重学Android——基于Android9.0的Activity启动流程-白红宇

Activity系统的启动

首先总结了解一下Android系统的启动：

启动电源以及系统启动

引导程序BootLoader——BootLoader是android操作系统开始运行前的一个小程序，它的主要功能就是把系统os拉起来并运行

Linux内核启动——在内核启动后，会在系统文件中找到init.rc文件，并启动init进程

init进程启动——初始化和启动属性服务，并启动zygote进程

Zygote进程启动——创建java虚拟机并为java虚拟机注册jni方法，创建服务端socket，启动systemServer进程

SystemServer进程启动——启动Binder线程池和systemServerManager，并启动各种服务

Launcher启动——将SystemServer进程启动的AMS会启动Launcher，Launcher启动后把已安装的应用的快捷图标显示到界面上。

根Activity的启动过程（API28）

Activity启动可以分成三个阶段分析：

Launcher--AMS

AMS--ApplicationThread（是ActivityThread的内部类）

ActivityThread--启动Activity

Launcher--AMS

看到Lacucher的源码可以下载下源码，也可以在线阅读，

public class Launcher extends BaseDraggingActivity implements LauncherExterns,        LauncherModel.Callbacks, LauncherProviderChangeListener, UserEventDelegate{      ...	public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {        boolean success = super.startActivitySafely(v, intent, item);        if (success && v instanceof BubbleTextView) {            // This is set to the view that launched the activity that navigated the user away            // from launcher. Since there is no callback for when the activity has finished            // launching, enable the press state and keep this reference to reset the press            // state when we return to launcher.            BubbleTextView btv = (BubbleTextView) v;            btv.setStayPressed(true);            setOnResumeCallback(btv);        }        return success;    }     ...       }复制代码

可以看到，直接就是调用了父类的startActivitySafely方法

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {        ...        // Prepare intent        // 这样根Activity就在新的栈中启动了        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);        if (v != null) {            intent.setSourceBounds(getViewBounds(v));        }        try {            boolean isShortcut = Utilities.ATLEAST_MARSHMALLOW                    && (item instanceof ShortcutInfo)                    && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT                    || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT)                    && !((ShortcutInfo) item).isPromise();            if (isShortcut) {                // Shortcuts need some special checks due to legacy reasons.                startShortcutIntentSafely(intent, optsBundle, item);            } else if (user == null || user.equals(Process.myUserHandle())) {                // Could be launching some bookkeeping activity                // 从这启动Activity                startActivity(intent, optsBundle);            } else {                LauncherAppsCompat.getInstance(this).startActivityForProfile(                        intent.getComponent(), user, intent.getSourceBounds(), optsBundle);            }            getUserEventDispatcher().logAppLaunch(v, intent);            return true;        } catch (ActivityNotFoundException|SecurityException e) {            Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();            Log.e(TAG, "Unable to launch. tag=" + item + " intent=" + intent, e);        }        return false;    }复制代码

可以看到launcher里最后就是调用了startActivity，而

public abstract class BaseDraggingActivity extends BaseActivity        implements WallpaperColorInfo.OnChangeListener{        ...        }public abstract class BaseActivity extends Activity implements UserEventDelegate{}复制代码

可以看到，launcher其实最终就是继承的Activity，然后调用了Activity的startActivity方法。

@Override    public void startActivity(Intent intent, @Nullable Bundle options) {        if (options != null) {            startActivityForResult(intent, -1, options);        } else {            // Note we want to go through this call for compatibility with            // applications that may have overridden the method.            startActivityForResult(intent, -1);        }    }复制代码

在startActivity方法中又调用了startActivityForResult方法，其实requestCode参数传入-1表现不关心启动结果

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,            @Nullable Bundle options) {        if (mParent == null) {            options = transferSpringboardActivityOptions(options);            Instrumentation.ActivityResult ar =                mInstrumentation.execStartActivity(                    this, mMainThread.getApplicationThread(), mToken, this,                    intent, requestCode, options);                        ...        } else {            ...        }    }复制代码

我们只需要关心mParent==null的逻辑就行，因为mParent代表定义是Activity mParent;,表示当前Activity的父类，因为此时创建的就是根Activity，因此mParent==null。接着就调用了mInstrumentation.execStartActivity。需要注意的是，下面其中一个参数mMainThread.getApplicationThread()，它的类型是ApplicationThread，是ActivityThread的内部类，在启动过程中发挥着巨大作用。

再继续看Instrumentation类

public ActivityResult execStartActivity(            Context who, IBinder contextThread, IBinder token, Activity target,            Intent intent, int requestCode, Bundle options) {        ...        try {            intent.migrateExtraStreamToClipData();            intent.prepareToLeaveProcess(who);                        //关键代码            int result = ActivityManager.getService()                .startActivity(whoThread, who.getBasePackageName(), intent,                        intent.resolveTypeIfNeeded(who.getContentResolver()),                        token, target != null ? target.mEmbeddedID : null,                        requestCode, 0, null, options);            checkStartActivityResult(result, intent);        } catch (RemoteException e) {            throw new RuntimeException("Failure from system", e);        }        return null;    }	//ActivityManager.java    public static IActivityManager getService() {        return IActivityManagerSingleton.get();    }    private static final Singleton
    
