回顾：
Android消息机制
Android消息机制主要指的是Handler的运行机制以及Handler所附带的MessageQueue和Looper的工作机制。
介绍
通过Handler 消息机制来解决线程之间通信问题，或者用来切换线程。特别是在更新UI界面时，确保了线程间的数据同步和交互。
-
Handler：Handler的主要作用是将一个任务切换到某个指定的线程中执行。在Android开发中，Handler常用于从子线程更新UI界面，因为Android的UI控件不是线程安全的，直接在非UI线程中更新UI可能会导致界面处于不可预期的状态。通过Handler，可以在主线程（即UI线程）中安全地更新UI。
-
MessageQueue：MessageQueue是消息机制的Java层和C++层的连接纽带，它存储了一组待处理的消息，并提供了插入和删除的操作。MessageQueue的内部实现并不是传统的队列，而是采用单链表的形式。
-
Looper：Looper在Android消息机制中扮演着消息循环的角色。它会不断地从MessageQueue中查看是否有新消息，如果有新消息就会立刻处理，否则就一直阻塞在那里。Looper是针对线程的，为线程创建Looper后，该线程就可以通过Handler来处理消息了。
-
ThreadLocal：ThreadLocal是一个可以在多个线程间互不干扰地提供数据的类。在Android中，每个线程都有自己的ThreadLocalMap实例，用于存储该线程的Looper信息。这意味着不同线程访问ThreadLocal时，会获得不同的值副本，从而保证了线程间的独立性。
总的来说，Android的消息机制通过Handler、MessageQueue、Looper和ThreadLocal的协同工作，实现了跨线程的通信和数据的处理，确保了应用程序的响应性和界面的流畅性。
流程
在子线程执行完耗时操作，当Handler发送消息时，将会调用MessageQueue.enqueueMessage，向消息队列中添加消息。当通过Looper.loop开启循环后，会不断地从线程池中读取消息，即调用MessageQueue.next，然后调用目标Handler（即发送该消息的Handler）的dispatchMessage方法传递消息，然后返回到Handler所在线程，目标Handler收到消息，调用handleMessage方法，接收消息，处理消息。
下图来自：https://www.jianshu.com/p/f10cff5b4c25
示例
Looper的使用示例
public class LooperThread extends Thread{
private Handler mHandler;
@Override
public void run() {
Looper.prepare();
mHandler = new Handler(){
@Override
public void handleMessage(@NonNull Message msg) {
//process incoming messages here
}
};
Looper.loop();
}
}
Looper
用于在指定线程中运行一个消息循环，一旦有新任务则执行，执行完继续等待下一个任务，即变成Looper线程。
创建
Looper的创建需要通过Looper.prepare()。
在构造函数中创建了一个消息队列MessageQueue的实例mQueue,并持有当前线程对象的引用mThread。
@UnsupportedAppUsage
static final ThreadLocal<Looper> sThreadLocal = new ThreadLocal<Looper>();
...
/** Initialize the current thread as a looper.
* This gives you a chance to create handlers that then reference
* this looper, before actually starting the loop. Be sure to call
* {@link #loop()} after calling this method, and end it by calling
* {@link #quit()}.
*/
public static void prepare() {
prepare(true);
}
private static void prepare(boolean quitAllowed) {
if (sThreadLocal.get() != null) {
throw new RuntimeException("Only one Looper may be created per thread");
}
sThreadLocal.set(new Looper(quitAllowed));
}
private Looper(boolean quitAllowed) {
mQueue = new MessageQueue(quitAllowed);
mThread = Thread.currentThread();
}
ThreadLocal
ThreadLocal并不是线程,它的作用是可以在每个线程中存储数据。可以在不同的线程中互不干扰地存储并提供数据,通过它可以轻松获得每个线程的Looper。
运行
使用Looper.loop()在当前线程运行消息队列。（在这之前需要调用prepare方法，否则会抛出异常）
在for循环中，不断调用MessageQueue对象queue的next方法来获取下一个待处理的消息Message对象message。msg.target.dispatchMessage(msg); msg.target是handler对象。
注：next方法可能会发生阻塞。
Looper.loop方法源码：
/**
* Run the message queue in this thread. Be sure to call
* {@link #quit()} to end the loop.
*/
public static void loop() {
final Looper me = myLooper();
if (me == null) {
throw new RuntimeException("No Looper; Looper.prepare() wasn't called on this thread.");
}
if (me.mInLoop) {
Slog.w(TAG, "Loop again would have the queued messages be executed"
+ " before this one completed.");
}
me.mInLoop = true;
final MessageQueue queue = me.mQueue;
// Make sure the identity of this thread is that of the local process,
// and keep track of what that identity token actually is.
Binder.clearCallingIdentity();
final long ident = Binder.clearCallingIdentity();
// Allow overriding a threshold with a system prop. e.g.
// adb shell 'setprop log.looper.1000.main.slow 1 && stop && start'
final int thresholdOverride =
SystemProperties.getInt("log.looper."
