Android应用启动流程

应用启动流程

一、Launcher进程请求AMS

1、时序图

2、详细过程

• 请求的入口就是startActivitySafely方法，该方法为根Activity设置了flag，即根Activity会在新的任务栈中启动。然后会调用Activity中startActivity方法

  public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
      ...
      // 根Activity会在新的任务栈中启动
      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
      try {
          ...
          if (isShortcut) {
              // Shortcuts need some special checks due to legacy reasons.
              startShortcutIntentSafely(intent, optsBundle, item);
          } else if (user == null || user.equals(Process.myUserHandle())) {
              // 调用startActivity
              startActivity(intent, optsBundle);
          } else {
              LauncherAppsCompat.getInstance(this).startActivityForProfile(
                      intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
          }
          ...
          return true;
      } catch (ActivityNotFoundException|SecurityException e) {
          ...
      }
      return false;
  }
  

• startActivity的最终调用的是Instrumentation的execStartActivity

  @Override
  public void startActivity(Intent intent, @Nullable Bundle options) {
      if (options != null) {
          startActivityForResult(intent, -1, options);
      } else {
          // Note we want to go through this call for compatibility with
          // applications that may have overridden the method.
          startActivityForResult(intent, -1);
      }
  }
  
  public void startActivityForResult(@RequiresPermission Intent intent, int requestCode) {
      startActivityForResult(intent, requestCode, null);
  }
  
  public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
          @Nullable Bundle options) {
      if (mParent == null) {
          options = transferSpringboardActivityOptions(options);
          Instrumentation.ActivityResult ar =
              mInstrumentation.execStartActivity(
                  this, mMainThread.getApplicationThread(), mToken, this,
                  intent, requestCode, options);
         ... 
      } 
      ...
  }
  

• 在这个方法会调用ActivityManager的getService方法来得到AMS的代理对象，然后调用这个代理对象的startActivity方法

  public ActivityResult execStartActivity(
          Context who, IBinder contextThread, IBinder token, Activity target,
          Intent intent, int requestCode, Bundle options) {
      ...
      try {
  	   ...
  	    //获取AMS的代理对象
          int result = ActivityManager.getService()
              .startActivity(whoThread, who.getBasePackageName(), intent,
                      intent.resolveTypeIfNeeded(who.getContentResolver()),
                      token, target != null ? target.mEmbeddedID : null,
                      requestCode, 0, null, options);
          checkStartActivityResult(result, intent);
      } catch (RemoteException e) {
          throw new RuntimeException("Failure from system", e);
      }
      return null;
  }
  

• 在Singleton中的create方法中由于b是AMS引用作为服务端处于SystemServer进程中，与当前Launcher进程作为客户端与服务端不在同一个进程，所以am返回的是IActivityManager.Stub的代理对象，此时如果要实现客户端与服务端进程间的通信，只需要在AMS继承了IActivityManager.Stub类并实现了相应的方法，而通过下面的代码可以发现AMS刚好是继承了IActivityManager.Stub类的，这样Launcher进程作为客户端就拥有了服务端AMS的代理对象，然后就可以调用AMS的方法来实现具体功能了，就这样Launcher的工作就交给AMS实现了

  @UnsupportedAppUsage
  public static IActivityManager getService() {
      return IActivityManagerSingleton.get();
  }
  
  @UnsupportedAppUsage
  private static final Singleton<IActivityManager> IActivityManagerSingleton =
          new Singleton<IActivityManager>() {
              @Override
              protected IActivityManager create() {
                  //得到activity的service引用，即IBinder类型的AMS引用
                  final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
  				//转换成IActivityManager对象
                  final IActivityManager am = IActivityManager.Stub.asInterface(b);
                  return am;
              }
          };
  

二、AMS发送创建应用进程请求

1、时序图

2、详细过程

2.1 AMS将请求任务转移给Process

• startActivity方法经过多个方法调用会去执行startActivityAsUser方法，在startActivityAsUser方法最后会返回mActivityStartController的一长串链式调用方法

  @Deprecated
  @Override
  public int startActivity(IApplicationThread caller, String callingPackage,
  		Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
  		int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
  	return mActivityTaskManager.startActivity(caller, callingPackage, null, intent,
  			resolvedType, resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions);
  }
  
  @Override
  public final int startActivity(IApplicationThread caller, String callingPackage,
          Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
          int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
      return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
              resultWho, requestCode, startFlags, profilerInfo, bOptions,
              UserHandle.getCallingUserId());
  }
  
  @Override
  public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
          Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
          int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
      return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
              resultWho, requestCode, startFlags, profilerInfo, bOptions, userId,
              true /*validateIncomingUser*/);
  }
  
  public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
          Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
          int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,
          boolean validateIncomingUser) {
  
  		
      //判断调用者的进程是否隔离
      enforceNotIsolatedCaller("startActivity");
      //检查调用者权限
      userId = mActivityStartController.checkTargetUser(userId, validateIncomingUser,
              Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");
  
      // TODO: Switch to user app stacks here.
      return mActivityStartController.obtainStarter(intent, "startActivityAsUser")
              .setCaller(caller)
              .setCallingPackage(callingPackage)
              .setResolvedType(resolvedType)
              .setResultTo(resultTo)
              .setResultWho(resultWho)
              .setRequestCode(requestCode)
              .setStartFlags(startFlags)
              .setProfilerInfo(profilerInfo)
              .setActivityOptions(bOptions)
              .setMayWait(userId)
              .execute();
  
  }
  

• obtainStarter的返回类型是ActivityStarter，所以最后调用的是ActivityStarter对象execute方法

  ActivityStarter obtainStarter(Intent intent, String reason) {
      return mFactory.obtain().setIntent(intent).setReason(reason);
  }
  
  int execute() {
      try {
          // TODO(b/64750076): Look into passing request directly to these methods to allow
          // for transactional diffs and preprocessing.
          if (mRequest.mayWait) {
              return startActivityMayWait(mRequest.caller, mRequest.callingUid,
                      mRequest.callingPackage, mRequest.intent, mRequest.resolvedType,
                      mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                      mRequest.resultWho, mRequest.requestCode, mRequest.startFlags,
                      mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig,
                      mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId,
                      mRequest.inTask, mRequest.reason,
                      mRequest.allowPendingRemoteAnimationRegistryLookup,
                      mRequest.originatingPendingIntent);
          } else {
              return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,
                      mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,
                      mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                      mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,
                      mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,
                      mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,
                      mRequest.ignoreTargetSecurity, mRequest.componentSpecified,
                      mRequest.outActivity, mRequest.inTask, mRequest.reason,
                      mRequest.allowPendingRemoteAnimationRegistryLookup,
                      mRequest.originatingPendingIntent);
          }
      } finally {
          onExecutionComplete();
      }
  }
  

• 因为在startActivityAsUser的链式方法中我们调用了setMayWait这个方法，所以这里的mRequest.mayWait为true，故会继续调用startActivityMayWait方法

  private int startActivityMayWait(IApplicationThread caller, int callingUid,
          String callingPackage, Intent intent, String resolvedType,
          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
          IBinder resultTo, String resultWho, int requestCode, int startFlags,
          ProfilerInfo profilerInfo, WaitResult outResult,
          Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,
          int userId, TaskRecord inTask, String reason,
          boolean allowPendingRemoteAnimationRegistryLookup,
          PendingIntentRecord originatingPendingIntent) {
      .....
      //根据intent在系统中找到合适的应用的activity，如果有多个activity可选择，
  	//则会弹出ResolverActivity让用户选择合适的应用。
      ActivityInfo aInfo = mSupervisor.resolveActivity(intent, rInfo, startFlags, profilerInfo);
  
      int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,
                  voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,
                  callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,
                  ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,
                  allowPendingRemoteAnimationRegistryLookup, originatingPendingIntent);
      ....
  