      IActivityManagerSingleton =            new Singleton
     
      () {                @Override                protected IActivityManager create() {                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);                    final IActivityManager am = IActivityManager.Stub.asInterface(b);                    return am;                }            };复制代码

从上面代码可以看出，启动Activity真正的实现是由ActivityManager.getService()的startActivity方法来完成的，这和android8.0之前是有区别的

在Android8.0之前，ActivityManagerNative.getDefault().startActivity来完成，通过getDefault来获取到AMS的代理对象，用AMS的代理对象ActivityManagerProxy来与AMS跨进程通信。

8.0之后，这个逻辑封装到了ActivityManager中，通过AIDL跨进程通信，使用IActivityManager，它是AMS的本地代理。

public class ActivityManagerService extends IActivityManager.Stub        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {        ...}复制代码

至此，从桌面点击的流程如下：

Launcher调用startActivitySafely方法-->BaseDraggingActivity.startActivity-->Activity.startActivityForResult-->execStartAcitivty-->Instrumentation的startActivity-->IActivityManager的startActivity-->AMS

AMS--ApplicationThread

由前文，启动流程已经到了AMS（ActivityManegerService），现在看它的startActivity方法

@Override    public final int startActivity(IApplicationThread caller, String callingPackage,            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {        return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,                resultWho, requestCode, startFlags, profilerInfo, bOptions,                UserHandle.getCallingUserId());    }复制代码

这个方法内部又调用了startActivityAsUser的重载方法，多了一个参数UserHandle.getCallingUserId()，获取当前用户id。

@Override    public final int startActivityAsUser(IApplicationThread caller, String callingPackage,            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {        return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,                resultWho, requestCode, startFlags, profilerInfo, bOptions, userId,                true /*validateIncomingUser*/);    }    public final int startActivityAsUser(IApplicationThread caller, String callingPackage,            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,            boolean validateIncomingUser) {        //判断进程隔离        enforceNotIsolatedCaller("startActivity");        //检查调用者权限        userId = mActivityStartController.checkTargetUser(userId, validateIncomingUser,                Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");        // TODO: Switch to user app stacks here.        // 这里切换为用户应用程序堆栈        return mActivityStartController.obtainStarter(intent, "startActivityAsUser")                .setCaller(caller)                .setCallingPackage(callingPackage)                .setResolvedType(resolvedType)                .setResultTo(resultTo)                .setResultWho(resultWho)                .setRequestCode(requestCode)                .setStartFlags(startFlags)                .setProfilerInfo(profilerInfo)                .setActivityOptions(bOptions)                .setMayWait(userId)                .execute();    }复制代码

可以看到，最后会调用到ActivityStartController.obtainStarter方法

/** * Controller for delegating activity launches. * * This class' main objective is to take external activity start requests and prepare them into * a series of discrete activity launches that can be handled by an {
    @link ActivityStarter}. It is * also responsible for handling logic that happens around an activity launch, but doesn't * necessarily influence the activity start. Examples include power hint management, processing * through the pending activity list, and recording home activity launches. */public class ActivityStartController {    	ActivityStarter obtainStarter(Intent intent, String reason) {        return mFactory.obtain().setIntent(intent).setReason(reason);    }}复制代码

这个ActivityStartController是干什么的呢，注释的大意就是：以委托的方式处理启动Activity，对ActivityStarter类进行处理，可以不影响启动结果，只负责间接传递处理，说白了就是一个间接类，在ActivityStarter与AMS中多加了一层。

可以看到，最后交由ActivityStarter类来执行，专门把Intent、flag转进Activity，同时把Activity的任务栈关联起来，最后执行.executer()方法

/** * Controller for interpreting how and then launching an activity. * * This class collects all the logic for determining how an intent and flags should be turned into * an activity and associated task and stack. */class ActivityStarter {        int execute() {        try {            // TODO(b/64750076): Look into passing request directly to these methods to allow            // for transactional diffs and preprocessing.            if (mRequest.mayWait) {                return startActivityMayWait(mRequest.caller, mRequest.callingUid,                        mRequest.callingPackage, mRequest.intent, mRequest.resolvedType,                        mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,                        mRequest.resultWho, mRequest.requestCode, mRequest.startFlags,                        mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig,                        mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId,                        mRequest.inTask, mRequest.reason,                        mRequest.allowPendingRemoteAnimationRegistryLookup);            } else {                return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,                        mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,                        mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,                        mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,                        mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,                        mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,                        mRequest.ignoreTargetSecurity, mRequest.componentSpecified,                        mRequest.outActivity, mRequest.inTask, mRequest.reason,                        mRequest.allowPendingRemoteAnimationRegistryLookup);            }        } finally {            onExecutionComplete();        }    }}复制代码

if条件语句中mRequest.mayWait布尔值的判断，我们再回顾上文，链式调用.setMayWait(userId).execute();我们直接只看了execute，接下来看下上面的setMayWait方法

