4.Activity启动流程（基于AOSP 13）2024-03-12

Activity启动流程

这里说的是非首页的Activity。启动一个新的 Activity 只需要在当前 Activity 中调用startActivity方法，并传入一个Intent 即可。

Intent intent = new Intent(this, TestActivity.class);
startActivity(intent);

1、应用发起新Activity启动

// frameworks/base/core/java/android/app/Activity.java
	ActivityThread mMainThread;

    @Override
    public void startActivity(Intent intent) {
        this.startActivity(intent, null);
    }

    @Override
    public void startActivity(Intent intent, @Nullable Bundle options) {
        getAutofillClientController().onStartActivity(intent, mIntent);
        if (options != null) {
            startActivityForResult(intent, -1, options);
        } else {
            // Note we want to go through this call for compatibility with
            // applications that may have overridden the method.
            startActivityForResult(intent, -1);
        }
    }

	public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            // ...

        } else {
            // ...
        }
    }

可以看到，startActivity 方法最终会调用 startActivityForResult 方法，这个方法的核心代码是通过 Instrumentation 调用了 execStartActivity。

而 execStartActivity 方法中的第二个参数为 mMainThread.getApplicationThread()，即ApplicationThread Binder 类。

// frameworks/base/core/java/android/app/Instrumentation.java

    public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        Uri referrer = target != null ? target.onProvideReferrer() : null;
        if (referrer != null) {
            intent.putExtra(Intent.EXTRA_REFERRER, referrer);
        }
        // ...
        try {
            intent.migrateExtraStreamToClipData(who);
            intent.prepareToLeaveProcess(who);
            // 通过 ActivityTaskManager 获取 Service 来启动 Activity
            int result = ActivityTaskManager.getService().startActivity(whoThread,
                    who.getOpPackageName(), who.getAttributionTag(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                    target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
            notifyStartActivityResult(result, options);
            // 检查 Activity 的启动结果，例如是否在 AndroidManifest 文件中注册，没有则抛出异常
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

这里是binder调用ATMS.startActivity方法。

2、AMS处理新Activity启动

// frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java

public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
    // ...
    
    private ActivityStartController mActivityStartController;

    private int startActivityAsUser(IApplicationThread caller, String callingPackage,
            @Nullable String callingFeatureId, Intent intent, String resolvedType,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {

        // ... 省略配置项获取与校验
        userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser,
                Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");

        // TODO: Switch to user app stacks here.
        return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
                .setCaller(caller)
                .setCallingPackage(callingPackage)
                .setCallingFeatureId(callingFeatureId)
                .setResolvedType(resolvedType)
                .setResultTo(resultTo)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setStartFlags(startFlags)
                .setProfilerInfo(profilerInfo)
                .setActivityOptions(opts)
                .setUserId(userId)
                .execute();

    } 
}

在ATMS中，startActivity 最终调用了 startActivityAsUser 方法，这个方法中的代码也比较简单，就是通过 getActivityStartController().obtainStarter 来配置相关参数，并最终执行 execute。

/// ActivityStartController
ActivityStarter obtainStarter(Intent intent, String reason) {
    return mFactory.obtain().setIntent(intent).setReason(reason);
}

obtainStarter 返回的是一个ActivityStarter对象，我们看下它的execute()方法。

构造一个 launchingState
加锁处理，获取 launchingState 的值，避免死锁处理
根据 intent，设置重启或关机检查点, 记录源 intent 信息和包名
同步处理，获取执行请求的结果，关键方法 executeRequest(mRequest)

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

private final ActivityTaskSupervisor mSupervisor;

int execute() {
        try {
            onExecutionStarted();

            // ... 

            int res;
            synchronized (mService.mGlobalLock) {
                // ...
                
                res = executeRequest(mRequest);

