背景

AMS 完成启动后，会启动 Launcher 进程。作为Android的桌面程序，也是第一个有 Activity 的进程。

一、Launcher启动流程概述

主要过程分为三个阶段：

1. AMS 向 Zygote发起socket通信前的准备
2. Zygote 处理 AMS的 socket请求过程
3. 执行 Launch进程本身逻辑

二、AMS 向 Zygote发起 socket 通信前的准备

2.1 理清AMS相关类的关系

• ActivityTaskManagerService 简称为 atm。ActivityManagerService 简称为 AMS。

• ActivityTaskManagerInternal 简称为 atmInternal，是atm对外提供能力的封装。ActivityManagerInternal 简称为 amInternal，是AMS对外提供能力的封装。

• LocalServices： 专门用来存储本地服务的。可以简单认为是一个 map 容器。

• atm 中有两个成员变量：

// 抽象类，定义了接口方法。是atm对外提供能力的封装。
//本质上是为了让本进程更好的使用atm，直接就通过LocalServices类管理。避免通过SM。
ActivityTaskManagerInternal mInternal;
// 抽象类，定义了接口方法。是AMS对外提供能力的封装
ActivityManagerInternal mAmInternal;

• AMS中有一个成员变量：

ActivityTaskManagerInternal mAtmInternal;

atm 中有一个静态内部类 LocalService 继承了 ActivityTaskManagerInternal。因此，LocalService才是真正的实现者。

AMS 中也有一个静态内部类 LocalService 继承了 ActivityManagerInternal。因此，LocalService也才是真正的实现者。

2.2 从 systemReady()开始

上篇AMS的启动分析中，我们知道在阶段三种会去启动 launcher 进程。

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
    ...
    mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
    ...
}

经过 2.1 的分析，我们知道 mAtmInternal 的具体实现类其实是 atm 中的静态内部类 LocalService：

2.3 mAtmInternal.startHomeOnAllDisplays()

final class LocalService extends ActivityTaskManagerInternal {

    ...
    @Override
    public boolean startHomeOnAllDisplays(int userId, String reason) {
        synchronized (mGlobalLock) {
            return mRootActivityContainer.startHomeOnAllDisplays(userId, reason);
        }
    }
    ...
 }   

RootActivityContainer.java:

2.4 RootActivityContainer.startHomeOnAllDisplays()

boolean startHomeOnAllDisplays(int userId, String reason) {
    boolean homeStarted = false;
    for (int i = mActivityDisplays.size() - 1; i >= 0; i--) {
        final int displayId = mActivityDisplays.get(i).mDisplayId;
        homeStarted |= startHomeOnDisplay(userId, reason, displayId);
    }
    return homeStarted;
}

遍历所有的屏幕ActivityDisplay，一般只有主屏幕。

boolean startHomeOnDisplay(int userId, String reason, int displayId) {
    return startHomeOnDisplay(userId, reason, displayId, false /* allowInstrumenting */,
            false /* fromHomeKey */);
}

2.5 startHomeOnDisplay()

boolean startHomeOnDisplay(int userId, String reason, int displayId, boolean allowInstrumenting,// fasle
        boolean fromHomeKey //false) {
    // Fallback to top focused display if the displayId is invalid.
    if (displayId == INVALID_DISPLAY) {
        displayId = getTopDisplayFocusedStack().mDisplayId;
    }

    Intent homeIntent = null;
    ActivityInfo aInfo = null;
    if (displayId == DEFAULT_DISPLAY) {
        // 通过AMS 获取intent 
        homeIntent = mService.getHomeIntent();
        aInfo = resolveHomeActivity(userId, homeIntent);
    } else if (shouldPlaceSecondaryHomeOnDisplay(displayId)) {
        Pair<ActivityInfo, Intent> info = resolveSecondaryHomeActivity(userId, displayId);
        aInfo = info.first;
        homeIntent = info.second;
    }
    if (aInfo == null || homeIntent == null) {
        return false;
    }

    if (!canStartHomeOnDisplay(aInfo, displayId, allowInstrumenting)) {
        return false;
    }

    // Updates the home component of the intent.
    // 更新 intent的 component
    homeIntent.setComponent(new ComponentName(aInfo.applicationInfo.packageName, aInfo.name));
    homeIntent.setFlags(homeIntent.getFlags() | FLAG_ACTIVITY_NEW_TASK);
    // Updates the extra information of the intent.
    if (fromHomeKey) {
        homeIntent.putExtra(WindowManagerPolicy.EXTRA_FROM_HOME_KEY, true);
    }
    // Update the reason for ANR debugging to verify if the user activity is the one that
    // actually launched.
    final String myReason = reason + ":" + userId + ":" + UserHandle.getUserId(
            aInfo.applicationInfo.uid) + ":" + displayId;
     // 通过AMS 来启动       
    mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason,
            displayId);
    return true;
}

1. 构造 intent
2. 通过 ActivityStartController 启动 HomeActivity

ActivityStartController:

2.6 ActivityStartController.startHomeActivity()

void startHomeActivity(Intent intent, ActivityInfo aInfo, String reason, int displayId) {
    final ActivityOptions options = ActivityOptions.makeBasic();
    options.setLaunchWindowingMode(WINDOWING_MODE_FULLSCREEN);
    if (!ActivityRecord.isResolverActivity(aInfo.name)) {
        // The resolver activity shouldn't be put in home stack because when the foreground is
        // standard type activity, the resolver activity should be put on the top of current
        // foreground instead of bring home stack to front.
        options.setLaunchActivityType(ACTIVITY_TYPE_HOME);
    }
    options.setLaunchDisplayId(displayId);
    mLastHomeActivityStartResult = obtainStarter(intent, "startHomeActivity: " + reason)
            .setOutActivity(tmpOutRecord)
            .setCallingUid(0)
            .setActivityInfo(aInfo)
            .setActivityOptions(options.toBundle())
            .execute();
    mLastHomeActivityStartRecord = tmpOutRecord[0];
    final ActivityDisplay display =
            mService.mRootActivityContainer.getActivityDisplay(displayId);
    final ActivityStack homeStack = display != null ? display.getHomeStack() : null;
    if (homeStack != null && homeStack.mInResumeTopActivity) {
        // If we are in resume section already, home activity will be initialized, but not
        // resumed (to avoid recursive resume) and will stay that way until something pokes it
        // again. We need to schedule another resume.
        // 开始启动
        mSupervisor.scheduleResumeTopActivities();
    }
}

2.7 ActivityStackSupervisor.scheduleResumeTopActivities()

final void scheduleResumeTopActivities() {
    if (!mHandler.hasMessages(RESUME_TOP_ACTIVITY_MSG)) {
        mHandler.sendEmptyMessage(RESUME_TOP_ACTIVITY_MSG);
    }
}

通过 mHandler( 使用的是 DisplayThread线程的 looper，也就是说切换到了该线程) 发送消息：RESUME_TOP_ACTIVITY_MSG。 看 handleMessage()：

...
case RESUME_TOP_ACTIVITY_MSG: {
    synchronized (mService.mGlobalLock) {
        mRootActivityContainer.resumeFocusedStacksTopActivities();
    }
} break;
...

回到 RootActivityContainer.java中：

2.8 RootActivityContainer.resumeFocusedStacksTopActivities()

boolean resumeFocusedStacksTopActivities() {
    return resumeFocusedStacksTopActivities(null, null, null);
}

boolean resumeFocusedStacksTopActivities(
        ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) { //传入的参数 都是null 

    if (!mStackSupervisor.readyToResume()) {
        return false;
    }

    boolean result = false;
    if (targetStack != null && (targetStack.isTopStackOnDisplay()
            || getTopDisplayFocusedStack() == targetStack)) {
        result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
    }

    for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
        boolean resumedOnDisplay = false;
        final ActivityDisplay display = mActivityDisplays.get(displayNdx);
        for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
            final ActivityStack stack = display.getChildAt(stackNdx);
            final ActivityRecord topRunningActivity = stack.topRunningActivityLocked();
            if (!stack.isFocusableAndVisible() || topRunningActivity == null) {
                continue;
            }
            if (stack == targetStack) {
                // Simply update the result for targetStack because the targetStack had
                // already resumed in above. We don't want to resume it again, especially in
                // some cases, it would cause a second launch failure if app process was dead.
                resumedOnDisplay |= result;
                continue;
            }
            if (display.isTopStack(stack) && topRunningActivity.isState(RESUMED)) {
                // Kick off any lingering app transitions form the MoveTaskToFront operation,
                // but only consider the top task and stack on that display.
                stack.executeAppTransition(targetOptions);
            } else {
                resumedOnDisplay |= topRunningActivity.makeActiveIfNeeded(target);
            }
        }
        if (!resumedOnDisplay) {
            // In cases when there are no valid activities (e.g. device just booted or launcher
            // crashed) it's possible that nothing was resumed on a display. Requesting resume
            // of top activity in focused stack explicitly will make sure that at least home
            // activity is started and resumed, and no recursion occurs.
            final ActivityStack focusedStack = display.getFocusedStack();
            if (focusedStack != null) {
                // 获取到focusedStack，开始resume
                focusedStack.resumeTopActivityUncheckedLocked(target, targetOptions);
            }
        }
    }

    return result;
}

2.9 ActivityStack.resumeTopActivityUncheckedLocked()

ActivityStack.java

boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
    if (mInResumeTopActivity) {
        // Don't even start recursing.
        return false;
    }

    boolean result = false;
    try {
        // Protect against recursion.  //防止递归调用
        mInResumeTopActivity = true;
        result = resumeTopActivityInnerLocked(prev, options);