ActivityStarter setMayWait(int userId) {        mRequest.mayWait = true;        mRequest.userId = userId;        return this;    }复制代码

可以知道，在execute方法中，if条件语句是满足的，执行startActivityMayWait方法，这个方法长得口怕，只看我们关心的部分。

private int startActivityMayWait(IApplicationThread caller, int callingUid,            String callingPackage, Intent intent, String resolvedType,            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,            IBinder resultTo, String resultWho, int requestCode, int startFlags,            ProfilerInfo profilerInfo, WaitResult outResult,            Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,            int userId, TaskRecord inTask, String reason,            boolean allowPendingRemoteAnimationRegistryLookup) {        // Refuse possible leaked file descriptors        if (intent != null && intent.hasFileDescriptors()) {            throw new IllegalArgumentException("File descriptors passed in Intent");        }        mSupervisor.getActivityMetricsLogger().notifyActivityLaunching();        boolean componentSpecified = intent.getComponent() != null;        final int realCallingPid = Binder.getCallingPid();        final int realCallingUid = Binder.getCallingUid();		    	...        //解析Intent数据        ResolveInfo rInfo = mSupervisor.resolveIntent(intent, resolvedType, userId,                0 /* matchFlags */,                        computeResolveFilterUid(                                callingUid, realCallingUid, mRequest.filterCallingUid));        ...        // Collect information about the target of the Intent.        ActivityInfo aInfo = mSupervisor.resolveActivity(intent, rInfo, startFlags, profilerInfo);        ...			            //用于记录Activity的数据            final ActivityRecord[] outRecord = new ActivityRecord[1];        		//启动Activity            int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,                    voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,                    callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,                    ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,                    allowPendingRemoteAnimationRegistryLookup);            ...    }复制代码

可以看到内部调用了startActivity方法

private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,            SafeActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,            ActivityRecord[] outActivity, TaskRecord inTask, String reason,            boolean allowPendingRemoteAnimationRegistryLookup) {        if (TextUtils.isEmpty(reason)) {            throw new IllegalArgumentException("Need to specify a reason.");        }        mLastStartReason = reason;        mLastStartActivityTimeMs = System.currentTimeMillis();        mLastStartActivityRecord[0] = null;        //又在此调用startActivity的重载方法        mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,                aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,                callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,                options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,                inTask, allowPendingRemoteAnimationRegistryLookup);        if (outActivity != null) {            // mLastStartActivityRecord[0] is set in the call to startActivity above.            outActivity[0] = mLastStartActivityRecord[0];        }        return getExternalResult(mLastStartActivityResult);    }复制代码

又在此继续调用重载方法

private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,            SafeActivityOptions options,            boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity,            TaskRecord inTask, boolean allowPendingRemoteAnimationRegistryLookup) {        int err = ActivityManager.START_SUCCESS;        // Pull the optional Ephemeral Installer-only bundle out of the options early.        final Bundle verificationBundle                = options != null ? options.popAppVerificationBundle() : null;        ProcessRecord callerApp = null;                ...        //检查启动Activity的权限        boolean abort = !mSupervisor.checkStartAnyActivityPermission(intent, aInfo, resultWho,                requestCode, callingPid, callingUid, callingPackage, ignoreTargetSecurity,                inTask != null, callerApp, resultRecord, resultStack);        abort |= !mService.mIntentFirewall.checkStartActivity(intent, callingUid,                callingPid, resolvedType, aInfo.applicationInfo);                ...                if (mService.mDidAppSwitch) {            // This is the second allowed switch since we stopped switches,            // so now just generally allow switches.  Use case: user presses            // home (switches disabled, switch to home, mDidAppSwitch now true);            // user taps a home icon (coming from home so allowed, we hit here            // and now allow anyone to switch again).            mService.mAppSwitchesAllowedTime = 0;        } else {            mService.mDidAppSwitch = true;        }        mController.doPendingActivityLaunches(false);        //继续调用        return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags,                true /* doResume */, checkedOptions, inTask, outActivity);    }复制代码

在最后的返回时候，还是执行了另一个startActivity方法，直接点击：

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,                IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,                int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,                ActivityRecord[] outActivity) {        int result = START_CANCELED;        try {            mService.mWindowManager.deferSurfaceLayout();            //关键地方            result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,                    startFlags, doResume, options, inTask, outActivity);        } finally {            // If we are not able to proceed, disassociate the activity from the task. Leaving an            // activity in an incomplete state can lead to issues, such as performing operations            // without a window container.            //获取Activity任务栈            final ActivityStack stack = mStartActivity.getStack();            if (!ActivityManager.isStartResultSuccessful(result) && stack != null) {                stack.finishActivityLocked(mStartActivity, RESULT_CANCELED,                        null /* intentResultData */, "startActivity", true /* oomAdj */);            }            mService.mWindowManager.continueSurfaceLayout();        }        postStartActivityProcessing(r, result, mTargetStack);        return result;    }复制代码

