【源码】app是如何启动的？深入解析android应用程序的启动过程（中）

前言

由上文可知，在启动了应用程序的进程后，接下来，就该启动应用程序本身了，你已经知道AMS(Activity Manager Service)是专门管理Activity的服务，而启动应用程序，本质上来说，就是启动应用程序的第一个Activity，这个Activity被称为根Activity，所以AMS在本文中依然是主角。

本文将分为三个部分介绍，Launcher请求AMS，AMS到ApplicationThread的调用和ActivityThread 启动 Activity。

Launcher请求AMS过程

Launcher是一个进程，他在android系统启动后会发挥作用——将应用程序的快捷图标放到桌面，就是我们手机里面的app图标，这些图标就是每一个应用程序的入口，也是根Activity的入口，所以，要想启动app，就需要管理图标的Launcher去请求管理Activity的AMS

时序图如下(mermaid画图更好看哈哈哈)

sequenceDiagram participant 点击图标 participant Launcher participant Activity participant Instrumentation participant IActivityManager participant AMS 点击图标->>Launcher:startActivitySafely Launcher->>Activity:startActivity Activity->>Activity:startActivityForResult Activity->>Instrumentation:execStartActivity Instrumentation->>IActivityManager:startActivity IActivityManager->>AMS:startActivity

当点击桌面图标时，会启动Launcher``的startActivitySafely方法，如下

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
    ...
    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
    ...
    try {
        if (Utilities.ATLEAST_MARSHMALLOW
               ...
        } else if (user == null || user.equals(Process.myUserHandle())) {
            // Could be launching some bookkeeping activity
            startActivity(intent, optsBundle);//10
        } else {
       ...
    return false;
}

在第3行代码处将Flag设置为FLAG_ACTIVITY_NEW_TASK，表示启动一个新的任务栈，如果你了解Activity的四种启动模式的话，应该不会陌生他的作用，简单说，就是每个应用程序都有一个这样的栈，当打开里面的新的Activity的时候，就压入这么一个Activity，当回退的时候，就弹出，不过规则没那么简单，有四种模式，有兴趣可以自己搜搜看。

第10行代码启动了Activity，而这个方法在Activity.java中实现。

 public void startActivity(Intent intent, @Nullable Bundle options) {
     if (options != null) {
         startActivityForResult(intent, -1, options);
     } else {
         // Note we want to go through this call for compatibility with
         // applications that may have overridden the method.
         startActivityForResult(intent, -1);
     }
 }

startActivity没有什么内容，就是调用了startActivityForResult，第二个参数名为requestCode，这里是-1，表示Launcher不需要知道Activity的启动结果。

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
           ...

这里进入startActivityForResult后，由于根Activity没有启动，也就是mParent==null，将会让Instrumentation执行execStartActivity方法，Instrumentation的作用是监控应用程序与系统的交互。

public ActivityResult execStartActivity(
    Context who, IBinder contextThread, IBinder token, String target,
    Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    ...
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess(who);
        int result = ActivityManager.getService()//9
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target, requestCode, 0, null, options);
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

在第9行处，调用ActivityManager的getService方法，获取到AMS的代理对象，然后调用该对象的startActivity方法，注意这里我们已经获得了AMS。

然后我们看getService做了什么

public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

就调用了一个IActivityManagerSingleton的get()方法

private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                final IActivityManager am = IActivityManager.Stub.asInterface(b);//6
                return am;
            }
        };

这是一个单例，在第6行中创建了IActivityManager并返回，这段代码比较陌生，使用的是AIDL，不过我们不必深究了。

小结1

总而言之，这一节中所有的工作都是为了获得AMS，将代码逻辑放到AMS中，中间经历了多个startAcitvity，都是为了判定或者架构需要，非常琐碎，我认为了解即可

AMS到Application Thread的调用过程

现在我们已经来到了熟悉的AMS，看看他是如何工作的吧

sequenceDiagram participant AMS participant ActivityStarter participant ActivityStackSupervisor participant ActivityStack participant ApplicationThread AMS->>AMS:startActivityAsUser AMS->>ActivityStarter:startActivityMayWait ActivityStarter->>ActivityStarter:startActivityLocked ActivityStarter->>ActivityStarter:startActivity ActivityStarter->>ActivityStarter:startActivity ActivityStarter->>ActivityStarter:startActivityUnchecked ActivityStarter->>ActivityStackSupervisor:resumefocusedStackTopActivityLocked ActivityStackSupervisor->>ActivityStack:resumeTopActivityUncheckedLocked ActivityStack->>ActivityStack:resumeTopActivityInnerLocked ActivityStack-->>ActivityStackSupervisor:startSpecificActivityLocked ActivityStackSupervisor->>ActivityStackSupervisor:realStartActivityLocked ActivityStackSupervisor->>ApplicationThread:realStartActivityLocked

承接上一节Launcher请求AMS过程的最后一步，首先调用startActivity

public final int startActivity(IApplicationThread caller, String callingPackage,
        Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
        int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
    return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
            resultWho, requestCode, startFlags, profilerInfo, bOptions,
            UserHandle.getCallingUserId());
}

