kotlin复制代码// before
fun authWechat() {
    if (api != null) {
        if (!api.isWXAppInstalled) {
            ToastUtils.showErrorToast("您还未安装微信客户端")
            return
        }
        val req = SendAuth.Req()
        req.scope = "snsapi_userinfo"
        req.state = "none"
        api.sendReq(req)
    }
}

kotlin复制代码// after
fun authWechat(callbackContext: CallbackContext?) {
    val api = DsApplication.getDsInstance().wxapi
    api?.takeIf { it.isWXAppInstalled }?.let {
        // do something else
        it.sendReq(
            SendAuth.Req().apply {
                scope = "snsapi_userinfo"
                state = "none"
            }
        )
    } ?: api?.run { ToastUtils.showErrorToast("您还未安装微信客户端") }
}

kotlin复制代码val req = SendAuth.Req()
req.scope = "snsapi_userinfo"
req.state = "none"

kotlin复制代码SendAuth.Req().apply {
    scope = "snsapi_userinfo"
    state = "none"
}

kotlin复制代码val name: String = getName() ?: "default"

kotlin复制代码fun getUser(): User? = null
fun useUser(user: User) {}
// 从一个函数中获得了可空对象
val _userNullable = getUser()
// 判断非空+条件，返回对象或者构造不符合条件的值
val user =  if (_userNullable != null && _userNullable.user == "admin") {
    _userNullable
} else {
    User("guess")
}
//使用对象
useUser(user)

kotlin复制代码fun getUser(): User? = null
fun useUser(user: User) {}
// 使用`?:` Elvis 表达式简化的写法
useUser(getUser()?.takeIf { it.user == "admin" } ?: User("guest"))

kotlin复制代码fun View.onClickLike(user: String?, isGroup: Boolean = false) = this.setOnClickListener {
    user?.takeUnless { it.isEmpty() } ?: return@setOnClickListener
    StatisticsUtils.onClickLike(this.context, user, isGroup)
}

kotlin复制代码// before
btnA.setOnClickListener { sendEndCommand() }
btnB.setOnClickListener { sendEndCommand() }
btnC.setOnClickListener { sendEndCommand() }

kotlin复制代码btnA.setOnClickListener(::sendEndCommand)
btnB.setOnClickListener(::sendEndCommand)
btnC.setOnClickListener(::sendEndCommand)

kotlin复制代码@JvmOverloads
fun sendEndCommand(@Suppress("UNUSED_PARAMETER") v: View? = null) {

}

kotlin复制代码/**
 * 获取全部题目的正确率，x：题目序号，y：正确率数值（float）
 * @param format ((quesNum: Int) -> String)? 格式化X轴label文字
 * @param denominator Int  计算正确率使用的分母
 * @return BarData?
 */

kotlin复制代码/**
 * 获取全部题目的正确率的BarData，其中，x：题目序号，y：正确率数值（float）。
 * [format] 默认值为null，用于格式化X轴label文字，
 * [denominator] 除数，作为计算正确率使用的分母，
 * 返回值是直接可以用在BarChart中的[BarData]。
 */

例如:

在AS中他会被折叠成非常美观的注释块：


![image.png](https://gitee.com/songjianzaina/juejin_p3/raw/master/img/4728596a5d0539b2abe478df068579480806e4437c56deb6d3db88f0c6e98d50)




---




---


写在最后
----


文章最后我们看一段 ”Java“ 代码与 Kotlin 代码的对比吧：

ini复制代码[mysqld] 
# 打开binlog 
log-bin=mysql-bin 
# 选择ROW(行)模式 
binlog-format=ROW 
# 配置MySQL replaction需要定义，不要和canal的slaveId重复 
server_id=1

sql复制代码-- 使用命令登录：
mysql -u root -p 
-- 创建用户 用户名：canal 密码：Canal@123456 
create user 'canal'@'%' identified by 'Canal@123456';
-- 授权 *.*表示所有库 
grant SELECT, REPLICATION SLAVE, REPLICATION CLIENT on *.* to 'canal'@'%' identified by 'Canal@123456';

ini复制代码## mysql serverId , v1.0.26+ will autoGen
## v1.0.26版本后会自动生成slaveId，所以可以不用配置
# canal.instance.mysql.slaveId=0

# 数据库地址
canal.instance.master.address=127.0.0.1:3306
# binlog日志名称
canal.instance.master.journal.name=mysql-bin.000001
# mysql主库链接时起始的binlog偏移量
canal.instance.master.position=154
# mysql主库链接时起始的binlog的时间戳
canal.instance.master.timestamp=
canal.instance.master.gtid=

# username/password
# 在MySQL服务器授权的账号密码
canal.instance.dbUsername=canal
canal.instance.dbPassword=Canal@123456
# 字符集
canal.instance.connectionCharset = UTF-8
# enable druid Decrypt database password
canal.instance.enableDruid=false

# table regex .*\..*表示监听所有表 也可以写具体的表名，用，隔开
canal.instance.filter.regex=.*\..*
# mysql 数据解析表的黑名单，多个表用，隔开
canal.instance.filter.black.regex=

yaml复制代码canal.conf:
  mode: tcp # kafka rocketMQ                # canal client的模式: tcp kafka rocketMQ
  flatMessage: true                         # 扁平message开关, 是否以json字符串形式投递数据, 仅在kafka/rocketMQ模式下有效
  syncBatchSize: 1000                       # 每次同步的批数量
  retries: 0                                # 重试次数, -1为无限重试
  timeout:                                  # 同步超时时间, 单位毫秒
  consumerProperties:
    canal.tcp.server.host:                  # 对应单机模式下的canal
    canal.tcp.zookeeper.hosts: 127.0.0.1:2181 # 对应集群模式下的zk地址, 如果配置了canal.tcp.server.host, 则以canal.tcp.server.host为准
    canal.tcp.batch.size: 500               # tcp每次拉取消息的数量
  srcDataSources:                           # 源数据库
    defaultDS:                              # 自定义名称
      url: jdbc:mysql://127.0.0.1:3306/mytest?useUnicode=true   # jdbc url 
      username: root                                            # jdbc 账号
      password: 123                                          # jdbc 密码
  canalAdapters:                            # 适配器列表
  - instance: example                       # canal 实例名或者 MQ topic 名
    groups:                                 # 分组列表
    - groupId: g1                           # 分组id, 如果是MQ模式将用到该值
      outerAdapters:                        # 分组内适配器列表
      - name: es7                           # es7适配器
        mode: rest                          # transport or rest
        hosts: 127.0.0.1:9200               # es地址
        security.auth: test:123456          # 访问es的认证信息，如没有则不需要填
        cluster.name: my-es                 # 集群名称，transport模式必需配置
......