可以看到，在这个startActivity方法中，终于不是再调用的startActivity方法了（再这样我要疯了），继续看startActivityUnchecked

// Note: This method should only be called from {@link startActivity}.	private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,            int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,            ActivityRecord[] outActivity) {        setInitialState(r, options, inTask, doResume, startFlags, sourceRecord, voiceSession,                voiceInteractor);        //处理Activity的启动模式        computeLaunchingTaskFlags();        computeSourceStack();        mIntent.setFlags(mLaunchFlags);        ...                    int result = START_SUCCESS;        //在前面启动根Activity时，会将Intent的Flag设置为FLAG_ACTIVITY_NEW_TASK，所以这个if语句是成立的        if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask                && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {            newTask = true;            //创建新的TaskRecord            result = setTaskFromReuseOrCreateNewTask(taskToAffiliate, topStack);        } else if (mSourceRecord != null) {            result = setTaskFromSourceRecord();        } else if (mInTask != null) {            result = setTaskFromInTask();        } else {            // This not being started from an existing activity, and not part of a new task...            // just put it in the top task, though these days this case should never happen.            setTaskToCurrentTopOrCreateNewTask();        }        ...                    //根据Activity的启动模式来判断是直接插入已存在的栈顶还是新的栈        mTargetStack.startActivityLocked(mStartActivity, topFocused, newTask, mKeepCurTransition,                mOptions);        if (mDoResume) {            final ActivityRecord topTaskActivity =                    mStartActivity.getTask().topRunningActivityLocked();            if (!mTargetStack.isFocusable()                    || (topTaskActivity != null && topTaskActivity.mTaskOverlay                    && mStartActivity != topTaskActivity)) {                // If the activity is not focusable, we can't resume it, but still would like to                // make sure it becomes visible as it starts (this will also trigger entry                // animation). An example of this are PIP activities.                // Also, we don't want to resume activities in a task that currently has an overlay                // as the starting activity just needs to be in the visible paused state until the                // over is removed.                mTargetStack.ensureActivitiesVisibleLocked(null, 0, !PRESERVE_WINDOWS);                // Go ahead and tell window manager to execute app transition for this activity                // since the app transition will not be triggered through the resume channel.                mService.mWindowManager.executeAppTransition();            } else {                // If the target stack was not previously focusable (previous top running activity                // on that stack was not visible) then any prior calls to move the stack to the                // will not update the focused stack.  If starting the new activity now allows the                // task stack to be focusable, then ensure that we now update the focused stack                // accordingly.                if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {                    mTargetStack.moveToFront("startActivityUnchecked");                }                //关键地方                mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,                        mOptions);            }        } else if (mStartActivity != null) {            mSupervisor.mRecentTasks.add(mStartActivity.getTask());        }        mSupervisor.updateUserStackLocked(mStartActivity.userId, mTargetStack);        mSupervisor.handleNonResizableTaskIfNeeded(mStartActivity.getTask(), preferredWindowingMode,                preferredLaunchDisplayId, mTargetStack);        return START_SUCCESS;    }复制代码

上面在关键的地方已经做了注释，startActivityUnchecked方法主要处理与栈字处理相关的逻辑，因为我们在根启动Activity的时候会设置FLAG为FLAG_ACTIVITY_NEW_TASK，这样就会在使用setTaskFromReuseOrCreateNewTask方法，其内部会创建一个新的TaskRecord，用来描述一个Activity的任务栈。

最后会调用ActivityStackSupervisor的resumeFocusedStackTopActivityLocked方法。

boolean resumeFocusedStackTopActivityLocked(            ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {        if (!readyToResume()) {            return false;        }        if (targetStack != null && isFocusedStack(targetStack)) {            return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);        }        final ActivityRecord r = mFocusedStack.topRunningActivityLocked();        if (r == null || !r.isState(RESUMED)) {            mFocusedStack.resumeTopActivityUncheckedLocked(null, null);        } else if (r.isState(RESUMED)) {            // Kick off any lingering app transitions form the MoveTaskToFront operation.            mFocusedStack.executeAppTransition(targetOptions);        }        return false;    }复制代码

根据传过来的参数可知，targetStack不为null，而且isFocusedStack(targetStack)判断也为true，所以判断条件为true，进入执行resumeTopActivityUncheckedLocked方法，ActivityStack 是负责管理将要启动的Activity所处于的任务栈,继续进入到 ActivityStack 类中的resumeTopActivityUncheckedLocked方法