        // When resuming the top activity, it may be necessary to pause the top activity (for
        // example, returning to the lock screen. We suppress the normal pause logic in
        // {@link #resumeTopActivityUncheckedLocked}, since the top activity is resumed at the
        // end. We call the {@link ActivityStackSupervisor#checkReadyForSleepLocked} again here
        // to ensure any necessary pause logic occurs. In the case where the Activity will be
        // shown regardless of the lock screen, the call to
        // {@link ActivityStackSupervisor#checkReadyForSleepLocked} is skipped.
        final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);
        if (next == null || !next.canTurnScreenOn()) {
            checkReadyForSleep();
        }
    } finally {
        mInResumeTopActivity = false;
    }

    return result;
}

2.9.1 resumeTopActivityInnerLocked()

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
       ... 
    } else {
        // Whoops, need to restart this activity!
        if (!next.hasBeenLaunched) {
            next.hasBeenLaunched = true;
        } else {
            if (SHOW_APP_STARTING_PREVIEW) {
                next.showStartingWindow(null /* prev */, false /* newTask */,
                        false /* taskSwich */);
            }
            if (DEBUG_SWITCH) Slog.v(TAG_SWITCH, "Restarting: " + next);
        }
        if (DEBUG_STATES) Slog.d(TAG_STATES, "resumeTopActivityLocked: Restarting " + next);
        // 回到了supervisor
        mStackSupervisor.startSpecificActivityLocked(next, true, true);
    }
}    

2.10 ActivityStackSupervisor.startSpecificActivityLocked()

ActivityStackSupervisor.java

void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
    // Is this activity's application already running?
    final WindowProcessController wpc =
            mService.getProcessController(r.processName, r.info.applicationInfo.uid);

    boolean knownToBeDead = false;
    if (wpc != null && wpc.hasThread()) {
        try {
           // 如果这个activity的 进程已经启动则走这里。很明显现在还没有
            realStartActivityLocked(r, wpc, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            Slog.w(TAG, "Exception when starting activity "
                    + r.intent.getComponent().flattenToShortString(), e);
        }

        // If a dead object exception was thrown -- fall through to
        // restart the application.
        knownToBeDead = true;
    }

    // Suppress transition until the new activity becomes ready, otherwise the keyguard can
    // appear for a short amount of time before the new process with the new activity had the
    // ability to set its showWhenLocked flags.
    if (getKeyguardController().isKeyguardLocked()) {
        r.notifyUnknownVisibilityLaunched();
    }

    try {
        if (Trace.isTagEnabled(TRACE_TAG_ACTIVITY_MANAGER)) {
            Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "dispatchingStartProcess:"
                    + r.processName);
        }
       // 发送消息 开启进程
        // Post message to start process to avoid possible deadlock of calling into AMS with the
        // ATMS lock held.
        // 往 mH 中发送消息，执行 ActivityManagerInternal::startProcess方法
        final Message msg = PooledLambda.obtainMessage(
                ActivityManagerInternal::startProcess, mService.mAmInternal, r.processName,
                r.info.applicationInfo, knownToBeDead, "activity", r.intent.getComponent());
        mService.mH.sendMessage(msg);
    } finally {
        Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
    }
}

此时，launcher 进程还没有起来，所以下走的是下面逻辑。

obtainMessage()方法传入的是一个 func 函数 参数：ActivityManagerInternal::startProcess。因此，最终会执行这个func()函数。

2.11 ActivityManagerInternal::startProcess

我们知道 ActivityManagerInternal 的具体实现是 AMS中的 LocalService类：

@Override
public void startProcess(String processName, ApplicationInfo info,
        boolean knownToBeDead, String hostingType, ComponentName hostingName) {
    try {
        if (Trace.isTagEnabled(Trace.TRACE_TAG_ACTIVITY_MANAGER)) {
            Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "startProcess:"
                    + processName);
        }
        synchronized (ActivityManagerService.this) {
            //开始启动 process
            startProcessLocked(processName, info, knownToBeDead, 0 /* intentFlags */,
                    new HostingRecord(hostingType, hostingName),
                    false /* allowWhileBooting */, false /* isolated */,
                    true /* keepIfLarge */);
        }
    } finally {
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    }
}

2.11.1 startProcessLocked()

final ProcessRecord startProcessLocked(String processName,
        ApplicationInfo info, boolean knownToBeDead, int intentFlags,
        HostingRecord hostingRecord, boolean allowWhileBooting,
        boolean isolated, boolean keepIfLarge) {
        //  ProcessList 是管理进程的类
    return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
            hostingRecord, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
            null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
            null /* crashHandler */);
}

2.12 ProcessList.startProcessLocked()

ProcessList 是管理进程的类：

final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
        boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord,
        boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
        String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {

        ...
    if (app == null) {
        checkSlow(startTime, "startProcess: creating new process record");
        app = newProcessRecordLocked(info, processName, isolated, isolatedUid, hostingRecord);
        if (app == null) {
            Slog.w(TAG, "Failed making new process record for "
                    + processName + "/" + info.uid + " isolated=" + isolated);
            return null;
        }
        app.crashHandler = crashHandler;
        app.isolatedEntryPoint = entryPoint;
        app.isolatedEntryPointArgs = entryPointArgs;
        checkSlow(startTime, "startProcess: done creating new process record");
    } else {
        // If this is a new package in the process, add the package to the list
        app.addPackage(info.packageName, info.longVersionCode, mService.mProcessStats);
        checkSlow(startTime, "startProcess: added package to existing proc");
    }

    // If the system is not ready yet, then hold off on starting this
    // process until it is.
    if (!mService.mProcessesReady
            && !mService.isAllowedWhileBooting(info)
            && !allowWhileBooting) {
        if (!mService.mProcessesOnHold.contains(app)) {
            mService.mProcessesOnHold.add(app);
        }
        if (DEBUG_PROCESSES) Slog.v(TAG_PROCESSES,
                "System not ready, putting on hold: " + app);
        checkSlow(startTime, "startProcess: returning with proc on hold");
        return app;
    }

    checkSlow(startTime, "startProcess: stepping in to startProcess");
    // 开始启动
    final boolean success = startProcessLocked(app, hostingRecord, abiOverride);
    checkSlow(startTime, "startProcess: done starting proc!");
    return success ? app : null;


}

startProcessLocked() :

2.12.1 startProcessLocked()一

final boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,String abiOverride) {
    return startProcessLocked(app, hostingRecord,
            false /* disableHiddenApiChecks */, false /* mountExtStorageFull */, abiOverride);
}

2.12.2 startProcessLocked()二

boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,
        boolean disableHiddenApiChecks, boolean mountExtStorageFull,//传入的false
        String abiOverride//传入的false) {
   final String seInfo = app.info.seInfo
            + (TextUtils.isEmpty(app.info.seInfoUser) ? "" : app.info.seInfoUser);
    // Start the process.  It will either succeed and return a result containing
    // the PID of the new process, or else throw a RuntimeException.
    // 设置进程的入口类 为  ActivityThread
    final String entryPoint = "android.app.ActivityThread";
    //开始启动 
    return startProcessLocked(hostingRecord, entryPoint, app, uid, gids,
            runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith,
            startTime);
} catch (RuntimeException e) {
    Slog.e(ActivityManagerService.TAG, "Failure starting process " + app.processName, e);

    // Something went very wrong while trying to start this process; one
    // common case is when the package is frozen due to an active
    // upgrade. To recover, clean up any active bookkeeping related to
    // starting this process. (We already invoked this method once when
    // the package was initially frozen through KILL_APPLICATION_MSG, so
    // it doesn't hurt to use it again.)
   
    mService.forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid),
            false, false, true, false, false, app.userId, "start failure");
    return false;
}