+ Process.myUid() + "."
+ Thread.currentThread().getName()
+ ".slow", 0);
boolean slowDeliveryDetected = false;
for (;;) {
Message msg = queue.next(); // might block
if (msg == null) {
// No message indicates that the message queue is quitting.
return;
}
// This must be in a local variable, in case a UI event sets the logger
final Printer logging = me.mLogging;
if (logging != null) {
logging.println(">>>>> Dispatching to " + msg.target + " " +
msg.callback + ": " + msg.what);
}
// Make sure the observer won't change while processing a transaction.
final Observer observer = sObserver;
final long traceTag = me.mTraceTag;
long slowDispatchThresholdMs = me.mSlowDispatchThresholdMs;
long slowDeliveryThresholdMs = me.mSlowDeliveryThresholdMs;
if (thresholdOverride > 0) {
slowDispatchThresholdMs = thresholdOverride;
slowDeliveryThresholdMs = thresholdOverride;
}
final boolean logSlowDelivery = (slowDeliveryThresholdMs > 0) && (msg.when > 0);
final boolean logSlowDispatch = (slowDispatchThresholdMs > 0);
final boolean needStartTime = logSlowDelivery || logSlowDispatch;
final boolean needEndTime = logSlowDispatch;
if (traceTag != 0 && Trace.isTagEnabled(traceTag)) {
Trace.traceBegin(traceTag, msg.target.getTraceName(msg));
}
final long dispatchStart = needStartTime ? SystemClock.uptimeMillis() : 0;
final long dispatchEnd;
Object token = null;
if (observer != null) {
token = observer.messageDispatchStarting();
}
long origWorkSource = ThreadLocalWorkSource.setUid(msg.workSourceUid);
try {
msg.target.dispatchMessage(msg);
if (observer != null) {
observer.messageDispatched(token, msg);
}
dispatchEnd = needEndTime ? SystemClock.uptimeMillis() : 0;
} catch (Exception exception) {
if (observer != null) {
observer.dispatchingThrewException(token, msg, exception);
}
throw exception;
} finally {
ThreadLocalWorkSource.restore(origWorkSource);
if (traceTag != 0) {
Trace.traceEnd(traceTag);
}
}
if (logSlowDelivery) {
if (slowDeliveryDetected) {
if ((dispatchStart - msg.when) <= 10) {
Slog.w(TAG, "Drained");
slowDeliveryDetected = false;
}
} else {
if (showSlowLog(slowDeliveryThresholdMs, msg.when, dispatchStart, "delivery",
msg)) {
// Once we write a slow delivery log, suppress until the queue drains.
slowDeliveryDetected = true;
}
}
}
if (logSlowDispatch) {
showSlowLog(slowDispatchThresholdMs, dispatchStart, dispatchEnd, "dispatch", msg);
}
if (logging != null) {
logging.println("<<<<< Finished to " + msg.target + " " + msg.callback);
}
// Make sure that during the course of dispatching the
// identity of the thread wasn't corrupted.
final long newIdent = Binder.clearCallingIdentity();
if (ident != newIdent) {
Log.wtf(TAG, "Thread identity changed from 0x"
+ Long.toHexString(ident) + " to 0x"
+ Long.toHexString(newIdent) + " while dispatching to "
+ msg.target.getClass().getName() + " "
+ msg.callback + " what=" + msg.what);
}
msg.recycleUnchecked();
}
}
Message
Message
摘自：https://juejin.cn/post/6844903446571663374
这个类定义了一个包含描述和一个任意类型对象的对象，它可以被发送给Handler。
/**
*
* Defines a message containing a description and arbitrary data object that can be
* sent to a {@link Handler}. This object contains two extra int fields and an
* extra object field that allow you to not do allocations in many cases.
*
* While the constructor of Message is public, the best way to get
* one of these is to call {@link #obtain Message.obtain()} or one of the
* {@link Handler#obtainMessage Handler.obtainMessage()} methods, which will pull
* them from a pool of recycled objects.
*/
从注释里我们还可以了解到以下几点：
- 尽管Message有public的默认构造方法，但是你应该通过Message.obtain()来从消息池中获得空消息对象，以节省资源。
- 如果你的message只需要携带简单的int信息，请优先使用Message.arg1和Message.arg2来传递信息，这比用Bundle更省内存
- 用message.what来标识信息，以便用不同方式处理message。
/**
* Return a new Message instance from the global pool. Allows us to
* avoid allocating new objects in many cases.
*/
public static Message obtain() {
synchronized (sPoolSync) {
if (sPool != null) {
Message m = sPool;
sPool = m.next;
m.next = null;
m.flags = 0; // clear in-use flag
sPoolSize--;
return m;
}
}
return new Message();
}
MessageQueue
在Looper的构造函数中创建了MessageQueue，在loop过程中，通过死循环不断的获取消息。
可以通过Looper.myQueue()获取。
MessageQueue类注释如下：
/**
* Low-level class holding the list of messages to be dispatched by a
* {@link Looper}. Messages are not added directly to a MessageQueue,
* but rather through {@link Handler} objects associated with the Looper.
