在Android中，ActivityThread是应用进程的初始化类，它的main()方法就是应用的入口方法，应用进程被创建后会调用ActivityThread.main()方法。
本文以Android 13代码为例进行分析。
1,在frameworks/base/core/java/android/app/IApplicationThread.aidl中
oneway interface IApplicationThread {
void bindApplication(...);
......
}
2，在frameworks/base/core/java/android/app/ActivityThread.java中
public final class ActivityThread extends ClientTransactionHandler implements ActivityThreadInternal {
final ApplicationThread mAppThread = new ApplicationThread();
public ApplicationThread getApplicationThread()
{
return mAppThread;
}
private class ApplicationThread extends IApplicationThread.Stub {
public final void scheduleCreateService(...) {
CreateServiceData s = new CreateServiceData();
sendMessage(H.CREATE_SERVICE, s);
}
}
class H extends Handler {
public static final int BIND_APPLICATION = 110;
public static final int CREATE_SERVICE = 114;
public void handleMessage(Message msg) {}
}
public static void main(String[] args) {
Looper.prepareMainLooper(); // Looper.prepareMainLooper()为当前线程（即主线程）准备了一个Looper，Looper是Android中用于处理消息循环（如UI事件）的类。
ActivityThread thread = new ActivityThread(); // 创建ActivityThread的实例，并通过调用其attach方法将其附加到系统服务中。这里第一个参数为false，表示这不是系统服务进程。
thread.attach(false, startSeq); //调用ActivityThread的attach方法，第一个参数为false，表示不是system server进程，tartSeq参数用于传递启动序列号，可能用于调试或跟踪目的
Looper.loop(); // Looper.loop()方法使得当前线程进入一个无限循环，等待并处理消息队列中的消息。这是Android应用UI线程的核心，所有UI更新和事件处理都发生在这里。
}
private void attach(boolean system, long startSeq) {
RuntimeInit.setApplicationObject(mAppThread.asBinder()); // 通过RuntimeInit.setApplicationObject设置应用的Binder对象，以便AMS可以与之通信。
final IActivityManager mgr = ActivityManager.getService(); // 获取AMS服务，并调用attachApplication方法通知AMS应用进程已经准备好。这是通过Binder IPC（跨进程通信）完成的。
try {
mgr.attachApplication(mAppThread, startSeq);//通知AMS,app进程已经准备好，binder跨进程通信。mAppThread是ApplicationThread类对象，继承自IApplicationThread.Stub
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}
}
}
上面的代码通过ActivityManager.getService()获取AMS服务。
3,在frameworks/base/core/java/android/app/ActivityManager.java中
public class ActivityManager {
@UnsupportedAppUsage
public static IActivityManager getService() {
return IActivityManagerSingleton.get();
}
private static IActivityTaskManager getTaskService() {
return ActivityTaskManager.getService();
}
@UnsupportedAppUsage
private static final Singleton<IActivityManager> IActivityManagerSingleton =
new Singleton<IActivityManager>() {
@Override
protected IActivityManager create() {
final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE); // 获取ActivityManagerService的IBinder接口实例
final IActivityManager am = IActivityManager.Stub.asInterface(b); // 通过IActivityManager.Stub.asInterface(b)将这个IBinder实例转换为IActivityManager接口实例
return am;
}
};
}
上面的代码从ServiceManager获取ActivityManagerService的IBinder接口实例，通常被称为实名binder.