  }
  
  private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
          String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
          IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
          String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
          SafeActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
          ActivityRecord[] outActivity, TaskRecord inTask, String reason,
          boolean allowPendingRemoteAnimationRegistryLookup) {
      ...
      mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,
              aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,
              callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
              options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,
              inTask, allowPendingRemoteAnimationRegistryLookup);
      ...
      return getExternalResult(mLastStartActivityResult);
  }
  
  private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
          String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
          IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
          String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
          SafeActivityOptions options,
          boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity,
          TaskRecord inTask, boolean allowPendingRemoteAnimationRegistryLookup) {
      ...
      return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags,
              true /* doResume */, checkedOptions, inTask, outActivity);
  }
  
  private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
              IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
              int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
              ActivityRecord[] outActivity) {
      ...
          result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                  startFlags, doResume, options, inTask, outActivity);
      ...
      postStartActivityProcessing(r, result, mTargetStack);
      return result;
  }
  

• startActivityMayWait方法经过调用多次的startActivity方法后会调用到startActivityUnchecked这个方法，这个方法会根据启动标志位和Activity启动模式来决定如何启动一个Activity以及是否要调用deliverNewIntent方法通知Activity有一个Intent试图重新启动它。比如我们在一开始将活动设置了FLAG_ACTIVITY_NEW_TASK后将创建一个任务栈

  private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
          int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
          ActivityRecord[] outActivity) {
  ...
  if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask
              && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {
          newTask = true;
          //创建新的TaskRecord
          result = setTaskFromReuseOrCreateNewTask(
                  taskToAffiliate, preferredLaunchStackId, topStack);
      } else if (mSourceRecord != null) {
          result = setTaskFromSourceRecord();
      } else if (mInTask != null) {
          result = setTaskFromInTask();
      } else {
          setTaskToCurrentTopOrCreateNewTask();
      }
     ...
  if (mDoResume) {
          final ActivityRecord topTaskActivity =
                  mStartActivity.getTask().topRunningActivityLocked();
          if (!mTargetStack.isFocusable()
                  || (topTaskActivity != null && topTaskActivity.mTaskOverlay
                  && mStartActivity != topTaskActivity)) {
             ...
          } else {
              if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {
                  mTargetStack.moveToFront("startActivityUnchecked");
              }
              mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,
                      mOptions);
          }
      } else {
          mTargetStack.addRecentActivityLocked(mStartActivity);
      }
      ...
  }
  

• 无论以何种模式启动最终都会调用ActivityStackSupervisor.resumeFocusedStackTopActivityLocked方法，再调用了ActivityStack的resumeTopActivityUncheckedLocked，最终调用ActivityStackSupervisor.startSpecificActivityLocked

  boolean resumeFocusedStackTopActivityLocked(
          ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
      ....
      if (targetStack != null && isFocusedStack(targetStack)) {
          return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
      }
      ....
  }
  
  @GuardedBy("mService")
  boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
     ...
      try {
          // Protect against recursion.
          mStackSupervisor.inResumeTopActivity = true;
          result = resumeTopActivityInnerLocked(prev, options);
      }
     ...
  
  }
  
  private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
    ...
         mStackSupervisor.startSpecificActivityLocked(next, true, true);
     }
      if (DEBUG_STACK) mStackSupervisor.validateTopActivitiesLocked();
     return true;
  }
  

• 在方法中首先获取到了即将要启动的Activity所在的应用进程，假如是普通的Activity的启动流程的活，这个进程肯定是存在的，所以将执行realStartActivityLocked方法。但是我们现在讨论的是根Activity的启动流程，由于应用都还未启动，意味着根Activity所在的应用进程还未创建，而mService其实就是AMS，所以这里将调用AMS的startProcessLocked。于是我们又回到了最初的起点AMS

  void startSpecificActivityLocked(ActivityRecord r,
          boolean andResume, boolean checkConfig) {
      //获取即将要启动的Activity的所在的应用程序进程
      ProcessRecord app = mService.getProcessRecordLocked(r.processName,
              r.info.applicationInfo.uid, true);
      //如果应用进程已经存在
      if (app != null && app.thread != null) {
          try {
              if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                      || !"android".equals(r.info.packageName)) {
                  // Don't add this if it is a platform component that is marked
                  // to run in multiple processes, because this is actually
                  // part of the framework so doesn't make sense to track as a
                  // separate apk in the process.
                  app.addPackage(r.info.packageName, r.info.applicationInfo.longVersionCode,
                          mService.mProcessStats);
              }
              realStartActivityLocked(r, app, andResume, checkConfig);
              return;
          } catch (RemoteException e) {
              Slog.w(TAG, "Exception when starting activity "
                      + r.intent.getComponent().flattenToShortString(), e);
          }
  
          // If a dead object exception was thrown -- fall through to
          // restart the application.
      }
  	//应用进程还未创建，则通过AMS调用startProcessLocked向Zygote进程发送请求
      mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
              "activity", r.intent.getComponent(), false, false, true);
  }
  

• 通过调用多个startProcessLocked方法后最终将调用startProcess方法，不过需要重点看一下上面的第四个startProcessLocked，在该方法中有个entryPoint参数为 "android.app.ActivityThread"，这个参数将在后文讲到创建应用进程后启动ActivityThread会用到。然后在startProcess方法里将调用Process.start来发送应用创建进程的请求。这样AMS就将发送请求的事交给了Process

  final ProcessRecord startProcessLocked(String processName,
          ApplicationInfo info, boolean knownToBeDead, int intentFlags,
          String hostingType, ComponentName hostingName, boolean allowWhileBooting,
          boolean isolated, boolean keepIfLarge) {
      return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType,
              hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
              null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
              null /* crashHandler */);
  }
  
  final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
          boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
          boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
          String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
      ...
      final boolean success = startProcessLocked(app, hostingType, hostingNameStr, abiOverride);
      ...
  }
  
  @GuardedBy("this")
  private final boolean startProcessLocked(ProcessRecord app,
          String hostingType, String hostingNameStr, String abiOverride) {
      return startProcessLocked(app, hostingType, hostingNameStr,
              false /* disableHiddenApiChecks */, abiOverride);
  }
  
  private final boolean startProcessLocked(ProcessRecord app, String hostingType,
          String hostingNameStr, boolean disableHiddenApiChecks, String abiOverride) {
     ...
          int uid = app.uid; //创建应用进程的用户ID
          int[] gids = null;
          int mountExternal = Zygote.MOUNT_EXTERNAL_NONE;
          if (!app.isolated) {
              int[] permGids = null;
              try {
                  checkTime(startTime, "startProcess: getting gids from package manager");
                  final IPackageManager pm = AppGlobals.getPackageManager();
                  permGids = pm.getPackageGids(app.info.packageName,
                          MATCH_DEBUG_TRIAGED_MISSING, app.userId);
                  StorageManagerInternal storageManagerInternal = LocalServices.getService(
                          StorageManagerInternal.class);
                  mountExternal = storageManagerInternal.getExternalStorageMountMode(uid,
                          app.info.packageName);
              } catch (RemoteException e) {
                  throw e.rethrowAsRuntimeException();
              }
              //对用户组进行创建和赋值
              if (ArrayUtils.isEmpty(permGids)) {
                  gids = new int[3];
              } else {
                  gids = new int[permGids.length + 3];
                  System.arraycopy(permGids, 0, gids, 3, permGids.length);
              }
              gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid));
              gids[1] = UserHandle.getCacheAppGid(UserHandle.getAppId(uid));
              gids[2] = UserHandle.getUserGid(UserHandle.getUserId(uid));
  