                // ...
                }
                return getExternalResult(res);
            }
        } finally {
            onExecutionComplete();
        }
    }

execute 方法调用了 executeRequest 方法

private int executeRequest(Request request) {
        // ... 省略参数初始化及权限校验
        final ActivityRecord r = new ActivityRecord.Builder(mService)
                .setCaller(callerApp)
                .setLaunchedFromPid(callingPid)
                .setLaunchedFromUid(callingUid)
                .setLaunchedFromPackage(callingPackage)
                .setLaunchedFromFeature(callingFeatureId)
                .setIntent(intent)
                .setResolvedType(resolvedType)
                .setActivityInfo(aInfo)
                .setConfiguration(mService.getGlobalConfiguration())
                .setResultTo(resultRecord)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setComponentSpecified(request.componentSpecified)
                .setRootVoiceInteraction(voiceSession != null)
                .setActivityOptions(checkedOptions)
                .setSourceRecord(sourceRecord)
                .build();

        // ...
        mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
                request.voiceInteractor, startFlags, true /* doResume */, checkedOptions,
                inTask, inTaskFragment, restrictedBgActivity, intentGrants);

        if (request.outActivity != null) {
            request.outActivity[0] = mLastStartActivityRecord;
        }

        return mLastStartActivityResult;
    }

executeRequest 方法中的核心是实例化了 ActivityRecord，并调用 startActivityUnchecked：

检查权限
拦截器拦截调用行为
调用 startActivityUnchecked 方法

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            TaskFragment inTaskFragment, boolean restrictedBgActivity,
            NeededUriGrants intentGrants) {
        
        try {
            mService.deferWindowLayout();
            try {
                result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                        startFlags, doResume, options, inTask, inTaskFragment, restrictedBgActivity,
                        intentGrants);
            } finally {
                // ...
            }
        } finally {
            mService.continueWindowLayout();
        }
        postStartActivityProcessing(r, result, startedActivityRootTask);

        return result;
    }

startActivityUnchecked 方法中又调用了 startActivityInner，源码如下：

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

private final RootWindowContainer mRootWindowContainer;

int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            TaskFragment inTaskFragment, boolean restrictedBgActivity,
            NeededUriGrants intentGrants) {
        ....
        // 获取发起Activity启动的原Activity任务栈
        computeSourceRootTask();
		....
        // 查找可用的任务栈
        final Task reusedTask = getReusableTask();
        ....
        // 如果 reusedTask 不空，则使用 reusedTask 任务栈，否则寻找目标任务栈
        final Task targetTask = reusedTask != null ? reusedTask : computeTargetTask();
        // 目标任务栈为空，则标记为使用新任务栈，需要新建任务栈
        final boolean newTask = targetTask == null;
        mTargetTask = targetTask;

        computeLaunchParams(r, sourceRecord, targetTask);

        if (newTask) {
            // 需要创建一个新的任务栈
            final Task taskToAffiliate = (mLaunchTaskBehind && mSourceRecord != null)
                    ? mSourceRecord.getTask() : null;
            // 将 Activity 放入新建的任务栈        
            setNewTask(taskToAffiliate);
        } else if (mAddingToTask) {
            // 加入已有的任务栈
            addOrReparentStartingActivity(targetTask, "adding to task");
        }
        // ...
       
        if (mDoResume) {
                // ...
                mRootWindowContainer.resumeFocusedTasksTopActivities(
                        mTargetRootTask, mStartActivity, mOptions, mTransientLaunch);
            }
        }
        
        return START_SUCCESS;
}

startActivityInner 方法中的代码比较复杂。这个方法里主要是处理任务栈相关的逻辑，如果找到可用的任务栈则直接使用这个任务栈，如果没有找到，则新建一个任务栈：

计算并获取 Source Root Task
获取顶部的Task，以防后续复用Task时，存在排序问题
调用 Task#startActivityLocked
mRootWindowContainer#resumeFocusedTasksTopActivities，给Activity获取焦点并resume

在完成任务栈的处理之后通过mRootWindowContainer.resumeFocusedTasksTopActivities继续 Activity 的启动流程。

// frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java

 boolean resumeFocusedTasksTopActivities(
            Task targetRootTask, ActivityRecord target, ActivityOptions targetOptions,
            boolean deferPause) {
        // ...
        