2.12.2 startProcessLocked()三

boolean startProcessLocked(HostingRecord hostingRecord,
        String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    app.pendingStart = true;
    app.killedByAm = false;
    app.removed = false;
    app.killed = false;
       ...
    final long startSeq = app.startSeq = ++mProcStartSeqCounter;
    app.setStartParams(uid, hostingRecord, seInfo, startTime);
    app.setUsingWrapper(invokeWith != null
            || SystemProperties.get("wrap." + app.processName) != null);
    mPendingStarts.put(startSeq, app);
    // 异步启动
    if (mService.mConstants.FLAG_PROCESS_START_ASYNC) {
        if (DEBUG_PROCESSES) Slog.i(TAG_PROCESSES,
                "Posting procStart msg for " + app.toShortString());
        mService.mProcStartHandler.post(() -> {
            try {
                final Process.ProcessStartResult startResult = startProcess(app.hostingRecord,
                        entryPoint, app, app.startUid, gids, runtimeFlags, mountExternal,
                        app.seInfo, requiredAbi, instructionSet, invokeWith, app.startTime);
                synchronized (mService) {
                    handleProcessStartedLocked(app, startResult, startSeq);
                }
            } catch (RuntimeException e) {
                synchronized (mService) {
                    Slog.e(ActivityManagerService.TAG, "Failure starting process "
                            + app.processName, e);
                    mPendingStarts.remove(startSeq);
                    app.pendingStart = false;
                    mService.forceStopPackageLocked(app.info.packageName,
                            UserHandle.getAppId(app.uid),
                            false, false, true, false, false, app.userId, "start failure");
                }
            }
        });
        return true;
    } else {
        try {
        // 同步启动 
            final Process.ProcessStartResult startResult = startProcess(hostingRecord,
                    entryPoint, app,
                    uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet,
                    invokeWith, startTime);
            handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                    startSeq, false);
        } catch (RuntimeException e) {
           
            app.pendingStart = false;
            mService.forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid),
                    false, false, true, false, false, app.userId, "start failure");
        }
        return app.pid > 0;
    }
}

FLAG_PROCESS_START_ASYNC=true，走异步启动。 异步和同步都会走到 startProcess():

2.12.3 startProcess()

private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    try {
        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " +
                app.processName);
        checkSlow(startTime, "startProcess: asking zygote to start proc");
        final Process.ProcessStartResult startResult;
        if (hostingRecord.usesWebviewZygote()) { // 从webview进程fork()？
            startResult = startWebView(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null, app.info.packageName,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        } else if (hostingRecord.usesAppZygote()) {
            // 从zygote进程fork()? 是的,我们走这里
           // 创建appzygote 对象 
            final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app);
            // 开启 start 
            startResult = appZygote.getProcess().start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null, app.info.packageName,
                    /*useUsapPool=*/ false,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        } else {
            startResult = Process.start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, invokeWith, app.info.packageName,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        }
        checkSlow(startTime, "startProcess: returned from zygote!");
        return startResult;
    } finally {
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    }
}

1. 新建一个 AppZygote 对象，用来和 zygote 进程通信。此时还没有开始socket连接。
2. 调用start() 方法创建进程。

2.13 AppZygote.getProcess()

ChildZygoteProcess继承 ZygoteProcess ， ZygoteProcess 继承了 AppZygote 类，getProcess()方法，返回的就是 ChildZygoteProcess 对象。

public ChildZygoteProcess getProcess() {
    synchronized (mLock) {
        if (mZygote != null) return mZygote;

        connectToZygoteIfNeededLocked();
        return mZygote;
    }
}

2.13.1 connectToZygoteIfNeededLocked()

private void connectToZygoteIfNeededLocked() {
    String abi = mAppInfo.primaryCpuAbi != null ? mAppInfo.primaryCpuAbi :
            Build.SUPPORTED_ABIS[0];
    try {
        mZygote = Process.ZYGOTE_PROCESS.startChildZygote(
                "com.android.internal.os.AppZygoteInit",
                // 进程名字 有后缀
                mAppInfo.processName + "_zygote",
                mZygoteUid,
                mZygoteUid,
                null,  // gids
                0,  // runtimeFlags
                "app_zygote",  // seInfo
                abi,  // abi
                abi, // acceptedAbiList
                null, // instructionSet
                mZygoteUidGidMin,
                mZygoteUidGidMax);

       // 尝试连接 zygote  
       ZygoteProcess.waitForConnectionToZygote(mZygote.getPrimarySocketAddress());
        
        // preload application code in the zygote
        Log.i(LOG_TAG, "Starting application preload.");
        
        mZygote.preloadApp(mAppInfo, abi);
        
        Log.i(LOG_TAG, "Application preload done.");
    } catch (Exception e) {
        Log.e(LOG_TAG, "Error connecting to app zygote", e);
        stopZygoteLocked();
    }
}

ZYGOTE_PROCESS是 一个 ZygoteProcess 对象。

public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess();

2.13.2 ZygoteProcess.startChildZygote

// 开启一个子zygote进程
public ChildZygoteProcess startChildZygote(final String processClass,
                                           final String niceName,
                                           int uid, int gid, int[] gids,
                                           int runtimeFlags,
                                           String seInfo,
                                           String abi,
                                           String acceptedAbiList,
                                           String instructionSet,
                                           int uidRangeStart,
                                           int uidRangeEnd) {
    // Create an unguessable address in the global abstract namespace.
    final LocalSocketAddress serverAddress = new LocalSocketAddress(
            processClass + "/" + UUID.randomUUID().toString());

    final String[] extraArgs = {Zygote.CHILD_ZYGOTE_SOCKET_NAME_ARG + serverAddress.getName(),
                                Zygote.CHILD_ZYGOTE_ABI_LIST_ARG + acceptedAbiList,
                                Zygote.CHILD_ZYGOTE_UID_RANGE_START + uidRangeStart,
                                Zygote.CHILD_ZYGOTE_UID_RANGE_END + uidRangeEnd};

    Process.ProcessStartResult result;
    try {
        result = startViaZygote(processClass, niceName, uid, gid,
                gids, runtimeFlags, 0 /* mountExternal */, 0 /* targetSdkVersion */, seInfo,
                abi, instructionSet, null /* appDataDir */, null /* invokeWith */,
                true /* startChildZygote */, null /* packageName */,
                false /* useUsapPool */, extraArgs);
    } catch (ZygoteStartFailedEx ex) {
        throw new RuntimeException("Starting child-zygote through Zygote failed", ex);
    }
    // 返回一个 ChildZygoteProcess 对象
    return new ChildZygoteProcess(serverAddress, result.pid);
}

返回一个 ChildZygoteProcess 对象。至此， mZygote 被赋值为 ChildZygoteProcess 对象。

2.13.3 ZygoteProcess 构造方法

public ZygoteProcess() {
    // PRIMARY_SOCKET_NAME = "zygote"
    mZygoteSocketAddress =
            new LocalSocketAddress(Zygote.PRIMARY_SOCKET_NAME,
                                   LocalSocketAddress.Namespace.RESERVED);
    //SECONDARY_SOCKET_NAME = "zygote_secondary"                               
    mZygoteSecondarySocketAddress =
            new LocalSocketAddress(Zygote.SECONDARY_SOCKET_NAME,
                                   LocalSocketAddress.Namespace.RESERVED);

    mUsapPoolSocketAddress =
            new LocalSocketAddress(Zygote.USAP_POOL_PRIMARY_SOCKET_NAME,
                                   LocalSocketAddress.Namespace.RESERVED);
    mUsapPoolSecondarySocketAddress =
            new LocalSocketAddress(Zygote.USAP_POOL_SECONDARY_SOCKET_NAME,
                                   LocalSocketAddress.Namespace.RESERVED);
}

PRIMARY_SOCKET_NAME = "zygote"。 连接的是 zygote socket 服务。

2.13.4 ZygoteProcess.waitForConnectionToZygote()

mZygote.getPrimarySocketAddress() 返回的 LocalSocketAddress 对象。

public static void waitForConnectionToZygote(LocalSocketAddress zygoteSocketAddress) {
    int numRetries = ZYGOTE_CONNECT_TIMEOUT_MS / ZYGOTE_CONNECT_RETRY_DELAY_MS;
    for (int n = numRetries; n >= 0; n--) {
        try {
            // 内部通过 LocalSocket 连接  zygote socket
            final ZygoteState zs =
                    ZygoteState.connect(zygoteSocketAddress, null);
            zs.close();
            return;
        } catch (IOException ioe) {
            Log.w(LOG_TAG,
                    "Got error connecting to zygote, retrying. msg= " + ioe.getMessage());
        }

        try {
            Thread.sleep(ZYGOTE_CONNECT_RETRY_DELAY_MS);
        } catch (InterruptedException ignored) { }
    }
    Slog.wtf(LOG_TAG, "Failed to connect to Zygote through socket "
            + zygoteSocketAddress.getName());
}

内部通过 LocalSocket 连接 zygote socket。

2.14 ZygoteProcess.start()

ChildZygoteProcess 中没有 start()方法，在它的父类 ZygoteProcess 中：

// 开启一个新的进程
public final Process.ProcessStartResult start(@NonNull final String processClass,
                                              final String niceName,
                                              int uid, int gid, @Nullable int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion,
                                              @Nullable String seInfo,
                                              @NonNull String abi,
                                              @Nullable String instructionSet,
                                              @Nullable String appDataDir,
                                              @Nullable String invokeWith,
                                              @Nullable String packageName,
                                              boolean useUsapPool,
                                              @Nullable String[] zygoteArgs) {
    // TODO (chriswailes): Is there a better place to check this value?
    if (fetchUsapPoolEnabledPropWithMinInterval()) {
        informZygotesOfUsapPoolStatus();
    }

    try {
        // 调用 
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, /*startChildZygote=*/ false,
                packageName, useUsapPool, zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        Log.e(LOG_TAG,
                "Starting VM process through Zygote failed");
        throw new RuntimeException(
                "Starting VM process through Zygote failed", ex);
    }
}

startViaZygote():