*
* <p>You can retrieve the MessageQueue for the current thread with
* {@link Looper#myQueue() Looper.myQueue()}.
*/
Handler中调用了MessageQueue对象的enqueueMessage函数，将Message对象发送到队列中。
Handler中：
public final boolean sendMessageAtFrontOfQueue(@NonNull Message msg) {
MessageQueue queue = mQueue;
if (queue == null) {
RuntimeException e = new RuntimeException(
this + " sendMessageAtTime() called with no mQueue");
Log.w("Looper", e.getMessage(), e);
return false;
}
return enqueueMessage(queue, msg, 0);
}
private boolean enqueueMessage(@NonNull MessageQueue queue, @NonNull Message msg,
long uptimeMillis) {
msg.target = this;
msg.workSourceUid = ThreadLocalWorkSource.getUid();
if (mAsynchronous) {
msg.setAsynchronous(true);
}
return queue.enqueueMessage(msg, uptimeMillis);
}
MessageQueue中：
boolean enqueueMessage(Message msg, long when) {
if (msg.target == null) {
throw new IllegalArgumentException("Message must have a target.");
}
synchronized (this) {
if (msg.isInUse()) {
throw new IllegalStateException(msg + " This message is already in use.");
}
if (mQuitting) {
IllegalStateException e = new IllegalStateException(
msg.target + " sending message to a Handler on a dead thread");
Log.w(TAG, e.getMessage(), e);
msg.recycle();
return false;
}
msg.markInUse();
msg.when = when;
Message p = mMessages;
boolean needWake;
if (p == null || when == 0 || when < p.when) {//队列头
msg.next = p;
mMessages = msg;
needWake = mBlocked;
} else {
needWake = mBlocked && p.target == null && msg.isAsynchronous();
Message prev;
for (;;) {
prev = p;
p = p.next;
if (p == null || when < p.when) {
break;
}
if (needWake && p.isAsynchronous()) {
needWake = false;
}
}
msg.next = p; // invariant: p == prev.next
prev.next = msg;
}
// We can assume mPtr != 0 because mQuitting is false.
if (needWake) {
nativeWake(mPtr);
}
}
return true;
}
Handler
Handler的实际应用就是UI线程与其他线程之间的切换。
创建
Handler有多个构造函数，主要是设置三个参数Looper对象，Callback对象，布尔类型async。Callback对象主要涉及消息的处理，async表示是否设置同步屏障。
public Handler(@NonNull Looper looper)
public Handler(@NonNull Looper looper, @Nullable Callback callback)
public Handler(boolean async)
public Handler(@Nullable Callback callback, boolean async)
public Handler(@NonNull Looper looper, @Nullable Callback callback, boolean async)
消息传递
通过sendMessage发送一个Message对象，或通过post方法提交一个Runable对象。
而post函数只是将Runable对象封装到Message对象中的callback函数。最终还是调用sendMessagedDelayed函数的历程去处理。
从这里我们定位到了在Looper的loop函数中Message对象的target是Handler对象，看看dispatchMessage函数。
public void dispatchMessage(@NonNull Message msg) {
if (msg.callback != null) {
handleCallback(msg);
} else {
if (mCallback != null) {
if (mCallback.handleMessage(msg)) {
return;
}
}
handleMessage(msg);
}
}
从dispatchMessage函数可以看出对消息处理的优先级。
消息Message对象msg自带的Runable对象callback。也就是我们通过post函数投递的Runable对象会最先被处理。
优先级排第二就是我们在创建Handler对象时，设置的全局回调Callback对象mCallback。
优先级最低的，也是最常用的，重载handleMessage函数，该函数默认是空实现。
sendMessage与obtainMessage
public final boolean sendMessage(@NonNull Message msg); //传入一个Message参数，进行排队发送到handleMessage
public final Message obtainMessage(); //返回值是一个Message，一般搭配sendToTarget使用
有多个重载版本，就是构建传入参数的不同产出不同的Message
public final Message obtainMessage(int what); //带指定what的Message
public final Message obtainMessage(int what, @Nullable Object obj);//带指定what和obj的Message
public final Message obtainMessage(int what, int arg1, int arg2);//带指定what arg1 arg2的Message
public final Message obtainMessage(int what, int arg1, int arg2, @Nullable Object obj);带指定what arg1 arg2 obj的Message搭配使用就是 obtainMessage(xx).sendToTarget(); //实现和sendMessage相同的功能
obtainMessage会利用内部的message池，如果池中有可用message，就不重新new分配。参考Message的构造函数
参考资料
Android消息机制的原理及源码解析
Android Handler 消息机制
Android的消息机制Handler
![buu[HCTF 2018]WarmUp（代码审计）](https://img-blog.csdnimg.cn/direct/01f80e3705d64460981b57a0e1829323.png#pic_center)