        boolean result = false;
        if (targetRootTask != null && (targetRootTask.isTopRootTaskInDisplayArea()
                || getTopDisplayFocusedRootTask() == targetRootTask)) {
            result = targetRootTask.resumeTopActivityUncheckedLocked(target, targetOptions,deferPause);
        }
        
        // ...

        return result;
    }

这个方法中将启动相关的逻辑交给了待启动Activity对应 Task 的 resumeTopActivityUncheckedLocked 方法。这个方法将当前 Task 顶部的 Activity 进行 Resume。直接调用此方法是不安全的，因为它可能导致无焦点的任务栈中的 Activity 进行 Resume。这个方法是个递归：

是叶子任务，执行 resumeTopActivityInnerLocked 方法
否则遍历 children Task 检查是否有焦点 isTopActivityFocusable
- 有焦点，检查是否展示，调用子任务的resumeTopActivityUncheckedLocked 递归检查子任务的子任务。

frameworks/base/services/core/java/com/android/server/wm/Task.java

boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
    return resumeTopActivityUncheckedLocked(prev, options, false /* skipPause */);
}
    
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options,
        boolean deferPause) {
    // ...
    boolean someActivityResumed = false;
    try {
        // Protect against recursion.
        mInResumeTopActivity = true;

        if (isLeafTask()) {
            if (isFocusableAndVisible()) {
                someActivityResumed = resumeTopActivityInnerLocked(prev, options, deferPause);
            }
        } else {
           // ...
        }
    }
    // ...
    return someActivityResumed;
}

@GuardedBy("mService")
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options,
        boolean deferPause) {
    if (!mAtmService.isBooting() && !mAtmService.isBooted()) {
        // Not ready yet!
        return false;
    }
    // 任务栈栈顶正在运行的 Activity 
    final ActivityRecord topActivity = topRunningActivity(true /* focusableOnly */);
    if (topActivity == null) {
        // 空任务栈 There are no activities left in this task, let's look somewhere else.
        return resumeNextFocusableActivityWhenRootTaskIsEmpty(prev, options);
    }

    final boolean[] resumed = new boolean[1];
    final TaskFragment topFragment = topActivity.getTaskFragment();
    resumed[0] = topFragment.resumeTopActivity(prev, options, deferPause);
    // ...
    return resumed[0];
}

在 Task 的 resumeTopActivityUncheckedLocked 方法中进而又调用了resumeTopActivityInnerLocked，其实现逻辑如下：

通过topRunningActivity方法获取一个ActivityRecord对象
通过 ActivityRecord#getTaskFragment 获取TaskFragment
遍历所有的叶子 TaskFragment 执行：
- 若可以变为 Resumed，调用TaskFragment#resumeTopActivity
最终返回TaskFragment#resumeTopActivity的结果

在 resumeTopActivityInnerLocked 中调用了TaskFragment.resumeTopActivity()，接着来看 TaskFragment 中的实现。

frameworks/base/services/core/java/com/android/server/wm/TaskFragment.java

final ActivityTaskSupervisor mTaskSupervisor;

final boolean resumeTopActivity(ActivityRecord prev, ActivityOptions options,
            boolean deferPause) {
    ActivityRecord next = topRunningActivity(true /* focusableOnly */);
         // ...
    if (mResumedActivity != null) {
         // 将当前resume的activity 转到pause状态
        pausing |= startPausing(mTaskSupervisor.mUserLeaving, false /* uiSleeping */, next, "resumeTopActivity");
    }
     
    // ... 
    // 要启动的 Activity 已存在，且不需要重新创建。
    if (next.attachedToProcess()) {
        // ...
        ActivityRecord lastResumedActivity =
                lastFocusedRootTask == null ? null
                        : lastFocusedRootTask.getTopResumedActivity();
        final ActivityRecord.State lastState = next.getState();

        mAtmService.updateCpuStats();

        next.setState(RESUMED, "resumeTopActivity");

        // Have the window manager re-evaluate the orientation of
        // the screen based on the new activity order.
        boolean notUpdated = true;