2.14.1 startViaZygote()

private Process.ProcessStartResult startViaZygote(@NonNull final String processClass,
                                                  @Nullable final String niceName,
                                                  final int uid, final int gid,
                                                  @Nullable final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion,
                                                  @Nullable String seInfo,
                                                  @NonNull String abi,
                                                  @Nullable String instructionSet,
                                                  @Nullable String appDataDir,
                                                  @Nullable String invokeWith,
                                                  boolean startChildZygote,
                                                  @Nullable String packageName,
                                                  boolean useUsapPool,
                                                  @Nullable String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
    ArrayList<String> argsForZygote = new ArrayList<>();

    // --runtime-args, --setuid=, --setgid=,
    // and --setgroups= must go first
    argsForZygote.add("--runtime-args");
    argsForZygote.add("--setuid=" + uid);
    argsForZygote.add("--setgid=" + gid);
    argsForZygote.add("--runtime-flags=" + runtimeFlags);
    if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {
        argsForZygote.add("--mount-external-default");
    } else if (mountExternal == Zygote.MOUNT_EXTERNAL_READ) {
        argsForZygote.add("--mount-external-read");
    } else if (mountExternal == Zygote.MOUNT_EXTERNAL_WRITE) {
        argsForZygote.add("--mount-external-write");
    } else if (mountExternal == Zygote.MOUNT_EXTERNAL_FULL) {
        argsForZygote.add("--mount-external-full");
    } else if (mountExternal == Zygote.MOUNT_EXTERNAL_INSTALLER) {
        argsForZygote.add("--mount-external-installer");
    } else if (mountExternal == Zygote.MOUNT_EXTERNAL_LEGACY) {
        argsForZygote.add("--mount-external-legacy");
    }

    argsForZygote.add("--target-sdk-version=" + targetSdkVersion);

    // --setgroups is a comma-separated list
    if (gids != null && gids.length > 0) {
        StringBuilder sb = new StringBuilder();
        sb.append("--setgroups=");

        int sz = gids.length;
        for (int i = 0; i < sz; i++) {
            if (i != 0) {
                sb.append(',');
            }
            sb.append(gids[i]);
        }

        argsForZygote.add(sb.toString());
    }

    if (niceName != null) {
        argsForZygote.add("--nice-name=" + niceName);
    }

    if (seInfo != null) {
        argsForZygote.add("--seinfo=" + seInfo);
    }

    if (instructionSet != null) {
        argsForZygote.add("--instruction-set=" + instructionSet);
    }

    if (appDataDir != null) {
        argsForZygote.add("--app-data-dir=" + appDataDir);
    }

    if (invokeWith != null) {
        argsForZygote.add("--invoke-with");
        argsForZygote.add(invokeWith);
    }

    if (startChildZygote) {
        argsForZygote.add("--start-child-zygote");
    }

    if (packageName != null) {
        argsForZygote.add("--package-name=" + packageName);
    }

    argsForZygote.add(processClass);

    if (extraArgs != null) {
        Collections.addAll(argsForZygote, extraArgs);
    }

    //构造 socket 参数后，开始往 zygote 发送数据 
    synchronized(mLock) {
        // The USAP pool can not be used if the application will not use the systems graphics
        // driver.  If that driver is requested use the Zygote application start path.
        return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),
                                          useUsapPool,
                                          argsForZygote);
    }
}

2.14.2 zygoteSendArgsAndGetResult()

// 往zygote 发送数据 同时获取结果 
private Process.ProcessStartResult zygoteSendArgsAndGetResult(
        ZygoteState zygoteState, boolean useUsapPool, @NonNull ArrayList<String> args)
        throws ZygoteStartFailedEx {
    // Throw early if any of the arguments are malformed. This means we can
    // avoid writing a partial response to the zygote.
    for (String arg : args) {
        // Making two indexOf calls here is faster than running a manually fused loop due
        // to the fact that indexOf is a optimized intrinsic.
        if (arg.indexOf('\n') >= 0) {
            throw new ZygoteStartFailedEx("Embedded newlines not allowed");
        } else if (arg.indexOf('\r') >= 0) {
            throw new ZygoteStartFailedEx("Embedded carriage returns not allowed");
        }
    }

    /*
     * See com.android.internal.os.ZygoteArguments.parseArgs()
     * Presently the wire format to the zygote process is:
     * a) a count of arguments (argc, in essence)
     * b) a number of newline-separated argument strings equal to count
     *
     * After the zygote process reads these it will write the pid of
     * the child or -1 on failure, followed by boolean to
     * indicate whether a wrapper process was used.
     */
    String msgStr = args.size() + "\n" + String.join("\n", args) + "\n";

    if (useUsapPool && mUsapPoolEnabled && canAttemptUsap(args)) {
        try {
            return attemptUsapSendArgsAndGetResult(zygoteState, msgStr);
        } catch (IOException ex) {
            // If there was an IOException using the USAP pool we will log the error and
            // attempt to start the process through the Zygote.
            Log.e(LOG_TAG, "IO Exception while communicating with USAP pool - "
                    + ex.getMessage());
        }
    }

    return attemptZygoteSendArgsAndGetResult(zygoteState, msgStr);
}

2.14.3 attemptZygoteSendArgsAndGetResult

private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(
        ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx {
    try {
        // 往 zygote 写入的数据
        final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;
        // 从zygote读取数据 
        final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;

        zygoteWriter.write(msgStr); 写入的数据
        zygoteWriter.flush();

        // Always read the entire result from the input stream to avoid leaving
        // bytes in the stream for future process starts to accidentally stumble
        // upon.
        // 读取进程开启的 返回结果
        Process.ProcessStartResult result = new Process.ProcessStartResult();
        result.pid = zygoteInputStream.readInt();
        result.usingWrapper = zygoteInputStream.readBoolean();

        if (result.pid < 0) {
            throw new ZygoteStartFailedEx("fork() failed");
        }
        // 返回结果
        return result;
    } catch (IOException ex) {
        zygoteState.close();
        Log.e(LOG_TAG, "IO Exception while communicating with Zygote - "
                + ex.toString());
        throw new ZygoteStartFailedEx(ex);
    }
}

在这里真正完成与 zygote 通信读写数据。把启动 launcher 进程的命令通过 socket 发送到 zygote 中。

2.15 阶段一时序图

经过一系列的类参与工作，launcher启动的第一阶段终于完毕。

那么 zygote 又是如何接收数据的呢 ？

三、Zygote 进程处理 socket请求过程

在 zygote 进程启动篇中，我们知道 zygote 进程在启动后，会创建socket服务端，且会一直监听 客户端 socket 发来的请求。 具体过程看 zygote启动篇文章，这里简单总结：

zygote启动完成native侧工作后，会通过jni调用 zygoteInit.java 类的 main()方法。其中就会调用 zygoteServer.runSelectLoop()方法开启循环监听socket请求。

一旦有数据到来，则会调用 Zygote.forkAndSpecialize()方法来创建一个新的进程，进入子进程环境，调用ZygoteInit.zygoteInit()方法：

public static final Runnable zygoteInit(int targetSdkVersion, String[] argv,
        ClassLoader classLoader) {
    if (RuntimeInit.DEBUG) {
        Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
    }

    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
    RuntimeInit.redirectLogStreams();
    // 设置通用信息
    RuntimeInit.commonInit();
    //创建binder线程，talkWitchDriver()不断的与binder通信
    ZygoteInit.nativeZygoteInit();  
    // 反射调用activityThread的main()方法
    return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
}

1. 设置通用信息
2. 创建binder线程, talkWitchDriver()不断的与binder通信
3. 反射调用 ActivityThread 的main()方法

至此，zygote 进程处理完毕。现在 launcher 进程已经完全启动了起来。

3.1 阶段二时序图

四、执行 Launcher 进程逻辑

launcher进程既然已经启动，那么需要知道它启动后，做了什么操作。

看 ActivityThread 的 main()方法：

public static void main(String[] args) {
    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");

    // Install selective syscall interception
    AndroidOs.install();

    // CloseGuard defaults to true and can be quite spammy.  We
    // disable it here, but selectively enable it later (via
    // StrictMode) on debug builds, but using DropBox, not logs.
    CloseGuard.setEnabled(false);

    Environment.initForCurrentUser();

    // Make sure TrustedCertificateStore looks in the right place for CA certificates
    final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
    TrustedCertificateStore.setDefaultUserDirectory(configDir);

    Process.setArgV0("<pre-initialized>");
    // 准备looper
    Looper.prepareMainLooper();

    // Find the value for {@link #PROC_START_SEQ_IDENT} if provided on the command line.
    // It will be in the format "seq=114"
    long startSeq = 0;
    if (args != null) {
        for (int i = args.length - 1; i >= 0; --i) {
            if (args[i] != null && args[i].startsWith(PROC_START_SEQ_IDENT)) {
                startSeq = Long.parseLong(
                        args[i].substring(PROC_START_SEQ_IDENT.length()));
            }
        }
    }
    // 创建 ActivityThread 类对象
    ActivityThread thread = new ActivityThread();
    // attch方法
    thread.attach(false, startSeq);
    // 创建主线程 handler
    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

    if (false) {
        Looper.myLooper().setMessageLogging(new
                LogPrinter(Log.DEBUG, "ActivityThread"));
    }