              // Replace any invalid GIDs
              if (gids[0] == UserHandle.ERR_GID) gids[0] = gids[2];
              if (gids[1] == UserHandle.ERR_GID) gids[1] = gids[2];
          }
          ...
          //这个参数后文会提到
          final String entryPoint = "android.app.ActivityThread";    
  
          return startProcessLocked(hostingType, hostingNameStr, entryPoint, app, uid, gids,
                  runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith,
                  startTime);        
  }
  private boolean startProcessLocked(String hostingType, String hostingNameStr, String entryPoint,
          ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
          String seInfo, String requiredAbi, String instructionSet, String invokeWith,
          long startTime) {
      ....
  				//重点关注
                  final ProcessStartResult startResult = startProcess(app.hostingType, entryPoint,
                          app, app.startUid, gids, runtimeFlags, mountExternal, app.seInfo,
                          requiredAbi, instructionSet, invokeWith, app.startTime);    
      ...
  }
  
  private ProcessStartResult startProcess(String hostingType, String entryPoint,
          ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
          String seInfo, String requiredAbi, String instructionSet, String invokeWith,
          long startTime) {
          ....
          if (hostingType.equals("webview_service")) {
              startResult = startWebView(entryPoint,
                      app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                      app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                      app.info.dataDir, null,
                      new String[] {PROC_START_SEQ_IDENT + app.startSeq});
  
          } else {
  
  			//通过Process.start方法来为应用创建进程
              startResult = Process.start(entryPoint,
                      app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                      app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                      app.info.dataDir, invokeWith,
                      new String[] {PROC_START_SEQ_IDENT + app.startSeq});
          }
          checkTime(startTime, "startProcess: returned from zygote!");
          return startResult;
      } finally {
          Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
      }
  }
  

2.2 Process向Zygote进程发送创建应用进程请求

• Process中的start方法的实现是startViaZygote方法，在startViaZygote中会创建字符串列表argsForZygote来保存将要创建的应用进程的启动参数，然后最后会调用zygoteSendArgsAndGetResult方法，而在这个方法中第一个参数会调用openZygoteSocketIfNeeded方法，openZygoteSocketIfNeeded方法的作用是会根据Zygote进程的位数来建立相应的Socket连接，然后返回ZygoteState类型的对象

  public static final ProcessStartResult start(final String processClass,
                                final String niceName,
                                int uid, int gid, int[] gids,
                                int runtimeFlags, int mountExternal,
                                int targetSdkVersion,
                                String seInfo,
                                String abi,
                                String instructionSet,
                                String appDataDir,
                                String invokeWith,
                                String[] zygoteArgs) {
      return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
                  runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                  abi, instructionSet, appDataDir, invokeWith,
                  /*useBlastulaPool=*/ true, zygoteArgs);
  }
  
  public final Process.ProcessStartResult start(final String processClass,
                                                final String niceName,
                                                int uid, int gid, int[] gids,
                                                int runtimeFlags, int mountExternal,
                                                int targetSdkVersion,
                                                String seInfo,
                                                String abi,
                                                String instructionSet,
                                                String appDataDir,
                                                String invokeWith,
                                                boolean useBlastulaPool,
                                                String[] zygoteArgs) {
      try {
  	    //重点关注
          return startViaZygote(processClass, niceName, uid, gid, gids,
                  runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                  abi, instructionSet, appDataDir, invokeWith,
                  /*startChildZygote=*/false,
                  useBlastulaPool, zygoteArgs);
      } catch (ZygoteStartFailedEx ex) {
          Log.e(LOG_TAG,
                  "Starting VM process through Zygote failed");
          throw new RuntimeException(
                  "Starting VM process through Zygote failed", ex);
      }
  }
  
  private Process.ProcessStartResult startViaZygote(final String processClass,
                                                    final String niceName,
                                                    final int uid, final int gid,
                                                    final int[] gids,
                                                    int runtimeFlags, int mountExternal,
                                                    int targetSdkVersion,
                                                    String seInfo,
                                                    String abi,
                                                    String instructionSet,
                                                    String appDataDir,
                                                    String invokeWith,
                                                    boolean startChildZygote,
                                                    boolean useBlastulaPool,
                                                    String[] extraArgs)
                                                    throws ZygoteStartFailedEx {
      ArrayList<String> argsForZygote = new ArrayList<String>();
      // --runtime-args, --setuid=, --setgid=,
      //创建字符串列表argsForZygote，并将启动应用进程的启动参数保存在这个列表中
      argsForZygote.add("--runtime-args");
      argsForZygote.add("--setuid=" + uid);
      argsForZygote.add("--setgid=" + gid);
      argsForZygote.add("--runtime-flags=" + runtimeFlags);
      if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {
          argsForZygote.add("--mount-external-default");
      } else if (mountExternal == Zygote.MOUNT_EXTERNAL_READ) {
          argsForZygote.add("--mount-external-read");
      } else if (mountExternal == Zygote.MOUNT_EXTERNAL_WRITE) {
          argsForZygote.add("--mount-external-write");
      }
      argsForZygote.add("--target-sdk-version=" + targetSdkVersion);
  
      ...
      synchronized(mLock) {
  	    //重点关注
          return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),
                                            useBlastulaPool,
                                            argsForZygote);
      }
  }
  
  private ZygoteState openZygoteSocketIfNeeded(String abi)
          throws ZygoteStartFailedEx {
  
      Preconditions.checkState(Thread.holdsLock(mLock), "ZygoteProcess lock not held");
  	//64位进程中的
      if (primaryZygoteState == null || primaryZygoteState.isClosed()) {
          try {
  
  		    //调用ZygoteState的connect函数与mZygoteSocketAddress建立连接，
              //这里mZygoteSocketAddress的值为“zygote”
              primaryZygoteState =
                  ZygoteState.connect(mZygoteSocketAddress, mBlastulaPoolSocketAddress);
          } catch (IOException ioe) {
              throw new ZygoteStartFailedEx("Error connecting to primary zygote", ioe);
          }
  
          maybeSetApiBlacklistExemptions(primaryZygoteState, false);
          maybeSetHiddenApiAccessLogSampleRate(primaryZygoteState);
      }
  
      if (primaryZygoteState.matches(abi)) {
  
  	    //Socket进行连接成功并匹配abi后会返回ZygoteState类型对象
          return primaryZygoteState;
      }
  
      // 32位Zygote进程中
      if (secondaryZygoteState == null || secondaryZygoteState.isClosed()) {
          try {
              secondaryZygoteState =
                  ZygoteState.connect(mZygoteSecondarySocketAddress,
                                      mBlastulaPoolSecondarySocketAddress);
          } catch (IOException ioe) {
              throw new ZygoteStartFailedEx("Error connecting to secondary zygote", ioe);
          }
  
          maybeSetApiBlacklistExemptions(secondaryZygoteState, false);
          maybeSetHiddenApiAccessLogSampleRate(secondaryZygoteState);
      }
  
      if (secondaryZygoteState.matches(abi)) {
          return secondaryZygoteState;
      }
  
      throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);
  } 
  

• 与Zygote建立好Socket连接后，接下来是发送请求。这个方法中将传入的应用进程的启动参数argsForZygote写入到ZygoteState。这样AMS就完成了向Zygote进程发送创建应用进程的请求的任务