@GuardedBy("mService")    boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {        if (mStackSupervisor.inResumeTopActivity) {            // Don't even start recursing.            return false;        }        boolean result = false;        try {            // Protect against recursion.            mStackSupervisor.inResumeTopActivity = true;            result = resumeTopActivityInnerLocked(prev, options);            // When resuming the top activity, it may be necessary to pause the top activity (for            // example, returning to the lock screen. We suppress the normal pause logic in            // {@link #resumeTopActivityUncheckedLocked}, since the top activity is resumed at the            // end. We call the {@link ActivityStackSupervisor#checkReadyForSleepLocked} again here            // to ensure any necessary pause logic occurs. In the case where the Activity will be            // shown regardless of the lock screen, the call to            // {@link ActivityStackSupervisor#checkReadyForSleepLocked} is skipped.            final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);            if (next == null || !next.canTurnScreenOn()) {                checkReadyForSleep();            }        } finally {            mStackSupervisor.inResumeTopActivity = false;        }        return result;    }复制代码

调用了resumeTopActivityInnerLocked方法

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {        if (!mService.mBooting && !mService.mBooted) {            // Not ready yet!            return false;        }        // Find the next top-most activity to resume in this stack that is not finishing and is        // focusable. If it is not focusable, we will fall into the case below to resume the        // top activity in the next focusable task.        final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);          ......         mStackSupervisor.startSpecificActivityLocked(next, true, false);     //注释1          ......复制代码

这方法代码贼长，我们只关心调用链即可，再次调用了ActivityStackSupervisor 的方法，继续看startSpecificActivityLocked

void startSpecificActivityLocked(ActivityRecord r,            boolean andResume, boolean checkConfig) {        // Is this activity's application already running?        //获取即将启动的Activity的所在的应用进程        ProcessRecord app = mService.getProcessRecordLocked(r.processName,                r.info.applicationInfo.uid, true);        getLaunchTimeTracker().setLaunchTime(r);        if (app != null && app.thread != null) {            try {                if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0                        || !"android".equals(r.info.packageName)) {                    // Don't add this if it is a platform component that is marked                    // to run in multiple processes, because this is actually                    // part of the framework so doesn't make sense to track as a                    // separate apk in the process.                    app.addPackage(r.info.packageName, r.info.applicationInfo.longVersionCode,                            mService.mProcessStats);                }                                //                realStartActivityLocked(r, app, andResume, checkConfig);                return;            } catch (RemoteException e) {                Slog.w(TAG, "Exception when starting activity "                        + r.intent.getComponent().flattenToShortString(), e);            }            // If a dead object exception was thrown -- fall through to            // restart the application.        }        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,                "activity", r.intent.getComponent(), false, false, true);    }复制代码

在这里，调用realStartActivityLocked方法，此app就是上面获取的ProcessRecord。

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,            boolean andResume, boolean checkConfig) throws RemoteException {        if (!allPausedActivitiesComplete()) {            // While there are activities pausing we skipping starting any new activities until            // pauses are complete. NOTE: that we also do this for activities that are starting in            // the paused state because they will first be resumed then paused on the client side.            if (DEBUG_SWITCH || DEBUG_PAUSE || DEBUG_STATES) Slog.v(TAG_PAUSE,                    "realStartActivityLocked: Skipping start of r=" + r                    + " some activities pausing...");            return false;        }        ...                // Create activity launch transaction.                final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,                        r.appToken);                clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),                        System.identityHashCode(r), r.info,                        // TODO: Have this take the merged configuration instead of separate global                        // and override configs.                        mergedConfiguration.getGlobalConfiguration(),                        mergedConfiguration.getOverrideConfiguration(), r.compat,                        r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,                        r.persistentState, results, newIntents, mService.isNextTransitionForward(),                        profilerInfo));                // Set desired final state.                final ActivityLifecycleItem lifecycleItem;                if (andResume) {                    lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());                } else {                    lifecycleItem = PauseActivityItem.obtain();                }                clientTransaction.setLifecycleStateRequest(lifecycleItem);                // Schedule transaction.                mService.getLifecycleManager().scheduleTransaction(clientTransaction);                ...    }复制代码

9.0相对于其他版本最大的改动，就是这里了，先看一下8.0的代码是怎么样的

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,           boolean andResume, boolean checkConfig) throws RemoteException {       if (!allPausedActivitiesComplete()) {           // While there are activities pausing we skipping starting any new activities until           // pauses are complete. NOTE: that we also do this for activities that are starting in           // the paused state because they will first be resumed then paused on the client side.           if (DEBUG_SWITCH || DEBUG_PAUSE || DEBUG_STATES) Slog.v(TAG_PAUSE,                   "realStartActivityLocked: Skipping start of r=" + r                   + " some activities pausing...");            return false;        }       ......        app.thread.scheduleLaunchActivity(new Intent(r.intent), r.appToken,                   System.identityHashCode(r), r.info,                   // TODO: Have this take the merged configuration instead of separate global and                   // override configs.                   mergedConfiguration.getGlobalConfiguration(),                    mergedConfiguration.getOverrideConfiguration(), r.compat,                    r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,                    r.persistentState, results, newIntents, !andResume,                    mService.isNextTransitionForward(), profilerInfo);        ......复制代码