    // End of event ActivityThreadMain.
    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    // 开启looper循环 
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

1. 准备looper
2. 构造 ActivityThread 对象
3. 调用attach()

4.1 ActivityThread 构造方法

ActivityThread() {
    mResourcesManager = ResourcesManager.getInstance();
}

很简单，创建了一个 mResourcesManager 对象。

4.2 attach()

private void attach(boolean system, long startSeq) {
    sCurrentActivityThread = this;
    mSystemThread = system; //false ，不是系统线程
    if (!system) {
        android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                UserHandle.myUserId());
         // 往 RuntimeInit 设置launcher app侧的binder服务对象： ApplicationThread                                       
        RuntimeInit.setApplicationObject(mAppThread.asBinder());
        // 获取 AMS 在客户端的代理对象 mgr
        final IActivityManager mgr = ActivityManager.getService();
        try {
            // 告知 AMS zygote进程已经帮我启动好啦！mAppThread：这是我的服务binder对象。
            mgr.attachApplication(mAppThread, startSeq);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
        // Watch for getting close to heap limit.
        BinderInternal.addGcWatcher(new Runnable() {
            @Override public void run() {
                if (!mSomeActivitiesChanged) {
                    return;
                }
                Runtime runtime = Runtime.getRuntime();
                long dalvikMax = runtime.maxMemory();
                long dalvikUsed = runtime.totalMemory() - runtime.freeMemory();
                if (dalvikUsed > ((3*dalvikMax)/4)) {
                    if (DEBUG_MEMORY_TRIM) Slog.d(TAG, "Dalvik max=" + (dalvikMax/1024)
                            + " total=" + (runtime.totalMemory()/1024)
                            + " used=" + (dalvikUsed/1024));
                    mSomeActivitiesChanged = false;
                    try {
                        ActivityTaskManager.getService().releaseSomeActivities(mAppThread);
                    } catch (RemoteException e) {
                        throw e.rethrowFromSystemServer();
                    }
                }
            }
        });
    } else {
        ... 
    }

    ViewRootImpl.ConfigChangedCallback configChangedCallback
            = (Configuration globalConfig) -> {
        synchronized (mResourcesManager) {
            // We need to apply this change to the resources immediately, because upon returning
            // the view hierarchy will be informed about it.
            if (mResourcesManager.applyConfigurationToResourcesLocked(globalConfig,
                    null /* compat */)) {
                updateLocaleListFromAppContext(mInitialApplication.getApplicationContext(),
                        mResourcesManager.getConfiguration().getLocales());

                // This actually changed the resources! Tell everyone about it.
                if (mPendingConfiguration == null
                        || mPendingConfiguration.isOtherSeqNewer(globalConfig)) {
                    mPendingConfiguration = globalConfig;
                    sendMessage(H.CONFIGURATION_CHANGED, globalConfig);
                }
            }
        }
    };
    ViewRootImpl.addConfigCallback(configChangedCallback);
}

1. 往 RuntimeInit中设置 mApplicationObject
2. 通过binder，告知 AMS app进程已经启动完成。同时会把app端的 binder服务 ：ApplicationThread 也传递过去，方便 AMS 后续跟我们通信。

4.3 AMS.attachApplication()

@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    synchronized (this) {
        // 调用者的进程id
        int callingPid = Binder.getCallingPid();
        // 调用者的userid
        final int callingUid = Binder.getCallingUid();
        final long origId = Binder.clearCallingIdentity();
        // 
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}

这就是利用 binder机制 来实现的跨进程通信。往 AMS 备案。

4.3.1 attachApplicationLocked()

private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
        
        ...
        
    } else if (instr2 != null) {
        //  thread 就是 IApplicationThread对象
        thread.bindApplication(processName, appInfo, providers,
                instr2.mClass,
                profilerInfo, instr2.mArguments,
                instr2.mWatcher,
                instr2.mUiAutomationConnection, testMode,
                mBinderTransactionTrackingEnabled, enableTrackAllocation,
                isRestrictedBackupMode || !normalMode, app.isPersistent(),
                new Configuration(app.getWindowProcessController().getConfiguration()),
                app.compat, getCommonServicesLocked(app.isolated),
                mCoreSettingsObserver.getCoreSettingsLocked(),
                buildSerial, autofillOptions, contentCaptureOptions);
    } else {
        // 测试模式
        thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                null, null, null, testMode,
                mBinderTransactionTrackingEnabled, enableTrackAllocation,
                isRestrictedBackupMode || !normalMode, app.isPersistent(),
                new Configuration(app.getWindowProcessController().getConfiguration()),
                app.compat, getCommonServicesLocked(app.isolated),
                mCoreSettingsObserver.getCoreSettingsLocked(),
                buildSerial, autofillOptions, contentCaptureOptions);
    }
    
    ...
    
// See if the top visible activity is waiting to run in this process...
// 进程已经启动了，那么我们要看看是不是有activity需要显示？？
if (normalMode) {
    try {
        didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
    } catch (Exception e) {
        Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
        badApp = true;
    }
}

// Find any services that should be running in this process...
// 是否有 services需要启动？ 
if (!badApp) {
    try {
        didSomething |= mServices.attachApplicationLocked(app, processName);
        checkTime(startTime, "attachApplicationLocked: after mServices.attachApplicationLocked");
    } catch (Exception e) {
        Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
        badApp = true;
    }
}

// Check if a next-broadcast receiver is in this process...
//是否有广播？？
if (!badApp && isPendingBroadcastProcessLocked(pid)) {
    try {
        didSomething |= sendPendingBroadcastsLocked(app);
        checkTime(startTime, "attachApplicationLocked: after sendPendingBroadcastsLocked");
    } catch (Exception e) {
        // If the app died trying to launch the receiver we declare it 'bad'
        Slog.wtf(TAG, "Exception thrown dispatching broadcasts in " + app, e);
        badApp = true;
    }
}

... 

}

1. 通过 IApplicationThread 再次跨进程告诉 app(也就是launcher)进程，开始绑定。
2. 调用 atm 的 attachApplication()方法，来启动 正在等待的 activity。
3. 进程已经启动，是否有services需要启动？
4. 进程已经启动，是否有 broadcast需要发送？

我先回到 launcher进程看看是如何绑定的？

4.4 ActivityThread.bindApplication()

public final void bindApplication(String processName, ApplicationInfo appInfo,
        List<ProviderInfo> providers, ComponentName instrumentationName,
        ProfilerInfo profilerInfo, Bundle instrumentationArgs,
        IInstrumentationWatcher instrumentationWatcher,
        IUiAutomationConnection instrumentationUiConnection, int debugMode,
        boolean enableBinderTracking, boolean trackAllocation,
        boolean isRestrictedBackupMode, boolean persistent, Configuration config,
        CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
        String buildSerial, AutofillOptions autofillOptions,
        ContentCaptureOptions contentCaptureOptions) {
    if (services != null) {
        ...

        // Setup the service cache in the ServiceManager
        ServiceManager.initServiceCache(services);
    }
    // 核心设置变化，则会重新launch activity。
    setCoreSettings(coreSettings);
    // 构建appBinderData
    AppBindData data = new AppBindData();
    data.processName = processName;
    data.appInfo = appInfo;
    data.providers = providers;
    data.instrumentationName = instrumentationName;
    data.instrumentationArgs = instrumentationArgs;
    data.instrumentationWatcher = instrumentationWatcher;
    data.instrumentationUiAutomationConnection = instrumentationUiConnection;
    data.debugMode = debugMode;
    data.enableBinderTracking = enableBinderTracking;
    data.trackAllocation = trackAllocation;
    data.restrictedBackupMode = isRestrictedBackupMode;
    data.persistent = persistent;
    data.config = config;
    data.compatInfo = compatInfo;
    data.initProfilerInfo = profilerInfo;
    data.buildSerial = buildSerial;
    data.autofillOptions = autofillOptions;
    data.contentCaptureOptions = contentCaptureOptions;
    // 发送消息 BIND_APPLICATION 给主线程
    sendMessage(H.BIND_APPLICATION, data);
}

1. 核心设置变化，则会重新launch activity
2. 发送消息 BIND_APPLICATION= 110 给主线程

4.4.1 handleBindApplication()

private void handleBindApplication(AppBindData data) {

    ...
    //1 初始化 instrumentation 对象 
   // 走的这个分支
    try {
        final ClassLoader cl = instrContext.getClassLoader();
        mInstrumentation = (Instrumentation)
            cl.loadClass(data.instrumentationName.getClassName()).newInstance();
    } catch (Exception e) {
        throw new RuntimeException(
            "Unable to instantiate instrumentation "
            + data.instrumentationName + ": " + e.toString(), e);
    }

    final ComponentName component = new ComponentName(ii.packageName, ii.name);
    mInstrumentation.init(this, instrContext, appContext, component,
            data.instrumentationWatcher, data.instrumentationUiAutomationConnection);
    
     }else {
        mInstrumentation = new Instrumentation();
        mInstrumentation.basicInit(this);
    }
    ... 
    // 2 创建 Application app; 注意最后一个参数instrumentation 传入的是null！
    