  //将传入的应用进程的启动参数argsForZygote写入到ZygoteState
  @GuardedBy("mLock")
  private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
          ZygoteState zygoteState, boolean useBlastulaPool, ArrayList<String> args)
          throws ZygoteStartFailedEx {
      String msgStr = Integer.toString(args.size()) + "\n"
                      + String.join("\n", args) + "\n";
  
      // Should there be a timeout on this?
      Process.ProcessStartResult result = new Process.ProcessStartResult();
  
      // TODO (chriswailes): Move branch body into separate function.
      if (useBlastulaPool && Zygote.BLASTULA_POOL_ENABLED && isValidBlastulaCommand(args)) {
          LocalSocket blastulaSessionSocket = null;
          try {
              blastulaSessionSocket = zygoteState.getBlastulaSessionSocket();
  
              final BufferedWriter blastulaWriter =
                      new BufferedWriter(
                              new OutputStreamWriter(blastulaSessionSocket.getOutputStream()),
                              Zygote.SOCKET_BUFFER_SIZE);
              final DataInputStream blastulaReader =
                      new DataInputStream(blastulaSessionSocket.getInputStream());
  
              blastulaWriter.write(msgStr);
              blastulaWriter.flush();
  
              result.pid = blastulaReader.readInt();
              // Blastulas can't be used to spawn processes that need wrappers.
              result.usingWrapper = false;
  
              if (result.pid < 0) {
                  throw new ZygoteStartFailedEx("Blastula specialization failed");
              }
              return result;
          } catch (IOException ex) {
              // If there was an IOException using the blastula pool we will log the error and
              // attempt to start the process through the Zygote.
              Log.e(LOG_TAG, "IO Exception while communicating with blastula pool - "
                             + ex.toString());
          } finally {
              try {
                  blastulaSessionSocket.close();
              } catch (IOException ex) {
                  Log.e(LOG_TAG, "Failed to close blastula session socket: " + ex.getMessage());
              }
          }
      }
      try {
          final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;
          final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;
  
          zygoteWriter.write(msgStr);
          zygoteWriter.flush();
  
          // Always read the entire result from the input stream to avoid leaving
          // bytes in the stream for future process starts to accidentally stumble
          // upon.
          result.pid = zygoteInputStream.readInt();
          result.usingWrapper = zygoteInputStream.readBoolean();
      } catch (IOException ex) {
          zygoteState.close();
          Log.e(LOG_TAG, "IO Exception while communicating with Zygote - "
                  + ex.toString());
          throw new ZygoteStartFailedEx(ex);
      }
      if (result.pid < 0) {
          throw new ZygoteStartFailedEx("fork() failed");
      }
      return result;
  }
  

三、Zygote进程接受请求并孵化应用进程

1、 时序图

2、详细过程

• 从时序图与上面的分析我们知道现在Zygote进程接受请求是在main方法，main方法首先要创建一个Server端的Socket，这个name为”zygote”的Socket用来等待ActivityManagerService来请求Zygote来创建新的应用程序进程,在上面AMS请求的分析中我们也知道客户端将根据这个name来与Zygote的Socket建立连接。接下去会启动SystemServer进程，这个进程会启动各种系统服务，比如与Activity启动息息相关的AMS。最后会调用ZygoteServer.runSelectLoop(abiList)来使创建的Socket进入无限循环，等待AMS请求

  @UnsupportedAppUsage
  public static void main(String argv[]) {
      ZygoteServer zygoteServer = new ZygoteServer();
      Runnable caller;
      try {
          ...
  		//创建名为zygote的Socket
          zygoteServer.createZygoteSocket(socketName);
          ....
  		//由于在init.rc中设置了start-system-server参数,因此
  		//这里将启动SystemServer,可见SystemServer由Zygote创建的第一个进程
          if (startSystemServer) {
              Runnable r = forkSystemServer(abiList, socketName, zygoteServer);
              if (r != null) {
                  r.run();
                  return;
              }
          }
          caller = Zygote.initBlastulaPool();
          if (caller == null) {
              Log.i(TAG, "Accepting command socket connections");
              //等待AMS的请求
              caller = zygoteServer.runSelectLoop(abiList);
          }
      } catch (Throwable ex) {
          Log.e(TAG, "System zygote died with exception", ex);
          throw ex;
      } finally {
          zygoteServer.closeServerSocket();
      }
      // We're in the child process and have exited the select loop. Proceed to execute the
      // command.
      if (caller != null) {
          caller.run();
      }
  }
  

• runSelectLoop这个方法是死循环表示不停的监听着Socket连接。acceptCommandPeer方法就是监听是否收到了请求，如果收到了请求就交给processOneCommand来实现

  Runnable runSelectLoop(String abiList) {
      ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
      peers.add(null);
      while (true) {
  
          while (--pollIndex >= 0) {
              if ((pollFDs[pollIndex].revents & POLLIN) == 0) {
                  continue;
              }
  
              if (pollIndex == 0) {
  			  //监听Socket连接，充当服务端Socket
                  ZygoteConnection newPeer = acceptCommandPeer(abiList);
                  peers.add(newPeer);
                  socketFDs.add(newPeer.getFileDescriptor());
              } else if (pollIndex < blastulaPoolEventFDIndex) { 
                  try {
  					//不断处理客户端的AMS的请求，然后交给processOneCommand
                      ZygoteConnection connection = peers.get(pollIndex);
                      final Runnable command = connection.processOneCommand(this);
                  } 
                  ....
              }
          }
      }
  }
  

• processOneCommand这个方法中将对请求进行处理，首先获取到将要启动的应用进程的启动参数，然后调用forkAndSpecialize来创建应用进程

  Runnable processOneCommand(ZygoteServer zygoteServer) {
      String args[];
      ZygoteArguments parsedArgs = null;
      FileDescriptor[] descriptors;
      try {
  	    //获取应用程序进程的启动参数
          args = Zygote.readArgumentList(mSocketReader);
          // TODO (chriswailes): Remove this and add an assert.
          descriptors = mSocket.getAncillaryFileDescriptors();
      } catch (IOException ex) {
          throw new IllegalStateException("IOException on command socket", ex);
      }
      ....
      parsedArgs = new ZygoteArguments(args);
      ....
  	//fork当前进程创建一个子进程
      pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids,
              parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo,
              parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,
              parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mTargetSdkVersion);
  
      try {
  
  	    //pid为0则代表这个进程为子进程，即新创建的应用程序进程
          if (pid == 0) {
              zygoteServer.setForkChild();
              zygoteServer.closeServerSocket();
              IoUtils.closeQuietly(serverPipeFd);
              serverPipeFd = null;
  
              return handleChildProc(parsedArgs, descriptors, childPipeFd,
                      parsedArgs.mStartChildZygote);
          } else {
              // In the parent. A pid < 0 indicates a failure and will be handled in
              // handleParentProc.
              IoUtils.closeQuietly(childPipeFd);
              childPipeFd = null;
              handleParentProc(pid, descriptors, serverPipeFd);
              return null;
          }
      } finally {
          IoUtils.closeQuietly(childPipeFd);
          IoUtils.closeQuietly(serverPipeFd);
      }
  }
  