可以看到，这里返回的是startActivityAsUser方法，就开始了我们这一节的内容。

注意到startActivityAsUser比起startActivity多了最后一个参数，UserHandle.getCallingUserId，这个是AMS用来确定调用这的权限的

public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
        Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
        int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
    enforceNotIsolatedCaller("startActivity");
    userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
            userId, false, ALLOW_FULL_ONLY, "startActivity", null);
    // TODO: Switch to user app stacks here.
    return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent,
            resolvedType, null, null, resultTo, resultWho, requestCode, startFlags,
            profilerInfo, null, null, bOptions, false, userId, null, null,
            "startActivityAsUser");
}

第5行出就是在检查调用者权限，如果没有没有权限就会抛出SecurityException异常。

然后就是调用startActivityMayWait方法，这个方法在ActivityStarter中，比起startActivityAsUser，又多了几个参数，其中最后一个参数"startActivityAsUser"表示启动的理由，是从这个方法中调用的。

final int startActivityMayWait(IApplicationThread caller, int callingUid,
        String callingPackage, Intent intent, String resolvedType,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        IBinder resultTo, String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, WaitResult outResult,
        Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId,
        IActivityContainer iContainer, TaskRecord inTask, String reason) {
    // Refuse possible leaked file descriptors
    ...
        int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType,
        			aInfo, rInfo, voiceSession, voiceInteractor,
       				resultTo, resultWho, requestCode, callingPid,
        			callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
        			options, ignoreTargetSecurity, componentSpecified, outRecord, container,
        			inTask, reason);
    ...
    	return res;

ActivityStarter是一个加载Activity的控制类，回去搜集很多的Intent或者Flags用来生成Activity，这段代码的10行调用了startActivityLocked方法（我真的想吐槽，调来调去的，很容易晕）

int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
        String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
        String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
        ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
        ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container,
        TaskRecord inTask, String reason) {

    if (TextUtils.isEmpty(reason)) {
        throw new IllegalArgumentException("Need to specify a reason.");
    }
    mLastStartReason = reason;
    mLastStartActivityTimeMs = System.currentTimeMillis();
    mLastStartActivityRecord[0] = null;

    mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,//17
            aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,
            callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
            options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,
            container, inTask);

    if (outActivity != null) {
        // mLastStartActivityRecord[0] is set in the call to startActivity above.
        outActivity[0] = mLastStartActivityRecord[0];
    }
    return mLastStartActivityResult;
}

没什么好看的，注意到17行处又调用了startActivity方法，方法如下

private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
        String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
        String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
        ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
        ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container,
        TaskRecord inTask) {
    int err = ActivityManager.START_SUCCESS;
    // Pull the optional Ephemeral Installer-only bundle out of the options early.
    final Bundle verificationBundle
            = options != null ? options.popAppVerificationBundle() : null;
    ProcessRecord callerApp = null;
    if (caller != null) { //14
        callerApp = mService.getRecordForAppLocked(caller);//15
        if (callerApp != null) {
            callingPid = callerApp.pid;
            callingUid = callerApp.info.uid;
        } else {
            Slog.w(TAG, "Unable to find app for caller " + caller
                    + " (pid=" + callingPid + ") when starting: "
                    + intent.toString());
            err = ActivityManager.START_PERMISSION_DENIED;
        }
    }
    ...
	ActivityRecord r = new ActivityRecord(mService, callerApp, callingPid, callingUid,
        callingPackage, intent, resolvedType, aInfo, mService.getGlobalConfiguration(),
        resultRecord, resultWho, requestCode, componentSpecified, voiceSession != null,
        mSupervisor, container, options, sourceRecord);
    if (outActivity != null) {
        outActivity[0] = r; //32
    }
    ...
    doPendingActivityLaunchesLocked(false);
	return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags, true,
        options, inTask, outActivity);

第14行处判定caller是否为null，这个caller是从前面传过来的，一直都是第一个参数，代表的是Launcher所在的应用程序的进程的ApplicationThread对象，如果为null，那么执行15行处的getRecordForAppLocked方法，得到一个代替Launcher进程的callerApp对象。

ActivityRecord表示记录一个Activity信息的对象，就像入学一样，在新生报到前，学校就应该准备好档案，寝室，班级等等工作。

在27行处就新建了这个对象，然后在32行处将其放在outActivity数组的第一个，我想你应该猜到了，那这个数组的其他位置是什么呢？当然是除了根Activity之外的其他Activity的记录信息了。