    // If the app is being launched for full backup or restore, bring it up in
    // a restricted environment with the base application class.
    
    app = data.info.makeApplication(data.restrictedBackupMode, null);

    
     ...
    // don't bring up providers in restricted mode; they may depend on the
    // app's custom Application class
    3 启动 providers 
    if (!data.restrictedBackupMode) {
        if (!ArrayUtils.isEmpty(data.providers)) {
            installContentProviders(app, data.providers);
        }
    }

    // Do this after providers, since instrumentation tests generally start their
    // test thread at this point, and we don't want that racing.
    try {
        mInstrumentation.onCreate(data.instrumentationArgs);
    }
    catch (Exception e) {
        throw new RuntimeException(
            "Exception thrown in onCreate() of "
            + data.instrumentationName + ": " + e.toString(), e);
    }
    try {
        // 4 回调application的 onCreate方法
        mInstrumentation.callApplicationOnCreate(app);
    } catch (Exception e) {
        if (!mInstrumentation.onException(app, e)) {
            throw new RuntimeException(
              "Unable to create application " + app.getClass().getName()
              + ": " + e.toString(), e);
        }
    }
    
    ...
}

1. 初始化 instrumentation 对象
2. 创建 Application app。内部创建了一个 ContextImpl 对象，同时会回调application的 attachBaseContext() 方法回调。
3. 启动 providers ，会回调 provider 的 onCreate() 方法
4. 回调application的 onCreate() 方法

从这里，我们知道：

• application的 attachBaseContext() 方法优先调用
• provider的onCreate方法接着调用
• application的 onCreate()方法 最后被调用

Application 已经创建完毕，现在需要处理之前在等待的activity了！ 让我们在回到 AMS 中去吧！

4.5 atm. attachApplication()

最终会调用到 RootActivityContainer的 attachApplication()方法，再调用ActivityStackSuperVisor的 mStackSupervisor.realStartActivityLocked()方法：

boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
        boolean andResume, boolean checkConfig) throws RemoteException {

        ...
        
    // Create activity launch transaction.
    // 创建一个 activity的 启动事务
    final ClientTransaction clientTransaction = ClientTransaction.obtain(
            proc.getThread(), r.appToken);

    final DisplayContent dc = r.getDisplay().mDisplayContent;
    
    //新建一个  LaunchActivityItem 对象
    // 加入到 callbacks列表中:private List<ClientTransactionItem> mActivityCallbacks;
    
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
            System.identityHashCode(r), r.info,
            // TODO: Have this take the merged configuration instead of separate global
            // and override configs.
            mergedConfiguration.getGlobalConfiguration(),
            mergedConfiguration.getOverrideConfiguration(), r.compat,
            r.launchedFromPackage, task.voiceInteractor, proc.getReportedProcState(),
            r.icicle, r.persistentState, results, newIntents,
            dc.isNextTransitionForward(), proc.createProfilerInfoIfNeeded(),
                    r.assistToken));

    // Set desired final state.
    // 准备回调Activity生命周期
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) { //
    // obtain一个 ResumeActivityItem 对象

        lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward());
    } else {
        // obtain一个 PauseActivityItem 对象
        lifecycleItem = PauseActivityItem.obtain();
    }
    //设置生命周期
    clientTransaction.setLifecycleStateRequest(lifecycleItem);

    
    // Schedule transaction. 开始执行事务
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);

}        

1. 创建一个 activity的 启动事务：ClientTransaction
2. 新建一个 LaunchActivityItem 对象加入到 callbacks列表中
3. 给 clientTransaction 设置Activity 生命周期请求(ResumeActivityItem 对象), 此时 andResume=true。
4. 通过 ClientLifecycleManager 开启事务

4.5.1 ClientLifecycleManager.scheduleTransaction()

void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    final IApplicationThread client = transaction.getClient();
    transaction.schedule();
    if (!(client instanceof Binder)) {
        // If client is not an instance of Binder - it's a remote call and at this point it is
        // safe to recycle the object. All objects used for local calls will be recycled after
        // the transaction is executed on client in ActivityThread.
        transaction.recycle();
    }
}

内部调用了 ClientTransaction 的 schedule()：

4.5.1 ClientTransaction.schedule()

private IApplicationThread mClient; //表示app端 


public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this);
}

IApplicationThread 实现者是 ActivityThread 中的静态内部类： ApplicationThread。

跨进程把system 进程的 ClientTransaction 对象传递给 app 进程，通知app端执行这个 scheduleTransaction(this)方法：

既然能在进程中传递，那么 ClientTransaction 肯定是 parcelable 对象。

4.6 ApplicationThread.scheduleTransaction()

@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    ActivityThread.this.scheduleTransaction(transaction);
}

调用了 ActivityThread 的 scheduleTransaction()方法。ActivityThread本身没有这个方法，但是它继承的父类 ClientTransactionHandler 就有：

ClientTransactionHandler.java

void scheduleTransaction(ClientTransaction transaction) {
    transaction.preExecute(this);
    sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

ClientTransactionHandler 这个类用来干什么？？就是用来发送消息，为执行之前的事务做准备。

1. 先调用 事务的 preExecute()方法
2. 最终通过发送消息给主线程，我们看看主线程的 handleMessage() 是如何处理的：

ActivityThread.java

// An executor that performs multi-step transactions.
private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);

case EXECUTE_TRANSACTION:
    final ClientTransaction transaction = (ClientTransaction) msg.obj;
    //获取事务对象，开始执行 execute
    mTransactionExecutor.execute(transaction);
    if (isSystem()) {
        // Client transactions inside system process are recycled on the client side
        // instead of ClientLifecycleManager to avoid being cleared before this
        // message is handled. // 处理完毕，回收事务
        transaction.recycle();
    }
    // TODO(lifecycler): Recycle locally scheduled transactions.
    break;

• 创建 TransactionExecutor 对象，用来执行事务

• 获取事务对象，在 app 主线程开始执行 mTransactionExecutor.execute(transaction)。

4.7 TransactionExecutor.execute()

public void execute(ClientTransaction transaction) {
    if (DEBUG_RESOLVER) Slog.d(TAG, tId(transaction) + "Start resolving transaction");

    final IBinder token = transaction.getActivityToken();
    
    //...
    
    if (DEBUG_RESOLVER) Slog.d(TAG, transactionToString(transaction, mTransactionHandler));
    //执行 atm 之前添加的 LaunchActivityItem 对象
    executeCallbacks(transaction);
    // 执行生命周期？？
    executeLifecycleState(transaction);
    mPendingActions.clear();
    if (DEBUG_RESOLVER) Slog.d(TAG, tId(transaction) + "End resolving transaction");
}

1. executeCallbacks() 内部会调用 ClientTransactionItem 的 excecute方法。
2. executeLifecycleState() 生命周期状态。内部调用 ActivityLifecycleItem 的 excecute方法。

4.7.1 executeCallbacks() 执行真正的事务

public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    ...
    final IBinder token = transaction.getActivityToken();
    ActivityClientRecord r = mTransactionHandler.getActivityClient(token);

    // In case when post-execution state of the last callback matches the final state requested
    // for the activity in this transaction, we won't do the last transition here and do it when
    // moving to final state instead (because it may contain additional parameters from server).
    final ActivityLifecycleItem finalStateRequest = transaction.getLifecycleStateRequest();
    final int finalState = finalStateRequest != null ? finalStateRequest.getTargetState()
            : UNDEFINED;
    // Index of the last callback that requests some post-execution state.
    final int lastCallbackRequestingState = lastCallbackRequestingState(transaction);

    final int size = callbacks.size();
    //遍历callbacs 
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        if (DEBUG_RESOLVER) Slog.d(TAG, tId(transaction) + "Resolving callback: " + item);
        final int postExecutionState = item.getPostExecutionState();
        final int closestPreExecutionState = mHelper.getClosestPreExecutionState(r,
                item.getPostExecutionState());
        if (closestPreExecutionState != UNDEFINED) {
            cycleToPath(r, closestPreExecutionState, transaction);
        }
        // 执行事务
        item.execute(mTransactionHandler, token, mPendingActions);
        item.postExecute(mTransactionHandler, token, mPendingActions);
        if (r == null) {
            // Launch activity request will create an activity record.
            r = mTransactionHandler.getActivityClient(token);
        }

        if (postExecutionState != UNDEFINED && r != null) {
            // Skip the very last transition and perform it by explicit state request instead.
            final boolean shouldExcludeLastTransition =
                    i == lastCallbackRequestingState && finalState == postExecutionState;
            cycleToPath(r, postExecutionState, shouldExcludeLastTransition, transaction);
        }
    }
}

会执行 两个方法： execute、postExecute方法。 preExecute 前面已经执行过了。

4.7.1.1 LaunchActivityItem 的execute()

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    //创建  ActivityClientRecord r对象 
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
            mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
            mPendingResults, mPendingNewIntents, mIsForward,
            mProfilerInfo, client, mAssistToken);
           //  handleLaunchActivity
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

1. 创建 ActivityClientRecord r对象
2. 调用 handleLaunchActivity。 client 是一个 ClientTransactionHandler，具体实现就是 ActivityThread 对象。