• 在forkAndSpecialize中，最终将创建应用进程的任务交给nativeForkAndSpecialize，而这个方法可以看出来应该是本地方法，具体如何创建就不深究了，只需要知道nativeForkAndSpecialize最终是通过fork当前进程来创建一个子进程，而fork后会有返回值给pid:

  • 父进程中，fork返回新创建的子进程pid;
  • 子进程中，fork返回0；
  • 出现错误时，fork返回负数。

  到这里子进程也就是应用进程就被孵化出来了

  public static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
          int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
          int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir,
          int targetSdkVersion) {
      ZygoteHooks.preFork();
      // Resets nice priority for zygote process.
      resetNicePriority();
      int pid = nativeForkAndSpecialize(
              uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose,
              fdsToIgnore, startChildZygote, instructionSet, appDataDir);
      // Enable tracing as soon as possible for the child process.
      if (pid == 0) {
          Zygote.disableExecuteOnly(targetSdkVersion);
          Trace.setTracingEnabled(true, runtimeFlags);
  
          // Note that this event ends at the end of handleChildProc,
          Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "PostFork");
      }
      ZygoteHooks.postForkCommon();
      return pid;
  }
  

四、应用进程启动ActivityThread

1、时序图

2、详细过程

• 回头看上面的processOneCommand方法，细会发现再孵化出应用进程后，是有返回值的，当pid=0的时候，则代表了当前进程已经是子进程了，所以下一步将执行handleChildProc方法，最终又会调用ZygoteInit.zygoteInit方法

  private Runnable handleChildProc(ZygoteArguments parsedArgs, FileDescriptor[] descriptors,
          FileDescriptor pipeFd, boolean isZygote) {
          .....
          if (!isZygote) {
              return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                      parsedArgs.mRemainingArgs, null /* classLoader */);
          } else {
             ....
          }
  }
  

• 在zygoteInit方法里会创建当前进程的Binder线程池，便于后续与其它进程通信，然后调用了RuntimeInit的applicationInit方法

  public static final Runnable zygoteInit(int targetSdkVersion, String[] argv,
          ClassLoader classLoader) {
      if (RuntimeInit.DEBUG) {
          Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
      }
  
      Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
      RuntimeInit.redirectLogStreams();
  	//为当前的VM设置未捕获异常器
      RuntimeInit.commonInit();
  	//Binder驱动初始化，该方法完成后，可通过Binder进行进程通信
      ZygoteInit.nativeZygoteInit();
  	//主要调用SystemServer的main方法
      return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
  }
  

• applicationInit方法最终会调用findStaticMain方法，不过需注意的是方法的第一个参数args.startClass其实就是我们上文AMS将请求任务转移给Process中在最后强调的那个参数：android.app.ActivityThread。然后我们看看findStaticMain的实现，在这个方法中首先在注释1通过反射获取到android.app.ActivityThread类，然后在注释2获取到ActivityThread的main方法，最后通过main方法来构造MethodAndArgsCaller

  protected static Runnable applicationInit(int targetSdkVersion, String[] argv,
          ClassLoader classLoader) {
      ...
      final Arguments args = new Arguments(argv);
      // Remaining arguments are passed to the start class's static main
      return findStaticMain(args.startClass, args.startArgs, classLoader);
  }
  
  protected static Runnable findStaticMain(String className, String[] argv,
          ClassLoader classLoader) {
      Class<?> cl;
      try {
          cl = Class.forName(className, true, classLoader);//1
      } catch (ClassNotFoundException ex) {
         ....
      }
      Method m;
      try {
          m = cl.getMethod("main", new Class[] { String[].class });//2
      } catch (NoSuchMethodException ex) {
          ...
      } catch (SecurityException ex) {
          ...
      }
      return new MethodAndArgsCaller(m, argv);
  }
  

• MethodAndArgsCaller其实是RuntimeInit的一个内部类并且继承了Runnable,然后在run方法中会通过反射调用了mMethod方法，此时mMethod是ActivityThread的main方法，即run方法中将会执行ActivityThread的main方法。从分析Zygote进程接受请求并孵化应用进程的一开始，我们就是分析zygoteServer.runSelectLoop(abiList)这个方法，而分析到最后findStaticMain方法将返回MethodAndArgsCaller对象（继承Runnable）,所以这时候在ZygoteInit的main方法caller会等于这个MethodAndArgsCaller对象，显然caller不等于null，故最后会执行caller.run方法，即执行ActivityThread的main方法。于是应用进程成功启动ActivityThread

  static class MethodAndArgsCaller implements Runnable {
      /** method to call */
      private final Method mMethod;
  
      /** argument array */
      private final String[] mArgs;
  
      public MethodAndArgsCaller(Method method, String[] args) {
          mMethod = method;
          mArgs = args;
      }
  
      public void run() {
          try {
              mMethod.invoke(null, new Object[] { mArgs });
          } catch (IllegalAccessException ex) {
              throw new RuntimeException(ex);
          } catch (InvocationTargetException ex) {
              Throwable cause = ex.getCause();
              if (cause instanceof RuntimeException) {
                  throw (RuntimeException) cause;
              } else if (cause instanceof Error) {
                  throw (Error) cause;
              }
              throw new RuntimeException(ex);
          }
      }
  }
  

五、应用进程绑定到AMS

1、时序图

2、详细过程

• 当Zygote进程孵化出应用进程后会执行ActivityThread的main方法，在这里不详细分析prepareMainLooper和loop方法，重点分析attach这个方法

  public static void main(String[] args) {
      ....
  	//创建主线程的Looper以及MessageQueue
      Looper.prepareMainLooper();
      ...
      //AMS绑定ApplicationThread对象,即应用进程绑定到AMS
      thread.attach(false, startSeq);
  	//开启主线程的消息循环
      Looper.loop();
      ...
  }
  

• 由于在ActivityThread的attach中我们传入的是false，故在attach方法中将执行!system里的代码，通过调用AMS的attachApplication来将ActivityThread中的内部类ApplicationThread对象绑定至AMS，这样AMS就可以通过这个代理对象 来控制应用进程。接着为这个进程添加垃圾回收观察者，每当系统触发垃圾回收的时候就在run方法中计算应用使用了多大的内存，如果超过总量的3/4就尝试释放内存

  private void attach(boolean system, long startSeq) {
      sCurrentActivityThread = this;
      mSystemThread = system;
      if (!system) {
          android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                  UserHandle.myUserId());
          RuntimeInit.setApplicationObject(mAppThread.asBinder());
          final IActivityManager mgr = ActivityManager.getService();
          try {
  			//AMS绑定ApplicationThread对象
              mgr.attachApplication(mAppThread, startSeq);
          } catch (RemoteException ex) {
              throw ex.rethrowFromSystemServer();
          }
          //垃圾回收观察者
          BinderInternal.addGcWatcher(new Runnable() {
              @Override public void run() {
                  if (!mSomeActivitiesChanged) {
                      return;
                  }
                  Runtime runtime = Runtime.getRuntime();
                  long dalvikMax = runtime.maxMemory();
                  long dalvikUsed = runtime.totalMemory() - runtime.freeMemory();
                  if (dalvikUsed > ((3*dalvikMax)/4)) {
                      if (DEBUG_MEMORY_TRIM) Slog.d(TAG, "Dalvik max=" + (dalvikMax/1024)
                              + " total=" + (runtime.totalMemory()/1024)
                              + " used=" + (dalvikUsed/1024));
                      mSomeActivitiesChanged = false;
                      try {
                          mgr.releaseSomeActivities(mAppThread);
                      } catch (RemoteException e) {
                          throw e.rethrowFromSystemServer();
                      }
                  }
              }
          });
      } 
      ...
  }
  