通过对比9.0与8.0的代码，可以发现9.0是通过事务机制来启动Activity的，而以前都是通过主线程，直接app.thread.scheduleLaunchActivity调度执行，这是最大的差别

先来看9.0的代码，我们通过ClientTranSaction来管理了Activity的启动过程，包含了客户端app的的一系列消息，可以对这些消息做出反应回调，并发送给客户端，让客户端也就是app去执行回调,完成具体的消息执行和整个生命周期的调度执行。接着，先看 scheduleTransaction 方法执行，是ClientLifecycleManager 的一个方法：

/**     * Schedule a transaction, which may consist of multiple callbacks and a lifecycle request.     * @param transaction A sequence of client transaction items.     * @throws RemoteException     *     * @see ClientTransaction     */    void scheduleTransaction(ClientTransaction transaction) throws RemoteException {        final IApplicationThread client = transaction.getClient();        transaction.schedule();        //client本来就是Binder的，所以下面不用看        if (!(client instanceof Binder)) {            transaction.recycle();        }    }复制代码

因为client本来就是Binder的，所以下面不用看，只看ClientTransaction的schedule()方法就行。

public void schedule() throws RemoteException {        mClient.scheduleTransaction(this);    }    /** Obtain an instance initialized with provided params. */    public static ClientTransaction obtain(IApplicationThread client, IBinder activityToken) {        ClientTransaction instance = ObjectPool.obtain(ClientTransaction.class);        if (instance == null) {            instance = new ClientTransaction();        }        instance.mClient = client;        instance.mActivityToken = activityToken;        return instance;    }复制代码

mClient在ClientTransaction的定义为private IApplicationThread mClient;，可以看到在上面realStartActivityLocked方法中执行obtain时，已经赋值了。

final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,                        r.appToken);复制代码

所以可知在这，mClient = app.thread，也就是IApplicationThread类型，它的实现是ActivityThread的内部类ApplicationThread，其中ApplicationThread继承了IApplicationThread.Stub。app是指传入的要启动的Activity所在的应用程序进程，因此这段代码指的就是在目标进程启动Activity。

private class ApplicationThread extends IApplicationThread.Stub{...}复制代码

当前代码运行在AMS所在的进程，也就是SystemServer中，通过ApplicationThread进行Binder通信，实现了跨进程

时序图如下：

ApplicationThread--启动Activity

通过上面的分析，我们现在来到了ApplicationThread的源码

@Override        public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {            ActivityThread.this.scheduleTransaction(transaction);        }复制代码

调用了ActivityThread的父类ClientTransactionHandler的方法

/** Prepare and schedule transaction for execution. */    void scheduleTransaction(ClientTransaction transaction) {        transaction.preExecute(this);        sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);    }复制代码

通过sendMessage给ActivityThread的H类发送消息，而H继承自Handler，我们直接跟进去

class H extends Handler {    ...    public void handleMessage(Message msg) {    ...         case EXECUTE_TRANSACTION:                    final ClientTransaction transaction = (ClientTransaction) msg.obj;        			//执行语句                    mTransactionExecutor.execute(transaction);                    if (isSystem()) {                        // Client transactions inside system process are recycled on the client side                        // instead of ClientLifecycleManager to avoid being cleared before this                        // message is handled.                        transaction.recycle();                    }                    // TODO(lifecycler): Recycle locally scheduled transactions.                    break;    ...	}      ...}复制代码

可以知道接下来的流程是交给TransactionExecutor来处理

public void execute(ClientTransaction transaction) {        final IBinder token = transaction.getActivityToken();        log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);        executeCallbacks(transaction);        executeLifecycleState(transaction);        mPendingActions.clear();        log("End resolving transaction");    }复制代码

再看executeCallbacks方法

/** Cycle through all states requested by callbacks and execute them at proper times. */    @VisibleForTesting    public void executeCallbacks(ClientTransaction transaction) {        final List
    
      callbacks = transaction.getCallbacks();        if (callbacks == null) {            // No callbacks to execute, return early.            return;        }        log("Resolving callbacks");        //从服务中获取当前app        final IBinder token = transaction.getActivityToken();        ActivityClientRecord r = mTransactionHandler.getActivityClient(token);        // In case when post-execution state of the last callback matches the final state requested        // for the activity in this transaction, we won't do the last transition here and do it when        // moving to final state instead (because it may contain additional parameters from server).        final ActivityLifecycleItem finalStateRequest = transaction.getLifecycleStateRequest();        final int finalState = finalStateRequest != null ? finalStateRequest.getTargetState()                : UNDEFINED;        // Index of the last callback that requests some post-execution state.        final int lastCallbackRequestingState = lastCallbackRequestingState(transaction);        final int size = callbacks.size();        for (int i = 0; i < size; ++i) {            final ClientTransactionItem item = callbacks.get(i);            log("Resolving callback: " + item);            final int postExecutionState = item.getPostExecutionState();            final int closestPreExecutionState = mHelper.getClosestPreExecutionState(r,                    item.getPostExecutionState());            if (closestPreExecutionState != UNDEFINED) {                cycleToPath(r, closestPreExecutionState);            }            //执行启动activity            item.execute(mTransactionHandler, token, mPendingActions);            item.postExecute(mTransactionHandler, token, mPendingActions);            if (r == null) {                // Launch activity request will create an activity record.                r = mTransactionHandler.getActivityClient(token);            }            if (postExecutionState != UNDEFINED && r != null) {                // Skip the very last transition and perform it by explicit state request instead.                final boolean shouldExcludeLastTransition =                        i == lastCallbackRequestingState && finalState == postExecutionState;                cycleToPath(r, postExecutionState, shouldExcludeLastTransition);            }        }    }复制代码