yaml复制代码dataSourceKey: defaultDS
destination: example
groupId: g1
esMapping:
  _index: sys_goods
  _id: id
  upsert: true
  sql: "select id, goodsname, price from sys_goods"
  etlCondition: "where update_time>={}"
  commitBatch: 3000

arduino复制代码public final class IvoryTower {

  /**
   * 私有构造函数，因此没有人可以实例化该类.
   */
  private IvoryTower() {
  }

  /**
   * 静态到类的类实例.
   */
  private static final IvoryTower INSTANCE = new IvoryTower();

  /**
   * 被用户调用以获取类的实例.
   *
   * @return instance of the singleton.
   */
  public static IvoryTower getInstance() {
    return INSTANCE;
  }
}

csharp复制代码public final class ThreadSafeLazyLoadedIvoryTower {

  private static volatile ThreadSafeLazyLoadedIvoryTower instance;

  private ThreadSafeLazyLoadedIvoryTower() {
    // 通过反射，防止实例化化
    if (instance != null) {
      throw new IllegalStateException("Already initialized.");
    }
  }

  /**
   * 在第一次调用方法之前不会创建实例
   */
  public static synchronized ThreadSafeLazyLoadedIvoryTower getInstance() {
    if (instance == null) {
      instance = new ThreadSafeLazyLoadedIvoryTower();
    }
    return instance;
  }
}

typescript复制代码public enum EnumIvoryTower {

  INSTANCE;

  @Override
  public String toString() {
    return getDeclaringClass().getCanonicalName() + "@" + hashCode();
  }
}

csharp复制代码public final class ThreadSafeDoubleCheckLocking {

  private static volatile ThreadSafeDoubleCheckLocking instance;

  /**
   * 私有构造函数以防止客户端实例化.
   */
  private ThreadSafeDoubleCheckLocking() {
    // to prevent instantiating by Reflection call
    if (instance != null) {
      throw new IllegalStateException("Already initialized.");
    }
  }

  /**
   * 公共访问器
   *
   * @return an instance of the class.
   */
  public static ThreadSafeDoubleCheckLocking getInstance() {
    // 局部变量将性能提高 25%
    // Joshua Bloch “Effective Java，第二版”，p. 283-284

    var result = instance;
    // 检查单例实例是否初始化.
    // 如果它已初始化，那么我们可以返回实例。
    if (result == null) {
      // 它没有初始化，但我们不能确定，因为其他线程可能有
      // 同时初始化它.
      // 所以为了确保我们需要锁定一个对象以获得互斥.
      synchronized (ThreadSafeDoubleCheckLocking.class) {
        //再次将实例分配给局部变量以检查它是否由其他地方初始化
        //当前线程被阻塞进入锁定区时其他线程
        // 如果它已被初始化，那么我们可以返回之前创建的实例
        // 就像之前的空检查一样。
        result = instance;
        if (result == null) {
          // 该实例仍未初始化，因此我们可以安全地创建实例
          // (没有其他线程可以进入这个区域)
          // 创建一个实例并使其成为我们的单例实例.
          instance = result = new ThreadSafeDoubleCheckLocking();
        }
      }
    }
    return result;
  }
}

arduino复制代码public final class InitializingOnDemandHolderIdiom {

  /**
   * 私有构造函数.
   */
  private InitializingOnDemandHolderIdiom() {
  }

  /**
   * 单例实例.
   *
   * @return Singleton instance
   */
  public static InitializingOnDemandHolderIdiom getInstance() {
    return HelperHolder.INSTANCE;
  }

  /**
   * 提供延迟加载的 Singleton 实例.
   */
  private static class HelperHolder {
    private static final InitializingOnDemandHolderIdiom INSTANCE =
        new InitializingOnDemandHolderIdiom();
  }
}

java复制代码@Slf4j
public class App {

 
  public static void main(String[] args) {

    // 饿汉模式
    var ivoryTower1 = IvoryTower.getInstance();
    var ivoryTower2 = IvoryTower.getInstance();
    LOGGER.info("ivoryTower1={}", ivoryTower1);
    LOGGER.info("ivoryTower2={}", ivoryTower2);

    // 懒汉模式
    var threadSafeIvoryTower1 = ThreadSafeLazyLoadedIvoryTower.getInstance();
    var threadSafeIvoryTower2 = ThreadSafeLazyLoadedIvoryTower.getInstance();
    LOGGER.info("threadSafeIvoryTower1={}", threadSafeIvoryTower1);
    LOGGER.info("threadSafeIvoryTower2={}", threadSafeIvoryTower2);

    // 枚举单例
    var enumIvoryTower1 = EnumIvoryTower.INSTANCE;
    var enumIvoryTower2 = EnumIvoryTower.INSTANCE;
    LOGGER.info("enumIvoryTower1={}", enumIvoryTower1);
    LOGGER.info("enumIvoryTower2={}", enumIvoryTower2);

    // 双重检查锁定实现
    var dcl1 = ThreadSafeDoubleCheckLocking.getInstance();
    LOGGER.info(dcl1.toString());
    var dcl2 = ThreadSafeDoubleCheckLocking.getInstance();
    LOGGER.info(dcl2.toString());

    // 按需初始化 holder
    var demandHolderIdiom = InitializingOnDemandHolderIdiom.getInstance();
    LOGGER.info(demandHolderIdiom.toString());
    var demandHolderIdiom2 = InitializingOnDemandHolderIdiom.getInstance();
    LOGGER.info(demandHolderIdiom2.toString());
  }
}

csharp复制代码public interface RowingBoat {

  void row();

}

less复制代码@Setter
@NoArgsConstructor
@AllArgsConstructor
public final class Captain {

  private RowingBoat rowingBoat;

  void row() {
    rowingBoat.row();
  }

}

java复制代码@Slf4j
final class FishingBoat {

  void sail() {
    LOGGER.info("The fishing boat is sailing");
  }

}

java复制代码public class FishingBoatAdapter implements RowingBoat {

  private final FishingBoat boat = new FishingBoat();

  public final void row() {
    boat.sail();
  }
}

arduino复制代码public final class App {

  private App() {
  }

  /**
   * 程序入口.
   *
   * @param args command line args
   */
  public static void main(final String[] args) {
    // 船长只能操作划艇，但通过适配器他能够
    // 也使用渔船
    var captain = new Captain(new FishingBoatAdapter());
    captain.row();
  }
}

csharp复制代码public interface RequestHandler {

  boolean canHandleRequest(Request req);

  int getPriority();

  void handle(Request req);

  String name();
}

arduino复制代码public class Request {

  /**
   * 此请求的类型，由链中的每个项目使用以查看它们是否应该或可以处理
   * 这个特殊要求
   */
  private final RequestType requestType;