        // ...
        try {
            // 创建一个事务
            final ClientTransaction transaction =
                    ClientTransaction.obtain(next.app.getThread(), next.token);
            // ...
            if (next.newIntents != null) {
                // 添加 onNewIntent 的 callback ，最终会在APP端执行 onNewIntent()
                transaction.addCallback(
                        NewIntentItem.obtain(next.newIntents, true /* resume */));
            }
            // ...
            // 设置 Activity 最终的生命周期状态为 Resume
            transaction.setLifecycleStateRequest(
                    ResumeActivityItem.obtain(next.app.getReportedProcState(),
                            dc.isNextTransitionForward()));
            // 重点位置：开始执行事务                
            mAtmService.getLifecycleManager().scheduleTransaction(transaction);
        } catch (Exception e) {
            // Resume 异常，重新启动
            // ...
            mTaskSupervisor.startSpecificActivity(next, true, false);
            return true;
        }
        // ...
    } else { // 目标Activity还没有启动 
        // ...
        // 调用ActivityTaskSupervisor的startSpecificActivity启动Activity
        mTaskSupervisor.startSpecificActivity(next, true, true);
    }

    return true;
}

resumeTopActivity 方法中主要有两部分内容：

调用startPausing暂停栈顶Activity
启动目标Activity：
1. 若next.attachedToProcess() 为 true，即要启动的这个 Activity 已经存在，无需重新创建 Activity 的情况下，则先通过ClientTransaction添加了一个NewIntentItem的callback，接下来通过setLifecycleStateRequest设置了一个 ResumeActivityItem对象，并通过mAtmService.getLifecycleManager().scheduleTransaction()将事务发给客户端。
2. 若next.attachedToProcess() 为 false，则需要继续执行 Activity 的启动流程。

下面继续从else往下走，调用了 ActivityTaskSupervisor.startSpecificActivity()，这里是 Activity 正常启动的流程。

frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java


    void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?
        final WindowProcessController wpc =
                mService.getProcessController(r.processName, r.info.applicationInfo.uid);

        boolean knownToBeDead = false;
        
        if (wpc != null && wpc.hasThread()) {
            try {
                realStartActivityLocked(r, wpc, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
               // ...
            }
            // ...
        }
        // ...
    	mService.startProcessAsync(r, knownToBeDead, isTop, hostingType);
    }

在这个方法中，主要通过 WindowProcessController 和它是否存在线程来判断了目标 Activity 所在的应用是否在运行，如果在运行就直接通过 realStartActivityLocked 启动 Activity，否则就通过 ActivityTaskManagerService#startProcessAsync 去异步启动一个新进程。

   boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig) throws RemoteException {

        // ...
        final Task task = r.getTask();
        final Task rootTask = task.getRootTask();

        try {
                // ...
                // 创建启动 Activity 的事务
                final ClientTransaction clientTransaction = ClientTransaction.obtain(
                        proc.getThread(), r.token);

                final boolean isTransitionForward = r.isTransitionForward();
                final IBinder fragmentToken = r.getTaskFragment().getFragmentToken();
                
                // 添加启动 Activity 的 callback，执行launchActivity
                clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                        System.identityHashCode(r), r.info,
                        // TODO: Have this take the merged configuration instead of separate global
                        // and override configs.
                        mergedConfiguration.getGlobalConfiguration(),
                        mergedConfiguration.getOverrideConfiguration(), r.compat,
                        r.getFilteredReferrer(r.launchedFromPackage), task.voiceInteractor,
                        proc.getReportedProcState(), r.getSavedState(), r.getPersistentSavedState(),
                        results, newIntents, r.takeOptions(), isTransitionForward,
                        proc.createProfilerInfoIfNeeded(), r.assistToken, activityClientController,
                        r.shareableActivityToken, r.getLaunchedFromBubble(), fragmentToken));