可以看到是通过item.execute方法来执行启动Activity的，而item也就是ClientTransactionItem是什么呢？

/** * A callback message to a client that can be scheduled and executed. * Examples of these might be activity configuration change, multi-window mode change, activity * result delivery etc. * * @see ClientTransaction * @see com.android.server.am.ClientLifecycleManager * @hide */public abstract class ClientTransactionItem implements BaseClientRequest, Parcelable {...}复制代码

从注释中可知它是作为系统与app的回调枢纽，比如配置变化，多窗口模式变化，Activity启动等

由于我们在这看到的是一个抽象类，要找到它的实现类才行。

回到ActivityStackSupervisor的realStartActivityLocked方法

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,            boolean andResume, boolean checkConfig) throws RemoteException {        if (!allPausedActivitiesComplete()) {            // While there are activities pausing we skipping starting any new activities until            // pauses are complete. NOTE: that we also do this for activities that are starting in            // the paused state because they will first be resumed then paused on the client side.            if (DEBUG_SWITCH || DEBUG_PAUSE || DEBUG_STATES) Slog.v(TAG_PAUSE,                    "realStartActivityLocked: Skipping start of r=" + r                    + " some activities pausing...");            return false;        }         ......             // Create activity launch transaction.                   final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,                        r.appToken);     //注意！！！！！！！/                clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),                        System.identityHashCode(r), r.info,                        // TODO: Have this take the merged configuration instead of separate global                        // and override configs.                        mergedConfiguration.getGlobalConfiguration(),                        mergedConfiguration.getOverrideConfiguration(), r.compat,                        r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,                        r.persistentState, results, newIntents, mService.isNextTransitionForward(),                        profilerInfo));                // Set desired final state.                final ActivityLifecycleItem lifecycleItem;                if (andResume) {                    lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());                } else {                    lifecycleItem = PauseActivityItem.obtain();                }                clientTransaction.setLifecycleStateRequest(lifecycleItem);                // Schedule transaction.                mService.getLifecycleManager().scheduleTransaction(clientTransaction);          ......复制代码

在clientTransaction中add的是LaunchActivityItem，它就是ClientTransactionItem的实现类，所以我们只要看它的execute方法

@Override    public void execute(ClientTransactionHandler client, IBinder token,            PendingTransactionActions pendingActions) {        Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");        ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,                mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,                mPendingResults, mPendingNewIntents, mIsForward,                mProfilerInfo, client);        //最后执行了这里        client.handleLaunchActivity(r, pendingActions, null /* customIntent */);        Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);    }复制代码

最后执行到了ClientTransactionHandler的handleLaunchActivity方法。

高兴的跑源码一看，坑爹的又是个抽象类，找它的实现类才行。

这里直接看H收到EXECUTE_TRANSACTION消息时

case EXECUTE_TRANSACTION:                    final ClientTransaction transaction = (ClientTransaction) msg.obj;                    mTransactionExecutor.execute(transaction);                    if (isSystem()) {                        // Client transactions inside system process are recycled on the client side                        // instead of ClientLifecycleManager to avoid being cleared before this                        // message is handled.                        transaction.recycle();                    }                    // TODO(lifecycler): Recycle locally scheduled transactions.                    break;复制代码

看mTransactionExecutor是怎么赋值的，

private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);复制代码

可以看到是直接new了进去，然后传入的this，也就是ActivityThread自身，再看ActivityThread本身果然是继承于ClientTransactionHandler，所以执行client.handleLaunchActivity(r, pendingActions, null /* customIntent */);就是在ActivityThread中执行handleLaunchActivity方法