  /**
   * 请求的描述
   */
  private final String requestDescription;

  /**
   * 指示请求是否已处理。请求只能将状态从未处理切换到
   * 已处理，无法“取消处理”请求
   */
  private boolean handled;

  /**
   * 创建给定类型和随附描述的新请求。
   *
   * @param requestType        The type of request
   * @param requestDescription The description of the request
   */
  public Request(final RequestType requestType, final String requestDescription) {
    this.requestType = Objects.requireNonNull(requestType);
    this.requestDescription = Objects.requireNonNull(requestDescription);
  }

  /**
   * 获取请求的描述。
   *
   * @返回请求的人可读描述
   */
  public String getRequestDescription() {
    return requestDescription;
  }

  /**
   * G获取此请求的类型，由命令链中的每个人使用以查看他们是否应该
   * 或者可以处理这个特定的请求
   *
   * @return The request type
   */
  public RequestType getRequestType() {
    return requestType;
  }

  /**
   * 将请求标记为已处理
   */
  public void markHandled() {
    this.handled = true;
  }

  /**
   * 指示是否处理此请求
   *
   * @return <tt>true</tt> when the request is handled, <tt>false</tt> if not
   */
  public boolean isHandled() {
    return this.handled;
  }

  @Override
  public String toString() {
    return getRequestDescription();
  }

}

arduino复制代码public enum RequestType {

  DEFEND_CASTLE, //防御城堡
  TORTURE_PRISONER,//酷刑囚犯
  COLLECT_TAX //收税

}

typescript复制代码@Slf4j
public class OrcCommander implements RequestHandler {
  @Override
  public boolean canHandleRequest(Request req) {
    return req.getRequestType() == RequestType.DEFEND_CASTLE;
  }

  @Override
  public int getPriority() {
    return 2;
  }

  @Override
  public void handle(Request req) {
    req.markHandled();
    LOGGER.info("{} handling request "{}"", name(), req);
  }

  @Override
  public String name() {
    return "Orc commander";
  }
}

scss复制代码public class OrcKing {

  private List<RequestHandler> handlers;

  public OrcKing() {
    buildChain();
  }

  private void buildChain() {
    handlers = Arrays.asList(new OrcCommander(), new OrcOfficer(), new OrcSoldier());
  }

  /**
   * Handle request by the chain.
   */
  public void makeRequest(Request req) {
    handlers
        .stream()
        .sorted(Comparator.comparing(RequestHandler::getPriority))
        .filter(handler -> handler.canHandleRequest(req))
        .findFirst()
        .ifPresent(handler -> handler.handle(req));
  }
}

typescript复制代码@Slf4j
public class OrcOfficer implements RequestHandler {
  @Override
  public boolean canHandleRequest(Request req) {
    return req.getRequestType() == RequestType.TORTURE_PRISONER;
  }

  @Override
  public int getPriority() {
    return 3;
  }

  @Override
  public void handle(Request req) {
    req.markHandled();
    LOGGER.info("{} handling request "{}"", name(), req);
  }

  @Override
  public String name() {
    return "Orc officer";
  }
}

typescript复制代码@Slf4j
public class OrcSoldier implements RequestHandler {
  @Override
  public boolean canHandleRequest(Request req) {
    return req.getRequestType() == RequestType.COLLECT_TAX;
  }

  @Override
  public int getPriority() {
    return 1;
  }

  @Override
  public void handle(Request req) {
    req.markHandled();
    LOGGER.info("{} handling request "{}"", name(), req);
  }

  @Override
  public String name() {
    return "Orc soldier";
  }
}

typescript复制代码public class App {

  /**
   * Program entry point.
   *
   * @param args command line args
   */
  public static void main(String[] args) {

    var king = new OrcKing();
    king.makeRequest(new Request(RequestType.DEFEND_CASTLE, "defend castle 保卫城堡"));
    king.makeRequest(new Request(RequestType.TORTURE_PRISONER, "torture prisoner 酷刑囚犯"));
    king.makeRequest(new Request(RequestType.COLLECT_TAX, "collect tax 征税"));
  }
}

csharp复制代码public interface Troll {

  void attack(); //攻击

  int getAttackPower(); // 获取攻击力

  void fleeBattle(); //逃离战斗

}

typescript复制代码@Slf4j
@RequiredArgsConstructor
public class ClubbedTroll implements Troll {

  private final Troll decorated;

  @Override
  public void attack() {
    decorated.attack();
    LOGGER.info("The troll swings at you with a club!");
  }

  @Override
  public int getAttackPower() {
    return decorated.getAttackPower() + 10;
  }

  @Override
  public void fleeBattle() {
    decorated.fleeBattle();
  }
}

typescript复制代码@Slf4j
public class SimpleTroll implements Troll {

  @Override
  public void attack() {
    LOGGER.info("The troll tries to grab you!");
  }

  @Override
  public int getAttackPower() {
    return 10;
  }

  @Override
  public void fleeBattle() {
    LOGGER.info("The troll shrieks in horror and runs away!");
  }
}

scss复制代码@Slf4j
public class App {

  /**
   * Program entry point.
   *
   * @param args command line args
   */
  public static void main(String[] args) {

    // simple troll
    LOGGER.info("A simple looking troll approaches.");
    var troll = new SimpleTroll();
    troll.attack();
    troll.fleeBattle();
    LOGGER.info("Simple troll power: {}.\n", troll.getAttackPower());

    // 通过添加装饰器改变简单巨魔的行为
    LOGGER.info("A troll with huge club surprises you.");
    var clubbedTroll = new ClubbedTroll(troll);
    clubbedTroll.attack();
    clubbedTroll.fleeBattle();
    LOGGER.info("Clubbed troll power: {}.\n", clubbedTroll.getAttackPower());
  }
}

js复制代码var foo = function () {
    console.log("foo1")
}
foo()

var foo = function () {
    console.log("foo2")
}
foo()


function foo() {
    console.log("foo1")
}
foo()

function foo() {
    console.log("foo2")
}
foo()

js复制代码var foo = function () {
    console.log("foo1")
}
foo()

var foo = function () {
    console.log("foo2")
}
foo()

js复制代码foo()
var foo = function () {
    console.log("foo1")
}

js复制代码var foo = function () {
    console.log("foo1")
}
foo()

var foo = function () {
    console.log("foo2")
}
foo()

js复制代码function foo() {
    console.log("foo1")
}
foo()

function foo() {
    console.log("foo2")
}
foo()

csharp复制代码@FunctionalInterface
public interface DragonSlayingStrategy {

  void execute();