                // Activity 启动后最终的生命周期状态
                final ActivityLifecycleItem lifecycleItem;
                if (andResume) {
                    // 将最终生命周期设置为 Resume 状态
                    lifecycleItem = ResumeActivityItem.obtain(isTransitionForward);
                } else {
                    // 将最终生命周期设置为 Pause 状态
                    lifecycleItem = PauseActivityItem.obtain();
                }
                // 设置 Activity 启动后最终的生命周期状态
                clientTransaction.setLifecycleStateRequest(lifecycleItem);

                // 开启事务
                mService.getLifecycleManager().scheduleTransaction(clientTransaction);
                // ...
            } catch (RemoteException e) {
                // ...
            }
        } finally {
            // ...
        }

        // ...
        return true;
    }

realStartActivityLocked 中主要做的事情：

给 ActivityRecord 设置进程
LockTaskController#startLockTaskMode
创建 activity 启动 Transaction，同时获取 lifecycleItem （生命周期）
执行 Transaction

该函数的核心作用是创建 Transaction 并分发给生命周期管理器处理。这个方法中同样是获取了一个 ClientTransaction 实例，并调用了它的 addCallback 方法，与上边不同的是，这里添加了一个 LaunchActivityItem 实例。

3、应用侧启动Activity并更新其生命周期

我们知道应用侧实际会在TransactionExecutor.execute执行上一节AMS封装好的ClientTransaction，具体可以参考Activity生命周期流程一文。

3.1 执行回调executeCallbacks

当 Activity 正常启动时，通过 addCallback 添加的是一个 LaunchActivityItem 的实例。因此这里就会首先执行 LaunchActivityItem 的 execute 方法，进而执行 Activity 的实例化及 onCreate 生命周期的调用。

// frameworks/base/core/java/android/app/servertransaction/LaunchActivityItem.java

    @Override
    public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
        
        ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
                mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
                mPendingResults, mPendingNewIntents, mActivityOptions, mIsForward, mProfilerInfo,
                client, mAssistToken, mShareableActivityToken, mLaunchedFromBubble,
                mTaskFragmentToken);
                
        client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    }

LaunchActivityItem 的 execute 方法调用了 ClientTransactionHandler 的 handleLaunchActivity，而这里的 ClientTransactionHandler 就是 ActivityThread。

// frameworks/base/core/java/android/app/ActivityThread.java

    public Activity handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, Intent customIntent) {
        // If we are getting ready to gc after going to the background, well
        // we are back active so skip it.
        unscheduleGcIdler();
        mSomeActivitiesChanged = true;

        // ...
        // 初始化 WindowManagerGlobal
        WindowManagerGlobal.initialize();
       
        // 调用 performLaunchActivity 执行 Activity 的创建流程
        final Activity a = performLaunchActivity(r, customIntent);

        // ...
        return a;
    }

在 handleLaunchActivity 方法中首先去初始化了 WindowManagerGlobal，紧接着调用了 performLaunchActivity 并返回了一个 Activity 实例，那么 Activity 的实例化必定是在 performLaunchActivity 中完成的。

performLaunchActivity 这个方法中的主要逻辑可以分为两部分：

第一部分是实例化 Activity；
第二部分是执行 Activity 的 onCreate 的生命周期；

// frameworks/base/core/java/android/app/ActivityThread.java

    private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
        ActivityInfo aInfo = r.activityInfo;
        // ...

        ContextImpl appContext = createBaseContextForActivity(r);
        Activity activity = null;
        try {
            // 在 Instrumentation 中通过反射实例化 Activity 
            java.lang.ClassLoader cl = appContext.getClassLoader();
            activity = mInstrumentation.newActivity(
                    cl, component.getClassName(), r.intent);
            StrictMode.incrementExpectedActivityCount(activity.getClass());
            r.intent.setExtrasClassLoader(cl);
            r.intent.prepareToEnterProcess(isProtectedComponent(r.activityInfo),
                    appContext.getAttributionSource());
            if (r.state != null) {
                r.state.setClassLoader(cl);
            }
        } catch (Exception e) {
            if (!mInstrumentation.onException(activity, e)) {
                throw new RuntimeException(
                    "Unable to instantiate activity " + component
                    + ": " + e.toString(), e);
            }
        }