4.7.1.2 handleLaunchActivity()

public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
    // If we are getting ready to gc after going to the background, well
    // we are back active so skip it.
    unscheduleGcIdler();
    mSomeActivitiesChanged = true;
    ... 

    final Activity a = performLaunchActivity(r, customIntent);

    if (a != null) {
    // 创建 activity 成功
        r.createdConfig = new Configuration(mConfiguration);
        reportSizeConfigurations(r);
        if (!r.activity.mFinished && pendingActions != null) {
            pendingActions.setOldState(r.state);
            pendingActions.setRestoreInstanceState(true);
            pendingActions.setCallOnPostCreate(true);
        }
    } else {
    // 失败则告诉AMS
        // If there was an error, for any reason, tell the activity manager to stop us.
        try {
            ActivityTaskManager.getService()
                    .finishActivity(r.token, Activity.RESULT_CANCELED, null,
                            Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
    }

    return a;
}

ActivityThread 的 handleLaunchActivity() 会调用 performLaunchActivity()方法：

4.7.1.3 performLaunchActivity()

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }

    ComponentName component = r.intent.getComponent();
    if (component == null) {
        component = r.intent.resolveActivity(
            mInitialApplication.getPackageManager());
        r.intent.setComponent(component);
    }

    if (r.activityInfo.targetActivity != null) {
        component = new ComponentName(r.activityInfo.packageName,
                r.activityInfo.targetActivity);
    }
    // 1 创建 activity的 mBase:context 对象。 
    ContextImpl appContext = createBaseContextForActivity(r);
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        // 2 通过反射构造 activity 对象
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
        StrictMode.incrementExpectedActivityCount(activity.getClass());
        r.intent.setExtrasClassLoader(cl);
        r.intent.prepareToEnterProcess();
        if (r.state != null) {
            r.state.setClassLoader(cl);
        }
    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to instantiate activity " + component
                + ": " + e.toString(), e);
        }
    }

    try {
        // 3, 构造 Application对象。 这里不会重新创建，因为在bindApplication阶段已经创建过了
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);

        if (localLOGV) Slog.v(TAG, "Performing launch of " + r);
        if (localLOGV) Slog.v(
                TAG, r + ": app=" + app
                + ", appName=" + app.getPackageName()
                + ", pkg=" + r.packageInfo.getPackageName()
                + ", comp=" + r.intent.getComponent().toShortString()
                + ", dir=" + r.packageInfo.getAppDir());

        if (activity != null) {
            CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
            Configuration config = new Configuration(mCompatConfiguration);
            if (r.overrideConfig != null) {
                config.updateFrom(r.overrideConfig);
            }
            if (DEBUG_CONFIGURATION) Slog.v(TAG, "Launching activity "
                    + r.activityInfo.name + " with config " + config);
            // 4 , 绑定window 
            Window window = null;
            if (r.mPendingRemoveWindow != null && r.mPreserveWindow) {
                window = r.mPendingRemoveWindow;
                r.mPendingRemoveWindow = null;
                r.mPendingRemoveWindowManager = null;
            }
            appContext.setOuterContext(activity);
            //5, attach 方法
            activity.attach(appContext, this, getInstrumentation(), r.token,
                    r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor, window, r.configCallback,
                    r.assistToken);

            if (customIntent != null) {
                activity.mIntent = customIntent;
            }
            r.lastNonConfigurationInstances = null;
            checkAndBlockForNetworkAccess();
            activity.mStartedActivity = false;
            int theme = r.activityInfo.getThemeResource();
            // 6 ,设置主题 
            if (theme != 0) {
                activity.setTheme(theme);
            }

            activity.mCalled = false;
            if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
            // 7 ，调用 activity的onCreate 方法
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }
            if (!activity.mCalled) {
                throw new SuperNotCalledException(
                    "Activity " + r.intent.getComponent().toShortString() +
                    " did not call through to super.onCreate()");
            }
            r.activity = activity;
        }
        r.setState(ON_CREATE);

        // updatePendingActivityConfiguration() reads from mActivities to update
        // ActivityClientRecord which runs in a different thread. Protect modifications to
        // mActivities to avoid race.
        synchronized (mResourcesManager) {
            mActivities.put(r.token, r);
        }

    } catch (SuperNotCalledException e) {
        throw e;

    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to start activity " + component
                + ": " + e.toString(), e);
        }
    }

    return activity;
}

这是Activity启动的核心内容：

1. 创建 activity 的 mBase:context 对象。
2. 通过反射构造 activity 对象
3. 构造 Application 对象。 这里不会重新创建，因为在 bindApplication 阶段已经创建过了
4. 绑定window
5. attach 方法
6. 设置主题
7. 调用 activity的 onCreate() 方法, Activity启动完成！

重点看下 Activity 的 attach()方法

4.7.1.4 Activity.attach()

final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor,
        Window window, ActivityConfigCallback activityConfigCallback, IBinder assistToken) {
        //设置 mBase。 context上下文
    attachBaseContext(context);
    // fragments attach
    mFragments.attachHost(null /*parent*/);
    // window对象创建
    mWindow = new PhoneWindow(this, window, activityConfigCallback);
    mWindow.setWindowControllerCallback(this);
    mWindow.setCallback(this);
    mWindow.setOnWindowDismissedCallback(this);
    mWindow.getLayoutInflater().setPrivateFactory(this);
    if (info.softInputMode != WindowManager.LayoutParams.SOFT_INPUT_STATE_UNSPECIFIED) {
        mWindow.setSoftInputMode(info.softInputMode);
    }
    if (info.uiOptions != 0) {
        mWindow.setUiOptions(info.uiOptions);
    }
    mUiThread = Thread.currentThread();

    mMainThread = aThread;
    mInstrumentation = instr;
    mToken = token;
    mAssistToken = assistToken;
    mIdent = ident;
    mApplication = application;
    mIntent = intent;
    mReferrer = referrer;
    mComponent = intent.getComponent();
    mActivityInfo = info;
    mTitle = title;
    mParent = parent;
    mEmbeddedID = id;
    mLastNonConfigurationInstances = lastNonConfigurationInstances;
    if (voiceInteractor != null) {
        if (lastNonConfigurationInstances != null) {
            mVoiceInteractor = lastNonConfigurationInstances.voiceInteractor;
        } else {
            mVoiceInteractor = new VoiceInteractor(voiceInteractor, this, this,
                    Looper.myLooper());
        }
    }
    // 给 window设置 wms 
    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
    if (mParent != null) {
        mWindow.setContainer(mParent.getWindow());
    }
    mWindowManager = mWindow.getWindowManager();
    mCurrentConfig = config;

    mWindow.setColorMode(info.colorMode);

    setAutofillOptions(application.getAutofillOptions());
    setContentCaptureOptions(application.getContentCaptureOptions());
}

1. 设置上下文 context
2. mFragments attach
3. window 创建，设置 WMS

mToken为何物？

答： 是一个 IBinder对象。 其实是 IApplicationToken.Stub的子类： Token(ActivityRecord 的内部类)。

本质上 持有ActivityRecord的弱引用，同时还有一个名字。可以简单的认为就是 ActivityRecord。

static class Token extends IApplicationToken.Stub {
       private final WeakReference<ActivityRecord> weakActivity;
       private final String name;

       Token(ActivityRecord activity, Intent intent) {
           weakActivity = new WeakReference<>(activity);
           name = intent.getComponent().flattenToShortString();
       }

ActivityRecord.java 的内部类

final IApplicationToken.Stub appToken; // window manager token

IApplicationToken.aidl的定义：

interface IApplicationToken
22  {
23    String getName();
24  }
25  

至此，Activity 真正启动完成！onCreate(）方法也已经被回调了。那么生命周期调度呢？ 让我们再回到 TransactionExecutor 的 executeLifecycleState 方法：

4.7.2 executeLifecycleState() 调度Activity生命周期

private void executeLifecycleState(ClientTransaction transaction) {
    final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
    if (lifecycleItem == null) {
        // No lifecycle request, return early.
        return;
    }

    final IBinder token = transaction.getActivityToken();
    final ActivityClientRecord r = mTransactionHandler.getActivityClient(token);
       ...

    if (r == null) {
        // Ignore requests for non-existent client records for now.
        return;
    }

    // 调整 Activity 的生命周期状态
    // Cycle to the state right before the final requested state.
    cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */, transaction);

    // Execute the final transition with proper parameters.
    //开始执行
    lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
    lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
}

1. 在开始请求之前，先完善 Activity 的生命周期状态。getTargetState()此时返回的是 OnResume 阶段。
2. 开始执行 execute()

ActivityLifecycleItem 的子类有四个： ResumeActivityItem、PauseActivityItem、StopActivityItem、DestroyActivityItem。

这里，我们关注的是 ResumeActivityItem。

4.7.2.1 cycleToPath()