}

csharp复制代码public class DragonSlayer {

  private DragonSlayingStrategy strategy;

  public DragonSlayer(DragonSlayingStrategy strategy) {
    this.strategy = strategy;
  }

  public void changeStrategy(DragonSlayingStrategy strategy) {
    this.strategy = strategy;
  }

  public void goToBattle() {
    strategy.execute();
  }
}

scss复制代码@Slf4j
public class LambdaStrategy {

  /**
   * Enum to demonstrate strategy pattern.
   */
  public enum Strategy implements DragonSlayingStrategy {
    MeleeStrategy(() -> LOGGER.info(
        "With your Excalibur you severe the dragon's head!")),
    ProjectileStrategy(() -> LOGGER.info(
        "You shoot the dragon with the magical crossbow and it falls dead on the ground!")),
    SpellStrategy(() -> LOGGER.info(
        "You cast the spell of disintegration and the dragon vaporizes in a pile of dust!"));

    private final DragonSlayingStrategy dragonSlayingStrategy;

    Strategy(DragonSlayingStrategy dragonSlayingStrategy) {
      this.dragonSlayingStrategy = dragonSlayingStrategy;
    }

    @Override
    public void execute() {
      dragonSlayingStrategy.execute();
    }
  }
}

typescript复制代码@Slf4j
public class MeleeStrategy implements DragonSlayingStrategy {

  @Override
  public void execute() {
    LOGGER.info("With your Excalibur you sever the dragon's head!");
  }
}

typescript复制代码@Slf4j
public class ProjectileStrategy implements DragonSlayingStrategy {

  @Override
  public void execute() {
    LOGGER.info("You shoot the dragon with the magical crossbow and it falls dead on the ground!");
  }
}

typescript复制代码@Slf4j
public class SpellStrategy implements DragonSlayingStrategy {

  @Override
  public void execute() {
    LOGGER.info("You cast the spell of disintegration and the dragon vaporizes in a pile of dust!");
  }

}

ini复制代码@Slf4j
public class App {

  private static final String RED_DRAGON_EMERGES = "Red dragon emerges.";
  private static final String GREEN_DRAGON_SPOTTED = "Green dragon spotted ahead!";
  private static final String BLACK_DRAGON_LANDS = "Black dragon lands before you.";

  /**
   * Program entry point.
   *
   * @param args command line args
   */
  public static void main(String[] args) {
    //GoF 策略模式
    LOGGER.info(GREEN_DRAGON_SPOTTED);
    var dragonSlayer = new DragonSlayer(new MeleeStrategy());
    dragonSlayer.goToBattle();
    LOGGER.info(RED_DRAGON_EMERGES);
    dragonSlayer.changeStrategy(new ProjectileStrategy());
    dragonSlayer.goToBattle();
    LOGGER.info(BLACK_DRAGON_LANDS);
    dragonSlayer.changeStrategy(new SpellStrategy());
    dragonSlayer.goToBattle();

    // Java 8 函数式实现策略模式
    LOGGER.info(GREEN_DRAGON_SPOTTED);
    dragonSlayer = new DragonSlayer(
        () -> LOGGER.info("With your Excalibur you severe the dragon's head!"));
    dragonSlayer.goToBattle();
    LOGGER.info(RED_DRAGON_EMERGES);
    dragonSlayer.changeStrategy(() -> LOGGER.info(
        "You shoot the dragon with the magical crossbow and it falls dead on the ground!"));
    dragonSlayer.goToBattle();
    LOGGER.info(BLACK_DRAGON_LANDS);
    dragonSlayer.changeStrategy(() -> LOGGER.info(
        "You cast the spell of disintegration and the dragon vaporizes in a pile of dust!"));
    dragonSlayer.goToBattle();

    // 具有枚举策略模式的 Java 8 lambda 实现
    LOGGER.info(GREEN_DRAGON_SPOTTED);
    dragonSlayer.changeStrategy(LambdaStrategy.Strategy.MeleeStrategy);
    dragonSlayer.goToBattle();
    LOGGER.info(RED_DRAGON_EMERGES);
    dragonSlayer.changeStrategy(LambdaStrategy.Strategy.ProjectileStrategy);
    dragonSlayer.goToBattle();
    LOGGER.info(BLACK_DRAGON_LANDS);
    dragonSlayer.changeStrategy(LambdaStrategy.Strategy.SpellStrategy);
    dragonSlayer.goToBattle();
  }
}

csharp复制代码@Slf4j
public abstract class StealingMethod {

  protected abstract String pickTarget();

  protected abstract void confuseTarget(String target);

  protected abstract void stealTheItem(String target);

  /**
   * Steal.
   */
  public final void steal() {
    var target = pickTarget();
    LOGGER.info("The target has been chosen as {}.", target);
    confuseTarget(target);
    stealTheItem(target);
  }
}

csharp复制代码public class HalflingThief {

  private StealingMethod method;

  public HalflingThief(StealingMethod method) {
    this.method = method;
  }

  public void steal() {
    method.steal();
  }

  public void changeMethod(StealingMethod method) {
    this.method = method;
  }
}

typescript复制代码@Slf4j
public class HitAndRunMethod extends StealingMethod {

  @Override
  protected String pickTarget() {
    return "old goblin woman";
  }

  @Override
  protected void confuseTarget(String target) {
    LOGGER.info("Approach the {} from behind.", target);
  }

  @Override
  protected void stealTheItem(String target) {
    LOGGER.info("Grab the handbag and run away fast!");
  }
}

typescript复制代码@Slf4j
public class SubtleMethod extends StealingMethod {

  @Override
  protected String pickTarget() {
    return "shop keeper";
  }

  @Override
  protected void confuseTarget(String target) {
    LOGGER.info("Approach the {} with tears running and hug him!", target);
  }

  @Override
  protected void stealTheItem(String target) {
    LOGGER.info("While in close contact grab the {}'s wallet.", target);
  }
}

typescript复制代码public class App {

 
  public static void main(String[] args) {
    var thief = new HalflingThief(new HitAndRunMethod());
    thief.steal();
    thief.changeMethod(new SubtleMethod());
    thief.steal();
  }
}