        // ... 省略后半部分执行 Activity 生命周期的代码
        return activity;
    }

上面是第一部分的代码，可以看到这里通过 Instrumentation 的 newActivity 获取到一个 Activity 实例，newActivity 的参数传入了一个 ClassLoader 和 Activity 的 className。因此，这里实例化 Activity 的过程一定是通过反射实现的。

    public Activity newActivity(Class<?> clazz, Context context, 
            IBinder token, Application application, Intent intent, ActivityInfo info, 
            CharSequence title, Activity parent, String id,
            Object lastNonConfigurationInstance) throws InstantiationException,
            IllegalAccessException {
        Activity activity = (Activity)clazz.newInstance();
        ActivityThread aThread = null;
        // Activity.attach expects a non-null Application Object.
        if (application == null) {
            application = new Application();
        }
        activity.attach(context, aThread, this, token, 0 /* ident */, application, intent,
                info, title, parent, id,
                (Activity.NonConfigurationInstances)lastNonConfigurationInstance,
                new Configuration(), null /* referrer */, null /* voiceInteractor */,
                null /* window */, null /* activityCallback */, null /*assistToken*/,
                null /*shareableActivityToken*/);
        return activity;
    }

newActivity 中通过反射实例化了 Activity，接着调用了 Activity 的 attach 方法，下面会提到。

接下来看 performLaunchActivity 方法的后半部分的逻辑。在实例化了 Activity 之后是如何调用 Activity 的 onCreate 生命周期的。

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
        ActivityInfo aInfo = r.activityInfo;
        // ...
        try {
            // 获取 Application 
            Application app = r.packageInfo.makeApplicationInner(false, mInstrumentation);

            // ...
            if (activity != null) {
                CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
                Configuration config =
                        new Configuration(mConfigurationController.getCompatConfiguration());
                // ...
                // Activity resources must be initialized with the same loaders as the
                // application context.
                appContext.getResources().addLoaders(
                        app.getResources().getLoaders().toArray(new ResourcesLoader[0]));

                appContext.setOuterContext(activity);
                // 再次执行 Activity 的 attach 方法
                activity.attach(appContext, this, getInstrumentation(), r.token,
                        r.ident, app, r.intent, r.activityInfo, title, r.parent,
                        r.embeddedID, r.lastNonConfigurationInstances, config,
                        r.referrer, r.voiceInteractor, window, r.activityConfigCallback,
                        r.assistToken, r.shareableActivityToken);

                if (customIntent != null) {
                    activity.mIntent = customIntent;
                }
                r.lastNonConfigurationInstances = null;
                checkAndBlockForNetworkAccess();
                activity.mStartedActivity = false;
                int theme = r.activityInfo.getThemeResource();
                if (theme != 0) {
                    // 设置 Activity 主题
                    activity.setTheme(theme);
                }

                if (r.mActivityOptions != null) {
                    activity.mPendingOptions = r.mActivityOptions;
                    r.mActivityOptions = null;
                }
                activity.mLaunchedFromBubble = r.mLaunchedFromBubble;
                activity.mCalled = false;
                // Assigning the activity to the record before calling onCreate() allows
                // ActivityThread#getActivity() lookup for the callbacks triggered from
                // ActivityLifecycleCallbacks#onActivityCreated() or
                // ActivityLifecycleCallback#onActivityPostCreated().
                r.activity = activity;
                // 调用 Activity 的 onCreate 方法
                if (r.isPersistable()) {
                    mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
                } else {
                    mInstrumentation.callActivityOnCreate(activity, r.state);
                }
                // ...
            }
            r.setState(ON_CREATE);
        } catch (SuperNotCalledException e) {
           // ...
        } 
        return activity;
    }

首先获取 Activity 的 title 以及 Configuration 等相关参数，然后再次调用 Activity 的 attach 方法，并将这些参数传入。attach 方法中主要做了初始化 PhoneWindow 的一些操作。