• 在AMS的attachApplication方法中调用了attachApplicationLocked进行绑定，从代码可以发现attachApplicationLocked中有两个重要的方法：thread.bindApplication和mStackSupervisor.attachApplicationLocked(app)。thread.bindApplication中的thread其实就是ActivityThread里ApplicationThread对象在AMS的代理对象，故此方法将最终调用ApplicationThread的bindApplication方法。而mStackSupervisor.attachApplicationLocked(app)主要是AMS启动Activity的作用

  public final void attachApplication(IApplicationThread thread, long startSeq) {
      synchronized (this) {
          int callingPid = Binder.getCallingPid();
          final int callingUid = Binder.getCallingUid();
          final long origId = Binder.clearCallingIdentity();
          attachApplicationLocked(thread, callingPid, callingUid, startSeq);
          Binder.restoreCallingIdentity(origId);
      }
  }
  
  
  private final boolean attachApplicationLocked(IApplicationThread thread,
          int pid, int callingUid, long startSeq) {
  		....
  		    //将应用进程的ApplicationThread对象绑定到AMS，即AMS获得ApplicationThread的代理对象
              thread.bindApplication(processName, appInfo, providers,
                      app.instr.mClass,
                      profilerInfo, app.instr.mArguments,
                      app.instr.mWatcher,
                      app.instr.mUiAutomationConnection, testMode,
                      mBinderTransactionTrackingEnabled, enableTrackAllocation,
                      isRestrictedBackupMode || !normalMode, app.persistent,
                      new Configuration(getGlobalConfiguration()), app.compat,
                      getCommonServicesLocked(app.isolated),
                      mCoreSettingsObserver.getCoreSettingsLocked(),
                      buildSerial, isAutofillCompatEnabled);
        
  
      boolean badApp = false;
      boolean didSomething = false;
      // See if the top visible activity is waiting to run in this process...
      if (normalMode) {
          try {
  			//启动Activity
              if (mStackSupervisor.attachApplicationLocked(app)) {
                  didSomething = true;
              }
          } catch (Exception e) {
              Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
              badApp = true;
          }
      }
      .....
  }
  

• bindApplication方法其实就是Handler机制的应用，mH就是H类型的，所以bindApplication主要就是向ActivityThread的Handler,即H发送绑定的消息

  public final void bindApplication(String processName, ApplicationInfo appInfo,
              List<ProviderInfo> providers, ComponentName instrumentationName,
              ProfilerInfo profilerInfo, Bundle instrumentationArgs,
              IInstrumentationWatcher instrumentationWatcher,
              IUiAutomationConnection instrumentationUiConnection, int debugMode,
              boolean enableBinderTracking, boolean trackAllocation,
              boolean isRestrictedBackupMode, boolean persistent, Configuration config,
              CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
              String buildSerial, boolean autofillCompatibilityEnabled) {
  
        	....
  		//向H发送绑定ApplicationThread对象的消息
          sendMessage(H.BIND_APPLICATION, data);
      }
  
  void sendMessage(int what, Object obj) {
      sendMessage(what, obj, 0, 0, false);
  }
  
  private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
      ...
      Message msg = Message.obtain();
      msg.what = what;
      msg.obj = obj;
      msg.arg1 = arg1;
      msg.arg2 = arg2;
      if (async) {
          msg.setAsynchronous(true);
      }
      mH.sendMessage(msg);
  }
  

• H其实就是当前线程，也可以说是主线程ActivityThread的Handler，内部定义了一组消息类型，包括了四大组件的启动和停止过程。通过Handler机制我们知道在H的handleMessage中会处理发送给H的消息，在这里将调用handleBindApplication方法

  //线程所需要的Handler，内部定义了一组消息类型，主要包括四大组件的启动和停止过程
  class H extends Handler {
      public static final int BIND_APPLICATION        = 110;
      ...
      public void handleMessage(Message msg) {
          if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
          switch (msg.what) {
              case BIND_APPLICATION:
                  Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                  AppBindData data = (AppBindData)msg.obj;
                  handleBindApplication(data);
                  Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                  break;
              ...
      }
  }
  
  
  @UnsupportedAppUsage
  private void handleBindApplication(AppBindData data) {
  
      ....
      final InstrumentationInfo ii;
      if (data.instrumentationName != null) {
          try {
              ii = new ApplicationPackageManager(null, getPackageManager())
                      .getInstrumentationInfo(data.instrumentationName, 0);
          } 
          ...
      } else {
          ii = null;
      }
      ....
      // Continue loading instrumentation.
      if (ii != null) {
          .....
      } else {
          mInstrumentation = new Instrumentation();
          mInstrumentation.basicInit(this);
      }
      ....
      try {
          // If the app is being launched for full backup or restore, bring it up in
          // a restricted environment with the base application class.
          app = data.info.makeApplication(data.restrictedBackupMode, null);
          mInitialApplication = app;
          try {
              //调用Application的onCreate的方法
              //故Application的onCreate比ActivityThread的main方法慢执行
              //但是会比所有该应用Activity的生命周期先调用，因为此时的Activity还没启动
              mInstrumentation.callApplicationOnCreate(app);
          }
          ...
      } 
  }
  

六、AMS发送启动Activity的请求

1、时序图

2、详细过程

• 应用进程绑定后，随之就得启动Activity，ApplicationThread的bindApplication方法我们分析应用进程是如何绑定到AMS的，另外一个方法mStackSupervisor.attachApplicationLocked(app)就是用来启动Activity的，attachApplicationLocked会调用realStartActivityLocked方法

  boolean attachApplicationLocked(ProcessRecord app) throws RemoteException {
      final String processName = app.processName;
      boolean didSomething = false;
      for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
          ...
          for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
              ....
              for (int i = 0; i < size; i++) {
                  final ActivityRecord activity = mTmpActivityList.get(i);
                  if (activity.app == null && app.uid == activity.info.applicationInfo.uid
                          && processName.equals(activity.processName)) {
                      try {
  					    //真正启动Activity，也是普通Activity的启动过程
                          if (realStartActivityLocked(activity, app,
                                  top == activity /* andResume */, true /* checkConfig */)) {
                              didSomething = true;
                          }
                      } catch (RemoteException e) {
                           ...
                      }
                  }
              }
          }
      }
      return didSomething;
  }
  

• 在realStartActivityLocked方法中为ClientTransaction对象添加LaunchActivityItem的callback，然后设置当前的生命周期状态，由于我们是根Activity的启动，很显然这里的生命周期为ResumeActivityItem，最后调用ClientLifecycleManager.scheduleTransaction方法执行

  final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
          boolean andResume, boolean checkConfig) throws RemoteException {
              .....
              final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,
                      r.appToken);
  		    //添加callback，首先会执行callback中的方法
               //此时的ActivityLifecycleItem为LaunchActivityItem
              clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                      System.identityHashCode(r), r.info,
                      // TODO: Have this take the merged configuration instead of separate global
                      // and override configs.
                      mergedConfiguration.getGlobalConfiguration(),
                      mergedConfiguration.getOverrideConfiguration(), r.compat,
                      r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
                      r.persistentState, results, newIntents, mService.isNextTransitionForward(),
                      profilerInfo));
  
              //判断此时的生命周期是resume还是pause
              final ActivityLifecycleItem lifecycleItem;
              if (andResume) {
                  lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());
              } else {
                  lifecycleItem = PauseActivityItem.obtain();
              }
              //设置当前的生命周期
              clientTransaction.setLifecycleStateRequest(lifecycleItem);
  