yaml复制代码--------- beginning of crash
06-07 01:53:32.465 12027 12027 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-07 01:53:32.465 12027 12027 F DEBUG : Revision: '0'
06-07 01:53:32.466 12027 12027 F DEBUG : ABI: 'arm64'
06-07 01:53:32.466 12027 12027 F DEBUG : Timestamp: 2022-06-07 01:53:32.033409857+0800
06-07 01:53:32.466 12027 12027 F DEBUG : Process uptime: 0s
06-07 01:53:32.466 12027 12027 F DEBUG : Cmdline: mediaserver64
06-07 01:53:32.466 12027 12027 F DEBUG : pid: 1139, tid: 11981, name: NPDecoder >>> mediaserver64 <<<
06-07 01:53:32.466 12027 12027 F DEBUG : uid: 1013
06-07 01:53:32.466 12027 12027 F DEBUG : tagged_addr_ctrl: 0000000000000001
06-07 01:53:32.466 12027 12027 F DEBUG : signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7c02d886f0
06-07 01:53:32.466 12027 12027 F DEBUG : x0 79748c5e568e2ddc x1 0000007ca13c3618 x2 0000000000000000 x3 0000007ca1291000
06-07 01:53:32.466 12027 12027 F DEBUG : x4 0000000001909705 x5 0000000000000000 x6 0000007c02d88808 x7 b60625655bf0252f
06-07 01:53:32.467 12027 12027 F DEBUG : x8 0000000000000080 x9 0000007ca126fed7 x10 0000000000000006 x11 0000007bfd0a81fc
06-07 01:53:32.467 12027 12027 F DEBUG : x12 9ef8a95ca9649dbe x13 e44782d5ac38720e x14 0000007bfd0a8030 x15 0000001e56307b5c
06-07 01:53:32.467 12027 12027 F DEBUG : x16 0000007c95dfdb70 x17 0000007c9844f118 x18 0000007bfaa28000 x19 b400007c13c246d0
06-07 01:53:32.467 12027 12027 F DEBUG : x20 0000007c02d88730 x21 b400007c13c67c00 x22 0000000000000415 x23 0000007c02d89000
06-07 01:53:32.467 12027 12027 F DEBUG : x24 0000000000000002 x25 b400007c13c246d0 x26 b400007c13c67c00 x27 0000007c02d89000
06-07 01:53:32.467 12027 12027 F DEBUG : x28 0000007ca13c2c28 x29 0000007c02d886f0
06-07 01:53:32.467 12027 12027 F DEBUG : lr 0000007c02d886f0 sp 0000007c02d886d0 pc 0000007c02d886f0 pst 0000000080001000
06-07 01:53:32.467 12027 12027 F DEBUG : backtrace:
06-07 01:53:32.467 12027 12027 F DEBUG : #00 pc 00000000000f86f0 [anon:stack_and_tls:11981]

yaml复制代码ABI: 'arm64' 【 arm64的程序 】
Timestamp: 2022-06-07 01:53:32.033409857+0800 【 发生错误的时间戳 】
Process uptime: 0s
Cmdline: mediaserver64 【 程序名 】
pid: 1139, tid: 11981, name: NPDecoder >>> mediaserver64 <<< 【 进程号、线程号 】
uid: 1013

ini复制代码signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7c02d886f0
【 错误类型是 SIGSEGV，子类是 SEGV_ACCERR，错误地址0x7c02d886f0 】
SIGSEGV 也是我们最常见的 Native Crash 类型，大部分时候我们称其为段错误，
而错误意思是在 PC=0x7c02d886f0 上发生拒绝访问的段错误。

复制代码x0 79748c5e568e2ddc x1 0000007ca13c3618 x2 0000000000000000 x3 0000007ca1291000
x4 0000000001909705 x5 0000000000000000 x6 0000007c02d88808 x7 b60625655bf0252f
x8 0000000000000080 x9 0000007ca126fed7 x10 0000000000000006 x11 0000007bfd0a81fc
x12 9ef8a95ca9649dbe x13 e44782d5ac38720e x14 0000007bfd0a8030 x15 0000001e56307b5c
x16 0000007c95dfdb70 x17 0000007c9844f118 x18 0000007bfaa28000 x19 b400007c13c246d0
x20 0000007c02d88730 x21 b400007c13c67c00 x22 0000000000000415 x23 0000007c02d89000
x24 0000000000000002 x25 b400007c13c246d0 x26 b400007c13c67c00 x27 0000007c02d89000
x28 0000007ca13c2c28 x29 0000007c02d886f0
lr 0000007c02d886f0 sp 0000007c02d886d0 pc 0000007c02d886f0 pst 0000000080001000

makefile复制代码backtrace:
#00 pc 00000000000f86f0 [anon:stack_and_tls:11981] 【PC刚好落在线程栈地址上】
这种情况很少见，虽然它只有的一条堆栈，并不代表程序是从这里开始运行，出现的这种情况仅仅 unwind 无法正确的回溯。
我们是可以通过栈地址空间内存进行恢复调用栈，用户态主线程栈（红色部分）结构如下：

ruby复制代码而线程栈位于 mmap segmemt上，我们可以在 /proc/self/maps 上找到该线程栈的地址空间范围。
0000007c'02c90000-0000007c'02d8bfff rw- 0 fc000 [anon:stack_and_tls:11981]
大多数 arm64 的 Linux Android 程序，它的线程调用栈结构样例如下：

erlang复制代码memory near x1 (/system/lib64/libstagefright.so):
0000007ca13c35f0 0000000000000000 0000000000000000 ................
0000007ca13c3600 0000000000000000 0000000000000000 ................
0000007ca13c3610 0000000000000000 0000007ca132326c ........l22.|...
0000007ca13c3620 0000007ca1324008 0000007ca10552e4 .@2.|....R..|...
0000007ca13c3630 0000007ca10552e8 0000007ca10552ec .R..|....R..|...
0000007ca13c3640 0000007ca10552f4 0000007ca132402c .R..|...,@2.|...
0000007ca13c3650 0000000000000000 0000000000000000 ................
0000007ca13c3660 0000000000000000 0000000000000000 ................
0000007ca13c3670 0000000000000000 0000007ca134ea84 ..........4.|...
0000007ca13c3680 0000007ca134ecec 0000007ca10552e4 ..4.|....R..|...
0000007ca13c3690 0000007ca10552e8 0000007ca10552ec .R..|....R..|...
0000007ca13c36a0 0000007ca10552f4 0000007ca134ed10 .R..|.....4.|...
0000007ca13c36b0 0000000000000000 0000000000000000 ................
0000007ca13c36c0 0000000000000000 0000000000000000 ................
0000007ca13c36d0 0000000000000000 0000007ca135d02c ........,.5.|...
0000007ca13c36e0 0000007ca135d4b8 0000007ca10552e4 ..5.|....R..|...