// frameworks/base/core/java/android/app/Activity.java

    final void attach(Context context, ActivityThread aThread,
            Instrumentation instr, IBinder token, int ident,
            Application application, Intent intent, ActivityInfo info,
            CharSequence title, Activity parent, String id,
            NonConfigurationInstances lastNonConfigurationInstances,
            Configuration config, String referrer, IVoiceInteractor voiceInteractor,
            Window window, ActivityConfigCallback activityConfigCallback, IBinder assistToken,
            IBinder shareableActivityToken) {
        attachBaseContext(context);

        mFragments.attachHost(null /*parent*/);
        // 实例化 PhoneWindow，Activity 中持有 PhoneWindow
        mWindow = new PhoneWindow(this, window, activityConfigCallback);
        mWindow.setWindowControllerCallback(mWindowControllerCallback);
        // 将 Activity 自身设置到 PhoneWindow
        mWindow.setCallback(this);
        mWindow.setOnWindowDismissedCallback(this);
        mWindow.getLayoutInflater().setPrivateFactory(this);
        
        // ...
        // PhoneWindow 关联 WindowManager
        mWindow.setWindowManager(
                (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
                mToken, mComponent.flattenToString(),
                (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
        if (mParent != null) {
            mWindow.setContainer(mParent.getWindow());
        }
        // Activity 中持有 WindowManager
        mWindowManager = mWindow.getWindowManager();
        mCurrentConfig = config;

        mWindow.setColorMode(info.colorMode);
        mWindow.setPreferMinimalPostProcessing(
                (info.flags & ActivityInfo.FLAG_PREFER_MINIMAL_POST_PROCESSING) != 0);

        getAutofillClientController().onActivityAttached(application);
        setContentCaptureOptions(application.getContentCaptureOptions());
    }

调用 attach 方法之后，接着通过 Instrumentation 执行了 Activity 的 performCreate 方法，代码如下:

public void callActivityOnCreate(Activity activity, Bundle icicle) {
    prePerformCreate(activity);
    activity.performCreate(icicle);
    postPerformCreate(activity);
}

而 Activity 的 performCreate 方法中最终会调用 Activity 的 onCreate方法。

3.2 执行生命周期executeLifecycleState

在executeLifecycleState中，首先通过cycleToPath补全并执行中间态生命周期，之后调用ActivityLifecycleItem对应实现，这里为ResumeActivityItem的execute方法和postExecute方法。

   private void executeLifecycleState(ClientTransaction transaction) {
        final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
        // ...

        // 第二个参数为执行完时的生命周状态
        cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */, transaction);

        // Execute the final transition with proper parameters.
        lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
        
        lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
    }

在cycleToPath中，由于 executeLifecycleState 方法是在 executeCallback 之后执行的，上面我们已经提到此时的 Activity 已经执行完了创建流程，并执行过了 onCreate 的生命周期。因此，这里的 start 应该是 ON_CREATE 状态，ON_CREATE 的值为 1，目标是ResumeActivityItem.getTargetState 返回的是一个 ON_RESUME值为3。

    private void cycleToPath(ActivityClientRecord r, int finish, boolean excludeLastState,
            ClientTransaction transaction) {
        // 获取当前 Activity 的生命周期状态，即开始时的状态    
        final int start = r.getLifecycleState();
        // 获取要执行的生命周期数组
        final IntArray path = mHelper.getLifecyclePath(start, finish, excludeLastState);
        // 按顺序执行 Activity 的生命周期
        performLifecycleSequence(r, path, transaction);
    }

因此，执行完 getLifecyclePath 后，会得到一个包含了 ON_START 与 ON_RESUME 的数组。

// frameworks/base/core/java/android/app/servertransaction/TransactionExecutorHelper.java

public IntArray getLifecyclePath(int start, int finish, boolean excludeLastState) {
        // ....
        mLifecycleSequence.clear();
        // Activity 启动 时，执行到这里的 start 状态为 ON_CREATE，结束状态为 ON_RESUME
        if (finish >= start) {
            if (start == ON_START && finish == ON_STOP) {
                // A case when we from start to stop state soon, we don't need to go
                // through the resumed, paused state.
                mLifecycleSequence.add(ON_STOP);
            } else {
                // 会走到这里的逻辑，将 ON_START 与 ON_RESUME 添加到数组
                for (int i = start + 1; i <= finish; i++) {
                    mLifecycleSequence.add(i);
                }
            }
        } else { // finish < start, can't just cycle down
            // ....
        }