ActivityLifecycleItem.java

@IntDef(prefix = { "UNDEFINED", "PRE_", "ON_" }, value = {
        UNDEFINED,
        PRE_ON_CREATE,
        ON_CREATE,
        ON_START,
        ON_RESUME,
        ON_PAUSE,
        ON_STOP,
        ON_DESTROY,
        ON_RESTART
})

private void cycleToPath(ActivityClientRecord r, int finish, boolean excludeLastState,
        ClientTransaction transaction) {
        // 此时 start= ON_CREATE
    final int start = r.getLifecycleState();
    // finish =ON_RESUME
    final IntArray path = mHelper.getLifecyclePath(start, finish, excludeLastState);
    performLifecycleSequence(r, path, transaction);
}

4.7.2.2 getLifecyclePath()

public IntArray getLifecyclePath(int start, int finish, boolean excludeLastState) {
    if (start == UNDEFINED || finish == UNDEFINED) {
        throw new IllegalArgumentException("Can't resolve lifecycle path for undefined state");
    }
    if (start == ON_RESTART || finish == ON_RESTART) {
        throw new IllegalArgumentException(
                "Can't start or finish in intermittent RESTART state");
    }
    if (finish == PRE_ON_CREATE && start != finish) {
        throw new IllegalArgumentException("Can only start in pre-onCreate state");
    }

    mLifecycleSequence.clear();
    if (finish >= start) {
    // 正常逻辑，ON_START+1 -> ON_RESUME：加入列表 ON_START、ON_RESUME
        // just go there
        for (int i = start + 1; i <= finish; i++) {
            mLifecycleSequence.add(i);
        }
    } else { // finish < start, can't just cycle down 
    // 异常逻辑处理 
        if (start == ON_PAUSE && finish == ON_RESUME) {
            // Special case when we can just directly go to resumed state.
            mLifecycleSequence.add(ON_RESUME);
        } else if (start <= ON_STOP && finish >= ON_START) {
            // Restart and go to required state.

            // Go to stopped state first.
            for (int i = start + 1; i <= ON_STOP; i++) {
                mLifecycleSequence.add(i);
            }
            // Restart
            mLifecycleSequence.add(ON_RESTART);
            // Go to required state
            for (int i = ON_START; i <= finish; i++) {
                mLifecycleSequence.add(i);
            }
        } else {
            // Relaunch and go to required state

            // Go to destroyed state first.
            for (int i = start + 1; i <= ON_DESTROY; i++) {
                mLifecycleSequence.add(i);
            }
            // Go to required state
            for (int i = ON_CREATE; i <= finish; i++) {
                mLifecycleSequence.add(i);
            }
        }
    }

    // Remove last transition in case we want to perform it with some specific params.
    if (excludeLastState && mLifecycleSequence.size() != 0) {
        mLifecycleSequence.remove(mLifecycleSequence.size() - 1);
    }
    // 返回结果 
    return mLifecycleSequence;
}

此时，正常情况下 mLifecycleSequence 包含两个阶段：ON_START、ON_RESUME。

4.7.2.3 performLifecycleSequence()

private void performLifecycleSequence(ActivityClientRecord r, IntArray path,
        ClientTransaction transaction) {
    final int size = path.size();
    for (int i = 0, state; i < size; i++) {
        state = path.get(i);
        if (DEBUG_RESOLVER) {
            Slog.d(TAG, tId(transaction) + "Transitioning activity: "
                    + getShortActivityName(r.token, mTransactionHandler)
                    + " to state: " + getStateName(state));
        }
        switch (state) {
            case ON_CREATE:
                mTransactionHandler.handleLaunchActivity(r, mPendingActions,
                        null /* customIntent */);
                break;
            case ON_START:
                mTransactionHandler.handleStartActivity(r, mPendingActions);
                break;
            case ON_RESUME:
                mTransactionHandler.handleResumeActivity(r.token, false /* finalStateRequest */,
                        r.isForward, "LIFECYCLER_RESUME_ACTIVITY");
                break;
            case ON_PAUSE:
                mTransactionHandler.handlePauseActivity(r.token, false /* finished */,
                        false /* userLeaving */, 0 /* configChanges */, mPendingActions,
                        "LIFECYCLER_PAUSE_ACTIVITY");
                break;
            case ON_STOP:
                mTransactionHandler.handleStopActivity(r.token, false /* show */,
                        0 /* configChanges */, mPendingActions, false /* finalStateRequest */,
                        "LIFECYCLER_STOP_ACTIVITY");
                break;
            case ON_DESTROY:
                mTransactionHandler.handleDestroyActivity(r.token, false /* finishing */,
                        0 /* configChanges */, false /* getNonConfigInstance */,
                        "performLifecycleSequence. cycling to:" + path.get(size - 1));
                break;
            case ON_RESTART:
                mTransactionHandler.performRestartActivity(r.token, false /* start */);
                break;
            default:
                throw new IllegalArgumentException("Unexpected lifecycle state: " + state);
        }
    }
}

这个简单，根据前面返回的 Activity 生命周期序列，依次执行 handleStartActivity 、handleResumeActivity()，最终回调 Activity 的 onStart()、onResume()方法。

**cycleToPath()后，还会调用 ResumeActivityItem.execute()方法，那内部做了什么呢？ **

4.7.2.4 ResumeActivityItem.execute()

ResumeActivityItem.java

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
    client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
            "RESUME_ACTIVITY");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

client 是 ActivityThread 对象 :

@Override
public void handleResumeActivity(IBinder token, boolean finalStateRequest, boolean isForward,
        String reason) {
    // If we are getting ready to gc after going to the background, well
    // we are back active so skip it.
    unscheduleGcIdler();
    mSomeActivitiesChanged = true;

    // TODO Push resumeArgs into the activity for consideration
    // 内部会调用 Acitivty 的 `onResume()`
    final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);
    if (r == null) {
        // We didn't actually resume the activity, so skipping any follow-up actions.
        return;
    }
    ...

performResumeActivity() 内部会调用 Acitivty 的 onResume() 方法。

那岂不是会有两次调用 onResume() 方法？ 答：不会。因为 performResumeActivity() 方法里面会做拦截！

我们看一下 Activity 的 performResumeActivity()方法：

public ActivityClientRecord performResumeActivity(IBinder token, boolean finalStateRequest,
        String reason) {
    final ActivityClientRecord r = mActivities.get(token);
    if (localLOGV) {
        Slog.v(TAG, "Performing resume of " + r + " finished=" + r.activity.mFinished);
    }
    if (r == null || r.activity.mFinished) {
        return null;
    }
    if (r.getLifecycleState() == ON_RESUME) {
        // 这里做拦截 
        if (!finalStateRequest) {
            final RuntimeException e = new IllegalStateException(
                    "Trying to resume activity which is already resumed");
            Slog.e(TAG, e.getMessage(), e);
            Slog.e(TAG, r.getStateString());
            // TODO(lifecycler): A double resume request is possible when an activity
            // receives two consequent transactions with relaunch requests and "resumed"
            // final state requests and the second relaunch is omitted. We still try to
            // handle two resume requests for the final state. For cases other than this
            // one, we don't expect it to happen.
        }
        return null;
    }
    if (finalStateRequest) {
        r.hideForNow = false;
        r.activity.mStartedActivity = false;
    }
    try {
        r.activity.onStateNotSaved();
        r.activity.mFragments.noteStateNotSaved();
        checkAndBlockForNetworkAccess();
        if (r.pendingIntents != null) {
            deliverNewIntents(r, r.pendingIntents);
            r.pendingIntents = null;
        }
        if (r.pendingResults != null) {
            deliverResults(r, r.pendingResults, reason);
            r.pendingResults = null;
        }
        r.activity.performResume(r.startsNotResumed, reason);

        r.state = null;
        r.persistentState = null;
        r.setState(ON_RESUME);

        reportTopResumedActivityChanged(r, r.isTopResumedActivity, "topWhenResuming");
    } catch (Exception e) {
        if (!mInstrumentation.onException(r.activity, e)) {
            throw new RuntimeException("Unable to resume activity "
                    + r.intent.getComponent().toShortString() + ": " + e.toString(), e);
        }
    }
    return r;
}

原来内部会做拦截，所以只会 回调一次 onResume() 方法。

至此， Acitivty的 生命周期暂时完毕。

4.8 阶段三时序图

五、总结

Launcher 进程启动主要分为三个阶段：

1. AMS 向 Zygote发起 socket 通信前的准备：
   • 如果进程没有被拉起，则优先向zygote发起请求，同时让启动的Activity进入等待ing
   • 如果进程已经拉起，则直接启动Activity
2. Zygote 处理 AMS 的 socket 请求过程：
   • 一直等带socket请求，收到客户端拉起进程的消息后，通过fork() zygote进程，得到新的进程Launcher
   • 创建binder线程
   • 回调新进程的入口 ActivityThread 类的main()方法
3. 执行 Launch进程本身逻辑
   • 告诉AMS Launcher进程已经启动
   • AMS 通知Launcher进程，可以开始绑定
   • 创建 Application对象，回调 attachBaseContext()方法
   • 初始化ContentProvider,回调 onCreate()方法
   • 回调 Application的onCreate()方法
   • 创建Activity对象, 调用attach()方法
   • 回调 Activity的 onCreate()方法

六、参考

# 理解Android进程创建流程

# Android10.0系统启动之Launcher(桌面)启动流程-[Android取经之路]

# 深入理解 ClientLifecycleManager 机制