memory near x29 ([anon:stack_and_tls:11981]):
0000007c02d886d0 b400007c13c246d0 0000000001909705 .F..|……….. 【SP = 0x0000007c02d886d0】
0000007c02d886e0 0000007c02d88700 6f2ab3b40fa2f8ef ….|………*o*
0000007c02d886f0 0000007c02d88750 0000007ca133f8e0 P…|…..3.|…*【x29 = 0x0000007c02d886f0】
0000007c02d88700 0000000000000002 0000000000000000 …………….*
0000007c02d88710 0000000000000415 0000000001909705 …………….*
0000007c02d88720 0000000000000000 0000007c02d88808 …………|…*
0000007c02d88730 b400007c13c67c00 0000000000000000 .|..|………..*
0000007c02d88740 0000007c02d89000 6f2ab3b40fa2f8ef ….|………*o
0000007c02d88750 0000007c02d88830 0000007ca796ee7c 0…|…|…|…
0000007c02d88760 0000007ca79f3dd8 0000007ca79edb80 .=..|…….|…
0000007c02d88770 0000007c02d89000 b400007c13c04680 ….|….F..|…
0000007c02d88780 0000000000000000 0000000000000002 …………….
0000007c02d88790 b400007c13c67c00 0000000000000000 .|..|………..
0000007c02d887a0 0000000000000000 b400007c13c7c100 …………|…
0000007c02d887b0 0000007c02d88830 0000007ca796d420 0…|… …|…
0000007c02d887c0 0000007c02d88830 0000007ca796d460 0…|…`…|…

memory near lr ([anon:stack_and_tls:11981]):
0000007c02d886d0 b400007c13c246d0 0000000001909705 .F..|………..
0000007c02d886e0 0000007c02d88700 6f2ab3b40fa2f8ef ….|………*o*
0000007c02d886f0 0000007c02d88750 0000007ca133f8e0 P…|…..3.|…*
0000007c02d88700 0000000000000002 0000000000000000 …………….*
0000007c02d88710 0000000000000415 0000000001909705 …………….*
0000007c02d88720 0000000000000000 0000007c02d88808 …………|…*
0000007c02d88730 b400007c13c67c00 0000000000000000 .|..|………..*
0000007c02d88740 0000007c02d89000 6f2ab3b40fa2f8ef ….|………*o
0000007c02d88750 0000007c02d88830 0000007ca796ee7c 0…|…|…|…
0000007c02d88760 0000007ca79f3dd8 0000007ca79edb80 .=..|…….|…
0000007c02d88770 0000007c02d89000 b400007c13c04680 ….|….F..|…
0000007c02d88780 0000000000000000 0000000000000002 …………….
0000007c02d88790 b400007c13c67c00 0000000000000000 .|..|………..
0000007c02d887a0 0000000000000000 b400007c13c7c100 …………|…
0000007c02d887b0 0000007c02d88830 0000007ca796d420 0…|… …|…
0000007c02d887c0 0000007c02d88830 0000007ca796d460 0…|…`…|…

memory near sp ([anon:stack_and_tls:11981]):
0000007c02d886b0 0000000000000018 0000007caae98c58 ……..X…|…
0000007c02d886c0 0000007c02d886f0 0000007c95de6754 ….|…Tg..|…
0000007c02d886d0 b400007c13c246d0 0000000001909705 .F..|………..
0000007c02d886e0 0000007c02d88700 6f2ab3b40fa2f8ef ….|………*o*
0000007c02d886f0 0000007c02d88750 0000007ca133f8e0 P…|…..3.|…*
0000007c02d88700 0000000000000002 0000000000000000 …………….*
0000007c02d88710 0000000000000415 0000000001909705 …………….*
0000007c02d88720 0000000000000000 0000007c02d88808 …………|…*
0000007c02d88730 b400007c13c67c00 0000000000000000 .|..|………..*
0000007c02d88740 0000007c02d89000 6f2ab3b40fa2f8ef ….|………*o
0000007c02d88750 0000007c02d88830 0000007ca796ee7c 0…|…|…|…
0000007c02d88760 0000007ca79f3dd8 0000007ca79edb80 .=..|…….|…
0000007c02d88770 0000007c02d89000 b400007c13c04680 ….|….F..|…
0000007c02d88780 0000000000000000 0000000000000002 …………….
0000007c02d88790 b400007c13c67c00 0000000000000000 .|..|………..
0000007c02d887a0 0000000000000000 b400007c13c7c100 …………|…

memory near pc ([anon:stack_and_tls:11981]):
0000007c02d886d0 b400007c13c246d0 0000000001909705 .F..|………..
0000007c02d886e0 0000007c02d88700 6f2ab3b40fa2f8ef ….|………*o*
0000007c02d886f0 0000007c02d88750 0000007ca133f8e0 P…|…..3.|…*
0000007c02d88700 0000000000000002 0000000000000000 …………….*
0000007c02d88710 0000000000000415 0000000001909705 …………….*
0000007c02d88720 0000000000000000 0000007c02d88808 …………|…*
0000007c02d88730 b400007c13c67c00 0000000000000000 .|..|………..*
0000007c02d88740 0000007c02d89000 6f2ab3b40fa2f8ef ….|………*o
0000007c02d88750 0000007c02d88830 0000007ca796ee7c 0…|…|…|…
0000007c02d88760 0000007ca79f3dd8 0000007ca79edb80 .=..|…….|…
0000007c02d88770 0000007c02d89000 b400007c13c04680 ….|….F..|…
0000007c02d88780 0000000000000000 0000000000000002 …………….
0000007c02d88790 b400007c13c67c00 0000000000000000 .|..|………..
0000007c02d887a0 0000000000000000 b400007c13c7c100 …………|…
0000007c02d887b0 0000007c02d88830 0000007ca796d420 0…|… …|…
0000007c02d887c0 0000007c02d88830 0000007ca796d460 0…|…`…|…

bash复制代码memory map (1146 entries):
0000005f'fabc7000-0000005f'fabc7fff r-- 0 1000 /system/bin/mediaserver64
0000005f'fabc8000-0000005f'fabc9fff r-x 1000 2000 /system/bin/mediaserver64
0000005f'fabca000-0000005f'fabcafff r-- 3000 1000 /system/bin/mediaserver64
0000007b'e79a3000-0000007b'e7d93fff --- 0 3f1000

0000007c'a120e000-0000007c'a128efff r-- 0 81000 /system/lib64/libstagefright.so
0000007c'a128f000-0000007c'a13c0fff r-x 81000 132000 /system/lib64/libstagefright.so
0000007c'a13c1000-0000007c'a13cffff r-- 1b3000 f000 /system/lib64/libstagefright.so
0000007c'a13d0000-0000007c'a13d1fff rw- 1c1000 2000 /system/lib64/libstagefright.so