@Override    public Activity handleLaunchActivity(ActivityClientRecord r,            PendingTransactionActions pendingActions, Intent customIntent) {        // If we are getting ready to gc after going to the background, well        // we are back active so skip it.        unscheduleGcIdler();        mSomeActivitiesChanged = true;        if (r.profilerInfo != null) {            mProfiler.setProfiler(r.profilerInfo);            mProfiler.startProfiling();        }        // Make sure we are running with the most recent config.        handleConfigurationChanged(null, null);        if (localLOGV) Slog.v(            TAG, "Handling launch of " + r);        // Initialize before creating the activity        if (!ThreadedRenderer.sRendererDisabled) {            GraphicsEnvironment.earlyInitEGL();        }        WindowManagerGlobal.initialize();        //执行点        final Activity a = performLaunchActivity(r, customIntent);        if (a != null) {            r.createdConfig = new Configuration(mConfiguration);            reportSizeConfigurations(r);            if (!r.activity.mFinished && pendingActions != null) {                pendingActions.setOldState(r.state);                pendingActions.setRestoreInstanceState(true);                pendingActions.setCallOnPostCreate(true);            }        } else {            // If there was an error, for any reason, tell the activity manager to stop us.            try {                ActivityManager.getService()                        .finishActivity(r.token, Activity.RESULT_CANCELED, null,                                Activity.DONT_FINISH_TASK_WITH_ACTIVITY);            } catch (RemoteException ex) {                throw ex.rethrowFromSystemServer();            }        }        return a;    }复制代码

在其中执行点在performLaunchActivity(r, customIntent);这个方法

/**  Core implementation of activity launch. */    private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {        //获取ActivityInfo类        ActivityInfo aInfo = r.activityInfo;//1        if (r.packageInfo == null) {            //获取apk文件的描述类LoadedApk            r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,                    Context.CONTEXT_INCLUDE_CODE);//2        }        ComponentName component = r.intent.getComponent();//3        ...        //创建Activity的Context        ContextImpl appContext = createBaseContextForActivity(r);        Activity activity = null;        try {            //用类加载器创建Activity的实例            java.lang.ClassLoader cl = appContext.getClassLoader();            activity = mInstrumentation.newActivity(                    cl, component.getClassName(), r.intent);//5            ...        } catch (Exception e) {            ...        }        try {            //创建Application            Application app = r.packageInfo.makeApplication(false, mInstrumentation);//6            ...            if (activity != null) {                //7  初始化Activity                activity.attach(appContext, this, getInstrumentation(), r.token,                        r.ident, app, r.intent, r.activityInfo, title, r.parent,                        r.embeddedID, r.lastNonConfigurationInstances, config,                        r.referrer, r.voiceInteractor, window, r.configCallback);                ...                if (r.isPersistable()) {                    mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);//8                } else {                    mInstrumentation.callActivityOnCreate(activity, r.state);                }                ...            }            r.setState(ON_CREATE);            mActivities.put(r.token, r);        } catch (SuperNotCalledException e) {            throw e;        } catch (Exception e) {            ...        }        return activity;    }复制代码

注释解释

用来获取ActivityInfo，用于存储代码以及AndroidMainfes设置的Activity和Receiver节点信息，比如Activity的theme和LaunchMode。

获取apk文件的描述类LoadedApk

获取要启动的Activity的ComponentName类，在这个类中保存了Activity的包名与类名。

用来创建启动的Activity的上下文context

根据ComponentName中存储的Activity类名，用类加载器创建该Activity的实例

创建Application，makeApplication方法内部会调用onCreate方法

调用Activity的attach方法初始化Activity，在attach中会创建window对象（phoneWindow）并与Activity关联

调用Instrumentation的callActivityOnCreate方法，启动Activity。

——摘自《Android进阶解密》100页

我们再来看callActivityOnCreate的源码

public void callActivityOnCreate(Activity activity, Bundle icicle) {        prePerformCreate(activity);        activity.performCreate(icicle);            postPerformCreate(activity);    }复制代码

调用了activity.performCreate(icicle); 直接搜索Activity的performCreate(icicle)方法

final void performCreate(Bundle icicle) {        performCreate(icicle, null);    }    final void performCreate(Bundle icicle, PersistableBundle persistentState) {        mCanEnterPictureInPicture = true;        restoreHasCurrentPermissionRequest(icicle);        if (persistentState != null) {            onCreate(icicle, persistentState);        } else {            onCreate(icicle);        }        writeEventLog(LOG_AM_ON_CREATE_CALLED, "performCreate");        mActivityTransitionState.readState(icicle);        mVisibleFromClient = !mWindow.getWindowStyle().getBoolean(                com.android.internal.R.styleable.Window_windowNoDisplay, false);        mFragments.dispatchActivityCreated();        mActivityTransitionState.setEnterActivityOptions(this, getActivityOptions());    }复制代码

终于在看了几十个类之后，看到了可爱的onCreate方法~~~~

到这，根Activity已经启动！

PS:时序图画不动了，困成狗

总结

Launcher进程向AMS请求创建根Activity，AMS会根据判断Activity的应用程序是否存在并启动，如果不存在就会通过Zygote进程fork自身创建程序进程。应用程序进程启动后，AMS会创建应用进程并启动Activity，其中，Launcher与AMS，AMS与应用程序是通过AIDL进行Binder通信，而AMS与Zygote之间使用socket通信。

普通Activity启动就只有AMS与应用进程通信了

参考

《Android进阶解密》

下面是我的公众号，欢迎大家关注我