最后的36行，还是返回了startActivity方法

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
        ActivityRecord[] outActivity) {
    int result = START_CANCELED;
    try {
        mService.mWindowManager.deferSurfaceLayout();
        result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, outActivity);
    ...
    postStartActivityProcessing(r, result, mSupervisor.getLastStack().mStackId,  mSourceRecord,
            mTargetStack);

    return result;
}

这个方法没什么好看的，就是调用了一个startActivityUnchecked方法

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
        ActivityRecord[] outActivity) {
	...
    if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask//6
            && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {
        newTask = true;
        result = setTaskFromReuseOrCreateNewTask( //9
                taskToAffiliate, preferredLaunchStackId, topStack);
    } else if (mSourceRecord != null) {
        result = setTaskFromSourceRecord();
    } else if (mInTask != null) {
        result = setTaskFromInTask();
    } else {
        setTaskToCurrentTopOrCreateNewTask();
    }
    ...
    if (mDoResume) {
        final ActivityRecord topTaskActivity =
                mStartActivity.getTask().topRunningActivityLocked();
        if (!mTargetStack.isFocusable()
                || (topTaskActivity != null && topTaskActivity.mTaskOverlay
                && mStartActivity != topTaskActivity)) {
			...
        } else {
            if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {
                mTargetStack.moveToFront("startActivityUnchecked");
            }
            mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,//30
                    mOptions);
        }
    } else {
        mTargetStack.addRecentActivityLocked(mStartActivity);
    }
}

startActivityUnchecked方法主要处理与栈相关的逻辑，还记得吗？每一个应用程序都有一个任务栈，Activity的四种启动模式就在这里，在一开始的类startActivitySafely中，我们将Intent的Flag设置为FLAG_ACTIVITY_NEW_TASK，这样子，就满足了第6行代码处的if判断，在第9行处，就会创建新的TaskRecord。

现在所有东西准备齐全，在第30行处调用resumeFocusedStackTopActivityLocked方法，我们去看看吧

 boolean resumeFocusedStackTopActivityLocked(
         ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
     if (targetStack != null && isFocusedStack(targetStack)) {
         return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
     }
     final ActivityRecord r = mFocusedStack.topRunningActivityLocked();//6
     if (r == null || r.state != RESUMED) {//7
         mFocusedStack.resumeTopActivityUncheckedLocked(null, null);
     } else if (r.state == RESUMED) {
         // Kick off any lingering app transitions form the MoveTaskToFront operation.
         mFocusedStack.executeAppTransition(targetOptions);
     }
     return false;
 }

在第6行处调用的topRunningActivityLocked方法可以获取要启动的Acitvity所在栈的栈顶的不是处于停止状态的ActivityRecord（修饰词很多，慢慢读），第7行，如果为null，或者要启动的Acitvity状态不是RESUMED，就会调用resumeTopActivityUncheckedLocked方法，当然，对于即将启动的Activity，满足上述条件，进入resumeTopActivityUncheckedLocked方法。

oolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
   if (mStackSupervisor.inResumeTopActivity) {
       // Don't even start recursing.
       return false;
   }

   boolean result = false;
   try {
       // Protect against recursion.
       mStackSupervisor.inResumeTopActivity = true;
       result = resumeTopActivityInnerLocked(prev, options);
   } finally {
       mStackSupervisor.inResumeTopActivity = false;
   }
   mStackSupervisor.checkReadyForSleepLocked();
   return result;

没有什么东西，进入resumeTopActivityInnerLocked方法

    private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
        ...   
		mStackSupervisor.startSpecificActivityLocked(next, true, true);
        ...
    }

代码很多，但是我们不关心，只看调用的startSpecificActivityLocked方法

void startSpecificActivityLocked(ActivityRecord r,
        boolean andResume, boolean checkConfig) {
    // Is this activity's application already running?
    ProcessRecord app = mService.getProcessRecordLocked(r.processName,//4
            r.info.applicationInfo.uid, true);

    r.getStack().setLaunchTime(r);

    if (app != null && app.thread != null) {//9
        try {
            if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                    || !"android".equals(r.info.packageName)) {
               
                app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode,
                        mService.mProcessStats);
            }
            realStartActivityLocked(r, app, andResume, checkConfig);//16
            return;
        } catch (RemoteException e) {
            Slog.w(TAG, "Exception when starting activity "
                    + r.intent.getComponent().flattenToShortString(), e);
        }
    }
    mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
            "activity", r.intent.getComponent(), false, false, true);
}

在第4行处，获得即将启动的Activity所在的应用程序进程，也就是我们在上篇文章中的主角，在第9行处判断如果这个进程已经运行了，就会调用了16行处的realStartActivityLocked方法。

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
    ...
    app.thread.scheduleLaunchActivity(new Intent(r.intent), r.appToken,
        System.identityHashCode(r), r.info,
        mergedConfiguration.getGlobalConfiguration(),
        mergedConfiguration.getOverrideConfiguration(), r.compat,
        r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
        r.persistentState, results, newIntents, !andResume,
        mService.isNextTransitionForward(), profilerInfo);
    ...
    return true;

在这里的app.thread就是ActivityThread的内部类，app表示传入这个应用程序的进程。

所以这段代码的意思就是，在应用程序的进程中，也就是ActivityThread中，启动Activity。

小结2

上面代码的核心，就是要把逻辑从AMS中移动到应用程序的进程当中，然后准备在应用程序的进程中启动Activity。

ActivityThread启动Acitvity的过程

历经千山万水，我们总算是要启动Activity了（我好饿啊……），下次再继续嘻嘻