0000007c'a787c000-0000007c'a78f4fff r-- 0 79000 /system/lib64/libmediaplayerservice.so
0000007c'a78f5000-0000007c'a79ecfff r-x 79000 f8000 /system/lib64/libmediaplayerservice.so
0000007c'a79ed000-0000007c'a79f8fff r-- 171000 c000 /system/lib64/libmediaplayerservice.so
0000007c'a79f9000-0000007c'a79f9fff rw- 17c000 1000 /system/lib64/libmediaplayerservice.so

javascript复制代码open files:
fd 0: /dev/null (unowned)
fd 1: /dev/null (unowned)
fd 2: /dev/null (unowned)
fd 3: socket:[62562] (unowned)
fd 4: /dev/binderfs/binder (unowned)
fd 5: /dev/binderfs/hwbinder (unowned)
fd 6: /sys/kernel/tracing/trace_marker (unowned)
fd 7: /dev/ashmem4945d9b6-db30-413c-88c5-e50674f154c7 (unowned)
fd 8: /dmabuf: (unowned)
fd 9: /dev/ashmem4945d9b6-db30-413c-88c5-e50674f154c7 (unowned)
fd 10: /storage/emulated/0/zapya/folder/华语音乐/IN-K&王忻辰&苏星婕 - 落日与晚风.mp3 (owned by unique_fd 0x7c13c7a498)
fd 11: /dev/ashmem4945d9b6-db30-413c-88c5-e50674f154c7 (unowned)
...

bash复制代码# build/envsetup.sh
# coredump_setup - enable core dumps globally for any process
#                  that has the core-file-size limit set correctly
#
# NOTE: You must call also coredump_enable for a specific process
#       if its core-file-size limit is not set already.
# NOTE: Core dumps are written to ramdisk; they will not survive a reboot!

function coredump_setup()
{
    echo "Getting root...";
    adb root;
    adb wait-for-device;

    echo "Remounting root partition read-write...";
    adb shell mount -w -o remount -t rootfs rootfs;
    sleep 1;
    adb wait-for-device;
    adb shell mkdir -p /cores;
    adb shell mount -t tmpfs tmpfs /cores;
    adb shell chmod 0777 /cores;

    echo "Granting SELinux permission to dump in /cores...";
    adb shell restorecon -R /cores;

    echo "Set core pattern.";
    adb shell 'echo /cores/core.%p > /proc/sys/kernel/core_pattern';

    echo "Done."
}

# coredump_enable - enable core dumps for the specified process
# $1 = PID of process (e.g., $(pid mediaserver))
#
# NOTE: coredump_setup must have been called as well for a core
#       dump to actually be generated.

function coredump_enable()
{
    local PID=$1;
    if [ -z "$PID" ]; then
        printf "Expecting a PID!\n";
        return;
    fi;
    echo "Setting core limit for $PID to infinite...";
    adb shell /system/bin/ulimit -P $PID -c unlimited
}

bash复制代码adb wait-for-device
adb root
adb shell mkdir /data/cores
adb shell chmod 777 /data/cores
#adb shell setenforce 0
adb shell restorecon -R /data/cores
adb shell 'echo /data/cores/core.%e.%p > /proc/sys/kernel/core_pattern'
adb shell 'system/bin/ulimit -P `pidof system_server` -c unlimited'
#adb shell 'echo 2 > /proc/sys/fs/suid_dumpable'

kotlin复制代码adb wait-for-device
adb root
adb shell mkdir /data/data/com.android.settings/cores
adb shell chmod 777 /data/data/com.android.settings/cores
adb shell restorecon -R /data/data/com.android.settings/cores
adb shell 'echo /data/data/com.android.settings/cores/core.%e.%p > /proc/sys/kernel/core_pattern'
adb shell 'system/bin/ulimit -P `pidof com.android.settings` -c unlimited'
#adb shell 'echo 2 > /proc/sys/fs/suid_dumpable'

shell复制代码当我们在机器上验证对这个app进行kill -11模拟时
$ kill -11 `pidof com.android.settings`
$ ls /data/data/com.android.settings/cores/core.ndroid.settings.27946

bash复制代码$ ~/work/debug/gdb_arm64/gdb-12.1/output/bin/aarch64-linux-gdb
当我们没有符号表时，仅加载 core-file 也是可以使用的。
(gdb) core-file PROCESS_MINIDUMP
当我们有相应的符号表时，即可加载符号表目录
(gdb) set solib-search-path symbols/
或者
(gdb) set sysroot symbols/

makefile复制代码编译Android版本时带入环境变量如下：
$ export SANITIZE_TARGET=hwaddress
跳过某个模块，在相应模块下的Android.bp文件下添加内容如下：
sanitize: {
hwaddress: false,
address: false,
},

Android.mk则添加内容如下：
LOCAL_NOSANITIZE := hwaddress

APP构建支持HWASAN则在Application.mk下添加内容如下：
APP_STL := c++_shared
APP_CFLAGS := -fsanitize=hwaddress -fno-omit-frame-pointer
APP_LDFLAGS := -fsanitize=hwaddress

arduino复制代码#include <stdio.h>
class A {
public:
    virtual ~A() = default;
    virtual void foo() {
        printf("A:%ld\n", a);
    }

    long a;
};

class B {
public:
    virtual ~B() = default;
    virtual void foo() {
        printf("B:%ld\n", b);
    }

    long b;
};

int main(int /*argc*/, char** /*argv[]*/) {
    A *a = new A();
    A *a_bak = a;
    a->a = 1000L;
    printf("A ptr = %p\n", a);
    delete a; // 此时a指针已经被free掉，那么指针a_bak是个野指针
    B *b = new B();
    printf("B ptr = %p\n", b);
    b->b = 2000L;
    b->foo();
    a_bak->foo(); // 此处程序会运行怎么结果
    delete b;
    return 0;
}

ini复制代码# ./data/Tester64
A ptr = 0xb400007690205010
B ptr = 0xb400007690205010
B:2000
B:2000

arduino复制代码#include <stdio.h>
class A {
public:
    long bad;
    long a;
};

class B {
    public:
    virtual ~B() = default;
    virtual void foo() {
        b = 2000L;
        printf("B:%ld\n", b);
    }

    long b;
};

int main(int /*argc*/, char** /*argv[]*/) {
    A *a = new A();
    A *a_bak = a;
    printf("A ptr = %p\n", a);
    delete a;
    B *b = new B();
    printf("B ptr = %p\n", b);
    a_bak->bad = 0x20L;
    b->foo();
    delete b;
    return 0;
}

yaml复制代码Timestamp: 2022-07-06 14:47:50.925654058+0800
Process uptime: 0s
Cmdline: ./data/Tester64
pid: 12652, tid: 12652, name: Tester64 >>> ./data/Tester64 <<<
uid: 0
tagged_addr_ctrl: 0000000000000001
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x28
Cause: null pointer dereference
x0 b40000762f005010 x1 b40000762f01b000 x2 0000000000000007 x3 ffffffffffffffff
x4 ffffffffffffffff x5 0000000040100401 x6 b40000762f01b006 x7 3637303030303462
x8 0000000000000020 x9 a454ef76eb4317d3 x10 0000000000004001 x11 0000000000000000
x12 0000000000000000 x13 0000000000000002 x14 0000000000000010 x15 0000000000000010
x16 000000762f5a0c58 x17 000000762f5910d4 x18 000000763745c000 x19 b40000762f005010
x20 b40000762f005010 x21 0000007fe173d378 x22 0000000000000001 x23 0000000000000000
x24 0000000000000000 x25 0000000000000000 x26 0000000000000000 x27 0000000000000000
x28 0000000000000000 x29 0000007fe173d2e0
lr 0000005ac14600c8 sp 0000007fe173d2e0 pc 0000005ac14600d0 pst 0000000060001000