              // mService为AMS对象,getLifecycleManager得到ClientLifecycleManager
              mService.getLifecycleManager().scheduleTransaction(clientTransaction);
      	    ......
          } 
  		....
      return true;
  }
  

• 由于transaction为ClientTransaction类型，故接下去将执行ClientTransaction的schedule方法，scheduleTransaction方法在ActivityThread的父类ClientTransactionHandler中，在这个方法中会调用sendMessage方法，而在ClientTransactionHandler类中该sendMessage方法为抽象方法，其具体实现在子类ActivityThread中。在ActivityThread的sendMessage中会把启动Activity的消息发送给mH,而mH为H类型，其实就是ActivityThread的Handler。到这里AMS就将启动Activity的请求发送给了ActivityThread的Handler。

  void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
      final IApplicationThread client = transaction.getClient();
      transaction.schedule();
      if (!(client instanceof Binder)) {
          transaction.recycle();
      }
  }
  
  public void schedule() throws RemoteException {
      //1.mClient是IApplicationThread类型，
      //2.ActivityThread的内部类ApplicationThread派生这个接口类并实现了对应的方法
      //3.ActivityThread实际调用的是他父类ClientTransactionHandler的scheduleTransaction方法。
      mClient.scheduleTransaction(this);
  }
  
  void scheduleTransaction(ClientTransaction transaction) {
      transaction.preExecute(this);
      sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
  }
  abstract void sendMessage(int what, Object obj);
  
  void sendMessage(int what, Object obj) {
      sendMessage(what, obj, 0, 0, false);
  }
  
  private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
      if (DEBUG_MESSAGES) Slog.v(
          TAG, "SCHEDULE " + what + " " + mH.codeToString(what)
          + ": " + arg1 + " / " + obj);
      Message msg = Message.obtain();
      msg.what = what;
      msg.obj = obj;
      msg.arg1 = arg1;
      msg.arg2 = arg2;
      if (async) {
          msg.setAsynchronous(true);
      }
      mH.sendMessage(msg);
  }
  

七、ActivityThread的Handler处理启动Activity的请求

1、时序图

2、详细过程

• 通过sendMessage的方法发送消息的话，应该是在Handler的handleMessage处理消息，ActivityThread的Handler就是H，那就是H的handleMessage方法对EXECUTE_TRANSACTION消息的处理，将调用TransactionExecutor.execute方法来切换Activity状态

  public void handleMessage(Message msg) {
      if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
      switch (msg.what) {
          case BIND_APPLICATION:
              Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
              AppBindData data = (AppBindData)msg.obj;
              handleBindApplication(data);
              Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
              break;
          ......
  		//处理事务，处理活动的启动，生命周期的转化等	
          case EXECUTE_TRANSACTION:
              final ClientTransaction transaction = (ClientTransaction) msg.obj;
  			//切换Activity的状态
              mTransactionExecutor.execute(transaction);
              if (isSystem()) {
                  // Client transactions inside system process are recycled on the client side
                  // instead of ClientLifecycleManager to avoid being cleared before this
                  // message is handled.
                  transaction.recycle();
              }
              // TODO(lifecycler): Recycle locally scheduled transactions.
              break;
          ....
      }
      ...
  }
  

• 在execute方法中重点关注两个方法：executeCallbacks，由于我们现在分析的是根Activity的启动流程，从上面也可以知道此时的callback是不为null的，所以会执行executeCallbacks，最终会执行Activity的onCreate方法.此时根Activity就已经启动成功了。executeLifecycleState方法是用来改变活动的生命周期状态的，如果是根Activity的启动，最终将会执行onStart和onResume方法

  public void execute(ClientTransaction transaction) {
      final IBinder token = transaction.getActivityToken();
      log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);
      //先执行callbacks，当根活动首次启动时会有callback，callback会执行onCreate方法
      //其它活动切换状态时没有callback
      executeCallbacks(transaction);
      //改变活动的生命周期状态
      executeLifecycleState(transaction);
      mPendingActions.clear();
      log("End resolving transaction");
  }
  

• 根Activity启动时这个callback的ClientTransactionItem为LaunchActivityItem，所以会执行LaunchActivityItem的execute方法，client为ActivityThread，所以会继续调用ActivityThread的handleLaunchActivity方法，最终会调用performLaunchActivity来启动活动

  @VisibleForTesting
  public void executeCallbacks(ClientTransaction transaction) {
      final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
      if (callbacks == null) {
          // No callbacks to execute, return early.
          return;
      }
      ......
      final int size = callbacks.size();
      for (int i = 0; i < size; ++i) {
          //此时item为LaunchActivityItem
          final ClientTransactionItem item = callbacks.get(i);
          ......
          item.execute(mTransactionHandler, token, mPendingActions);
          item.postExecute(mTransactionHandler, token, mPendingActions);
          ......
      }
  }
  
  @Override
  public void execute(ClientTransactionHandler client, IBinder token,
          PendingTransactionActions pendingActions) {
      Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
      ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
              mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
              mPendingResults, mPendingNewIntents, mIsForward,
              mProfilerInfo, client);
  	//此client为ActivityThread
      client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
      Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
  }
  
  public Activity handleLaunchActivity(ActivityClientRecord r,
          PendingTransactionActions pendingActions, Intent customIntent) {
      mSomeActivitiesChanged = true;
      //启动Activity
      final Activity a = performLaunchActivity(r, customIntent);
  
      if (a != null) {
          .....
      } else {
          //如果出现错误就通知AMS停止活动
          try {
  			//停止Activity
              ActivityManager.getService()
                      .finishActivity(r.token, Activity.RESULT_CANCELED, null,
                              Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
          } catch (RemoteException ex) {
              throw ex.rethrowFromSystemServer();
          }
      }
  
      return a;
  }
  

• performLaunchActivity方法要干的事情也挺多的，并且都很重要，通过注释应该可以知道这个方法的任务，当干完所有事后得将当前的生命周期设置为ON_CREATE。我们重点关注启动活动的代码mInstrumentation.callActivityOnCreate，可以知道在这里将会调用Instrumentation的callActivityOnCreate来启动活动

  private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
      //ActivityInfo用于存储代码和AndroidManifes设置的Activity和receiver节点信息，
      //比如Activity的theme和launchMode
      ActivityInfo aInfo = r.activityInfo;
      if (r.packageInfo == null) {
  		//获取APK文件的描述类LoadedApk
          r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                  Context.CONTEXT_INCLUDE_CODE);
      }
  	//获取要启动的Activity的ComponentName类，ComponentName类中保存了该Activity的包名和类名
      ComponentName component = r.intent.getComponent();
      if (component == null) {
          component = r.intent.resolveActivity(
              mInitialApplication.getPackageManager());
          r.intent.setComponent(component);
      }
  
      if (r.activityInfo.targetActivity != null) {
          component = new ComponentName(r.activityInfo.packageName,
                  r.activityInfo.targetActivity);
      }
  
  	
      //创建要启动Activity的上下文环境
      ContextImpl appContext = createBaseContextForActivity(r);
      Activity activity = null;
      try {
          java.lang.ClassLoader cl = appContext.getClassLoader();
  
  	    //用类加载器来创建该Activity的实例
          activity = mInstrumentation.newActivity(
                  cl, component.getClassName(), r.intent);
          StrictMode.incrementExpectedActivityCount(activity.getClass());
          r.intent.setExtrasClassLoader(cl);
          r.intent.prepareToEnterProcess();
          if (r.state != null) {
              r.state.setClassLoader(cl);
          }
      }
      ...
  