        // Remove last transition in case we want to perform it with some specific params.
        if (excludeLastState && mLifecycleSequence.size() != 0) {
            mLifecycleSequence.remove(mLifecycleSequence.size() - 1);
        }

        return mLifecycleSequence;
    }

在 performLifecycleSequence分别先后执行了 mTransactionHandler.handleStartActivity 与 mTransactionHandler.handleResumeActivity，即调用了 ApplicationThread 的 handleStartActivity 与 handleResumeActivity 来执行 Activity 的 onStart 与 onResume 的生命周期。

下面我们来依此看一下handleStartActivity方法和handleResumeActivity方法的执行。

// frameworks/base/core/java/android/app/ActivityThread.java

    public void handleStartActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, ActivityOptions activityOptions) {
        final Activity activity = r.activity;
        if (!r.stopped) {
            throw new IllegalStateException("Can't start activity that is not stopped.");
        }
        if (r.activity.mFinished) {
            // TODO(lifecycler): How can this happen?
            return;
        }

        unscheduleGcIdler();
        if (activityOptions != null) {
            activity.mPendingOptions = activityOptions;
        }

        // 调用 Activity 的 performStart 进而执行 onStart
        activity.performStart("handleStartActivity");
        
        // 将生命周状态设置为 ON_START
        r.setState(ON_START);
        // ...
    }

handleStartActivity 的逻辑比较简单，就是调用了 Activity 的 performStart 方法，进而调用了 onStart 方法。

// frameworks/base/core/java/android/app/ActivityThread.java

    public void handleResumeActivity(ActivityClientRecord r, boolean finalStateRequest,
            boolean isForward, boolean shouldSendCompatFakeFocus, String reason) {
        // If we are getting ready to gc after going to the background, well
        // we are back active so skip it.
        unscheduleGcIdler();
        mSomeActivitiesChanged = true;

        // TODO Push resumeArgs into the activity for consideration
        // skip below steps for double-resume and r.mFinish = true case.
        if (!performResumeActivity(r, finalStateRequest, reason)) {
            return;
        }
        
       // ... 省略 Window 的添加逻辑
    }

handleResumeActivity 方法中的逻辑比较复杂，但核心主要有两点：

调用 performResumeActivity 执行 onResume 的生命周期
将 DecorView 添加到 Window 中，核心是 wm.addView(decor, l) 这行代码，即通过 ViewManager 的 addView 方法将 DecorView 添加到了窗口中。窗口的添加过程会完成 DecorView 的布局、测量与绘制。窗口相关的本文暂时不多涉及。

当完成窗口的添加后 Activity 的 View 才被显示出来，且有了宽高。因此在 onResume 中获取不到 View 宽高。

    public boolean performResumeActivity(ActivityClientRecord r, boolean finalStateRequest,
            String reason) {
        if (r.activity.mFinished) {
            // 如果 Activity 已经是finish状态，直接return false
            return false;
        }
        if (r.getLifecycleState() == ON_RESUME) {
            // 如果已经是 Resume 状态 直接return false，避免重复执行
            return false;
        }

        try {
           // ...
           
            // 执行 Activity 的 performResume 进而执行 onResume
            r.activity. performResume(r.startsNotResumed, reason);

            r.state = null;
            r.persistentState = null;
            // 设置 Activity 的状态 为 ON_RESUME
            r.setState(ON_RESUME);

            reportTopResumedActivityChanged(r, r.isTopResumedActivity, "topWhenResuming");
        } catch (Exception e) {
            if (!mInstrumentation.onException(r.activity, e)) {
                throw new RuntimeException("Unable to resume activity "
                        + r.intent.getComponent().toShortString() + ": " + e.toString(), e);
            }
        }
        return true;
    }