转储:

adb shell dumpsys SurfaceFlinger --list
adb shell dumpsys SurfaceFlinger --latency <Surface>

性能分析:

python systrace.py -t 10 gfx input view

五、关键代码路径索引

功能	文件	关键方法/变量
Java 创建入口	`frameworks/base/core/java/android/view/SurfaceControl.java`	`Builder.build()`, `nativeCreate()`
Java 销毁入口	`frameworks/base/core/java/android/view/SurfaceControl.java`	`release()`, `Transaction.reparent(null)`
JNI 桥接	`frameworks/base/core/jni/android_view_SurfaceControl.cpp`	`nativeCreate()`, `nativeReparent()`
Layer 创建	`frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp`	`createLayer()`
Handle 管理	`frameworks/native/services/surfaceflinger/Layer.cpp`	`getHandle()`, `mHandleAlive`
Handle 析构	`frameworks/native/services/surfaceflinger/FrontEnd/LayerHandle.cpp`	`~LayerHandle()`, `mLayer` (强引用)
销毁判断	`frameworks/native/services/surfaceflinger/FrontEnd/RequestedLayerState.cpp`	`canBeDestroyed()`
生命周期管理	`frameworks/native/services/surfaceflinger/FrontEnd/LayerLifecycleManager.cpp`	`onHandlesDestroyed()`

六、Android 16 变化说明

6.1 核心代码未变化

以下核心代码在 Android 16 中保持不变：

销毁条件判断: RequestedLayerState::canBeDestroyed()
LayerHandle: LayerHandle.cpp
销毁流程: LayerLifecycleManager::onHandlesDestroyed()
Java API: SurfaceControl.release() / Transaction.remove()

Android Layer 创建与销毁流程分析