      try {
  		//创建Application,makeApplication会调用Application的onCreate方法
          Application app = r.packageInfo.makeApplication(false, mInstrumentation);
          ...
          if (activity != null) {
              ....
              //初始化Activity，创建Window对象（PhoneWindow）并实现Activity和Window相关联
              activity.attach(appContext, this, getInstrumentation(), r.token,
                      r.ident, app, r.intent, r.activityInfo, title, r.parent,
                      r.embeddedID, r.lastNonConfigurationInstances, config,
                      r.referrer, r.voiceInteractor, window, r.configCallback);
  
              ....
              //设置主题    
              int theme = r.activityInfo.getThemeResource();
              if (theme != 0) {
                  activity.setTheme(theme);
              }
  
              activity.mCalled = false;
              //启动活动
              if (r.isPersistable()) {
                  mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
              } else {
                  mInstrumentation.callActivityOnCreate(activity, r.state);
              }
              ....
          }
  
  		//设置生命周期为onCreate
          r.setState(ON_CREATE);
      } 
      ...
      return activity;
  }
  

• callActivityOnCreate将调用Activity的performCreate，最终调用Activity的onCreate，根Activity就已经启动了

  public void callActivityOnCreate(Activity activity, Bundle icicle) {
      prePerformCreate(activity);
      activity.performCreate(icicle);
      postPerformCreate(activity);
  }
  
  final void performCreate(Bundle icicle) {
      performCreate(icicle, null);
  }
  
  @UnsupportedAppUsage
  final void performCreate(Bundle icicle, PersistableBundle persistentState) {
      ....
  	//调用Activity的onCreate，根Activity启动成功
      if (persistentState != null) {
          onCreate(icicle, persistentState);
      } else {
          onCreate(icicle);
      }
      ...
  }
  

• 从上面分析中我们知道onCreate已经被调用，且生命周期的状态是ON_CREATE，故executeCallbacks已经执行完毕，所以开始执行executeLifecycleState，在executeLifecycleState方法中，会先执行cycleToPath，从上面的分析我们已经知道当根Activity启动时，此时的lifecycleItem为ResumeActivityItem，故调用lifecycleItem.getTargetState时将得到ON_RESUME状态。于onCreate方法已经执行，所以start为ON_CREATE,而finish为上面传递的ON_RESUME,excludeLastState是否移除最后的状态为true。mLifecycleSequence将添加ON_START和ON_RESUME状态，但是又因为excludeLastState为true，所以最后会移除掉ON_RESUME状态，故返回的类型只包含ON_START状态。故cycleToPath方法中的path中将只包含ON_START状态，然后继续执行performLifecycleSequence方法

  private void executeLifecycleState(ClientTransaction transaction) {
      final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
      if (lifecycleItem == null) {
          // No lifecycle request, return early.
          return;
      }
      ....
      // 执行当前生命周期状态之前的状态
      cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */);
  
      //切换状态
      lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
      lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
  }
  
  private void cycleToPath(ActivityClientRecord r, int finish,
          boolean excludeLastState) {
      final int start = r.getLifecycleState();
      log("Cycle from: " + start + " to: " + finish + " excludeLastState:" + excludeLastState);
      final IntArray path = mHelper.getLifecyclePath(start, finish, excludeLastState);
      performLifecycleSequence(r, path);
  }
  
  public IntArray getLifecyclePath(int start, int finish, boolean excludeLastState) {
      ...
      if (finish >= start) {
          // 添加start到finish之间的周期状态
          for (int i = start + 1; i <= finish; i++) {
              mLifecycleSequence.add(i);
          }
      } 
      ...
      // 根据需求移除最后的状态
      if (excludeLastState && mLifecycleSequence.size() != 0) {
          mLifecycleSequence.remove(mLifecycleSequence.size() - 1);
      }
  
      return mLifecycleSequence;
  }
  
  public abstract class ActivityLifecycleItem extends ClientTransactionItem {
      .....
      public static final int UNDEFINED = -1;
      public static final int PRE_ON_CREATE = 0;
      public static final int ON_CREATE = 1;
      public static final int ON_START = 2;
      public static final int ON_RESUME = 3;
      public static final int ON_PAUSE = 4;
      public static final int ON_STOP = 5;
      public static final int ON_DESTROY = 6;
      public static final int ON_RESTART = 7;
      ...
  }
  

• 因为path只包含ON_START状态，所以只执行ActivityThread的handleStartActivity方法，经过多次跳转最终会执行activity.onStart方法，至此cycleToPath方法执行完毕

  private void performLifecycleSequence(ActivityClientRecord r, IntArray path) {
      final int size = path.size();
      for (int i = 0, state; i < size; i++) {
          state = path.get(i);
          log("Transitioning to state: " + state);
          switch (state) {
              .....
              case ON_START:
                  mTransactionHandler.handleStartActivity(r, mPendingActions);
                  break;
               ......
          }
      }
  }
  
  public void handleStartActivity(ActivityClientRecord r,
          PendingTransactionActions pendingActions) {
      ...
      // Start
      activity.performStart("handleStartActivity");
      r.setState(ON_START);
      ...
  }
  
  final void performStart(String reason) {
      ...
       mInstrumentation.callActivityOnStart(this);
      ...
  }
  
  public void callActivityOnStart(Activity activity) {
      activity.onStart();
  }
  

• 执行完cycleToPath方法后将执行lifecycleItem.execute，即ResumeActivityItem的execute方法，通过多次调用最终将会调用Activity的onResume方法，至此Activity真正启动完毕

  @Override
  public void execute(ClientTransactionHandler client, IBinder token,
          PendingTransactionActions pendingActions) {
      Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
      //此client为ActivityThread
      client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
              "RESUME_ACTIVITY");
      Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
  }
  
  @Override
  public void handleResumeActivity(IBinder token, boolean finalStateRequest, boolean isForward,
          String reason) {
      ...
      // TODO Push resumeArgs into the activity for consideration
      final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);
      ...
      Looper.myQueue().addIdleHandler(new Idler());
      ...
  }
  
  public ActivityClientRecord performResumeActivity(IBinder token, boolean finalStateRequest,
          String reason) {
      ...
      try {
          ...
          r.activity.performResume(r.startsNotResumed, reason);
          r.state = null;
          r.persistentState = null;
          //设置当前状态为ON_RESUME
          r.setState(ON_RESUME);
      } 
      ...
      return r;
  }
  
  final void performResume(boolean followedByPause, String reason) {
      performRestart(true /* start */, reason);
      ...
      // mResumed is set by the instrumentation
      mInstrumentation.callActivityOnResume(this);
      ...
  }
  
  public void callActivityOnResume(Activity activity) {
      activity.mResumed = true;
      activity.onResume();
      ...
  }
  

八、总结

• 点击桌面App图标，Launcher进程采用Binder IPC向system_server进程发起startActivity请求
• system_server进程接收到请求后，向zygote进程发送创建进程的请求
• Zygote进程fork出新的子进程，即App进程
• App进程，通过Binder IPC向sytem_server进程发起attachApplication请求，system_server进程在收到请求后，进行一系列准备工作后，再通过binder IPC向App进 程发送scheduleLaunchActivity请求
• App进程的binder线程（ApplicationThread）在收到请求后，通过handler向主线程发送LAUNCH_ACTIVITY消息
• 主线程在收到Message后，通过发射机制创建目标Activity，并回调Activity.onCreate()等方法