backtrace:
#00 pc 00000000000010d0 /data/Tester64 (main+124)
#01 pc 000000000008436c /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+100)

arduino复制代码#include <stdio.h>
class A {
public:
    void *bad;
    long a;
};

class B {
public:
    virtual ~B() {
        printf("delete B\n");
    }
    
    virtual void foo() {
        b = 2000L;
        printf("B:%ld\n", b);
    }

    long b;
};

void func1() {
    printf("Hello !!\n");
}

void func2() {
    printf("GoGoGo !!\n");
}

int main(int /*argc*/, char** /*argv[]*/) {
    A *a = new A();
    A *a_bak = a;
    printf("A ptr = %p\n", a);
    delete a;
    B *b = new B();
    printf("B ptr = %p\n", b);
    
    long *data = new long[4] {0x0L, (long)func2, (long)func1, 0x0L};
    a_bak->bad = data;
    
    printf("Test .. \n");
    b->foo();
    delete b;
    printf("Done.\n");
    return 0;
}

ini复制代码# ./data/Tester64
A ptr = 0xb400007ce9605010
B ptr = 0xb400007ce9605010
Test ..
Hello !!
GoGoGo !!
Done.

arduino复制代码#include <stdio.h>
class A {
public:
    long a = 0x55AA;
    long b = 0xDEAD;
};

int main(int /*argc*/, char** /*argv[]*/) {
    long *b = new long[2] {0x0L, 0x1L};
    A *a = new A();
    printf("A:%p\n", a);
    printf("B:%p\n", b);
    b[2] = 0xDEAD;
    printf("B2:%p\n", &b[2]);
    printf("0x%lx-0x%lx\n", a->a, a->b);
    return 0;
}

makefile复制代码# ./data/Tester64
A:0xb400007fa7c05020
B:0xb400007fa7c05010
B2:0xb400007fa7c05020
0xdead-0xdead

bash复制代码signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x40
Cause: null pointer dereference
x0 0000000000000020 x1 b400007bf95f0e00 x2 63692f6863726165 x3 0000000000000008
x4 b400007bf95f0e74 x5 b400007bf8ea36f4 x6 656863732f676e69 x7 732f7269645f616d
x8 db4cf552ad46f717 x9 0000000000000001 x10 00000000000349e0 x11 0000007bc0000000
x12 0000000000000000 x13 0000000000034960 x14 b400007b58d7c4c0 x15 00000000374d2457
x16 0000007ca3543d50 x17 0000007ca35338ec x18 0000007b38c74000 x19 0000000000000020
x20 0000000000000000 x21 0000007b548e9000 x22 0000007b548e9000 x23 b400007bf946ffd0
x24 0000007b548e76c0 x25 0000007b548e9000 x26 0000007b548e7b30 x27 0000007b548e7b18
x28 0000007b548e7a10 x29 0000007b548e7410
lr 0000007a8e4e7980 sp 0000007b548e73e0 pc 0000007a8e4d0e00 pst 0000000060001000

memory near pc (/apex/com.android.appsearch/lib64/libicing.so):
0000007a8e4d0de0 a90557f6f90023f7 9100c3fda9064ff4 .#…W…O……
0000007a8e4d0df0 f94016c8d53bd056 f81f83a8aa0003f3 V.;…@………
0000007a8e4d0e00 350001c839408008 91181c42b0fffde2 ..@9…5….B…
0000007a8e4d0e10 2a1f03e1910023e0 910023f452808ee3 .#…..*…R.#..*
0000007a8e4d0e20 910022809400d695 912b742190fffde1 ….."……!t+.*

复制代码.inst 0xf90023f7
.inst 0xa90557f6
.inst 0xa9064ff4
.inst 0x9100c3fd
.inst 0xd53bd056
.inst 0xf94016c8
.inst 0xaa0003f3
.inst 0xf81f83a8
.inst 0x39408008
.inst 0x350001c8
.inst 0xb0fffde2
.inst 0x91181c42
.inst 0x910023e0
.inst 0x2a1f03e1
.inst 0x52808ee3
.inst 0x910023f4
.inst 0x9400d695
.inst 0x91002280
.inst 0x90fffde1
.inst 0x912b7421

yaml复制代码编译：aarch64-linux-android-as code.S -o code.o
反汇编：aarch64-linux-android-objdump -d code.o

code.o: file format elf64-littleaarch64
Disassembly of section .text:
0000000000000000 <.text>:
0: f90023f7 str x23, [sp, #64]
4: a90557f6 stp x22, x21, [sp, #80]
8: a9064ff4 stp x20, x19, [sp, #96]
c: 9100c3fd add x29, sp, #0x30
10: d53bd056 mrs x22, tpidr_el0
14: f94016c8 ldr x8, [x22, #40]
18: aa0003f3 mov x19, x0
1c: f81f83a8 stur x8, [x29, #-8]
20: 39408008 ldrb w8, [x0, #32]
24: 350001c8 cbnz w8, 5c <.text+0x5c>
28: b0fffde2 adrp x2, fffffffffffbd000 <.text+0xfffffffffffbd000>
2c: 91181c42 add x2, x2, #0x607
30: 910023e0 add x0, sp, #0x8
34: 2a1f03e1 mov w1, wzr
38: 52808ee3 mov w3, #0x477 // #1143
3c: 910023f4 add x20, sp, #0x8
40: 9400d695 bl 35a94 <.text+0x35a94>
44: 91002280 add x0, x20, #0x8
48: 90fffde1 adrp x1, fffffffffffbc000 <.text+0xfffffffffffbc000>
4c: 912b7421 add x1, x1, #0xadd

由于x0=0x0000000000000020，因此在指令0x39408008( ldrb w8, [x0, #32])，会发生读取内存0x40的段错误。

python复制代码str x30, [sp, #-16]!
str x29, [sp, #-16]!

python复制代码编译：aarch64-linux-android-as code_asm.S -o code_asm.o
反汇编：aarch64-linux-android-objdump -d code_asm.o

code_asm.o: file format elf64-littleaarch64
Disassembly of section .text:
0000000000000000 <.text>:
0: f81f0ffe str x30, [sp, #-16]!
4: f81f0ffd str x29, [sp, #-16]!