4,在frameworks/base/core/java/android/app/ActivityTaskManager.java中
public class ActivityTaskManager {
private static final Singleton<ActivityTaskManager> sInstance =
new Singleton<ActivityTaskManager>() {
@Override
protected ActivityTaskManager create() {
return new ActivityTaskManager();
}
};
private ActivityTaskManager() {
}
/** @hide */
public static ActivityTaskManager getInstance() {
return sInstance.get();
}
/** @hide */
public static IActivityTaskManager getService() {
return IActivityTaskManagerSingleton.get();
}
@UnsupportedAppUsage(trackingBug = 129726065)
private static final Singleton<IActivityTaskManager> IActivityTaskManagerSingleton =
new Singleton<IActivityTaskManager>() {
@Override
protected IActivityTaskManager create() {
final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE);
return IActivityTaskManager.Stub.asInterface(b);
}
};
}
上面的代码从ServiceManager获取ActivityTaskManager的IBinder接口实例。
5,在frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java中
public class ActivityManagerService extends IActivityManager.Stub
implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback, ActivityManagerGlobalLock {
public final void attachApplication(IApplicationThread thread, long startSeq) {
if (thread == null) {
throw new SecurityException("Invalid application interface");
}
synchronized (this) {
int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
attachApplicationLocked(thread, callingPid, callingUid, startSeq);//调用attachApplicationLocked函数
Binder.restoreCallingIdentity(origId);
}
}
@GuardedBy("this")
private boolean attachApplicationLocked(@NonNull IApplicationThread thread,
int pid, int callingUid, long startSeq) {
thread.bindApplication(...);//启动application
//ATMS启动activity，调用ActivityTaskManagerInternal抽象类的attachApplication方法，会走到其实现类ActivityTaskManagerService.java中的attachApplication函数。
didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
return true;
}
}
对于thread.bindApplication(...)会调用到ActivityThread.java中的 public final void bindApplication函数。
6，在frameworks/base/core/java/android/app/ActivityThread.java中
public final void bindApplication(...) {
AppBindData data = new AppBindData();
sendMessage(H.BIND_APPLICATION, data);//发送BIND_APPLICATION消息
}
public void handleMessage(Message msg) {
switch (msg.what) {
case BIND_APPLICATION:
AppBindData data = (AppBindData)msg.obj;
handleBindApplication(data);
break;
}
}
private void handleBindApplication(AppBindData data) {
final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
Application app;
app = data.info.makeApplicationInner(data.restrictedBackupMode, null);
...
}
7，在frameworks/base/core/java/android/app/LoadedApk.java中
public Application makeApplicationInner(boolean forceDefaultAppClass,Instrumentation instrumentation) {
return makeApplicationInner(forceDefaultAppClass, instrumentation,
/* allowDuplicateInstances= */ false);
}
private Application makeApplicationInner(boolean forceDefaultAppClass,Instrumentation instrumentation, boolean allowDuplicateInstances) {
......
app = mActivityThread.mInstrumentation.newApplication(
cl, appClass, appContext);
appContext.setOuterContext(app);
......
instrumentation.callApplicationOnCreate(app);
......
}
此时application已经启动。
8,在frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java中
public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
@Override
//此处的attachApplication是抽象类ActivityTaskManagerInternal中attachApplication函数的实现
public boolean attachApplication(WindowProcessController wpc) throws RemoteException {
synchronized (mGlobalLockWithoutBoost) {
return mRootWindowContainer.attachApplication(wpc);//调用RootWindowContainer类的attachApplication函数
}
}
}
9，在frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java中
class RootWindowContainer extends WindowContainer<DisplayContent> implements DisplayManager.DisplayListener {
boolean attachApplication(WindowProcessController app) throws RemoteException {
try {
return mAttachApplicationHelper.process(app); //执行AttachApplicationHelper类的process函数
} finally {
mAttachApplicationHelper.reset();
}
}
private class AttachApplicationHelper implements Consumer<Task>, Predicate<ActivityRecord> {
boolean process(WindowProcessController app) throws RemoteException {
mApp = app;
for (int displayNdx = getChildCount() - 1; displayNdx >= 0; --displayNdx) {
getChildAt(displayNdx).forAllRootTasks(this);// 对每个根任务调用forAllRootTasks(this),可以调用到test()函数，在forAllRootTasks中isRootTask() ? callback.test(this) : false;
if (mRemoteException != null) {
throw mRemoteException;
}
}
if (!mHasActivityStarted) {
ensureActivitiesVisible(null /* starting */, 0 /* configChanges */,
false /* preserveWindows */);
}
return mHasActivityStarted;
}
@Override
public boolean test(ActivityRecord r) {
if (r.finishing || !r.showToCurrentUser() || !r.visibleIgnoringKeyguard
|| r.app != null || mApp.mUid != r.info.applicationInfo.uid
|| !mApp.mName.equals(r.processName)) {
return false;
}
try {
//调用ActivityTaskSupervisor.java类中的realStartActivityLocked
if (mTaskSupervisor.realStartActivityLocked(r, mApp,
mTop == r && r.getTask().canBeResumed(r) /* andResume */,
true /* checkConfig */)) {
mHasActivityStarted = true;
}
} catch (RemoteException e) {
Slog.w(TAG, "Exception in new application when starting activity " + mTop, e);
mRemoteException = e;
return true;
}
return false;
}
}
}
上面的代码中调用forAllRootTasks函数，走到Task.java文件中。
上面的代码调用realStartActivityLocked函数，走到ActivityTaskSupervisor.java文件中。
10,在frameworks/base/services/core/java/com/android/server/wm/Task.java中
class Task extends TaskFragment {
@Override
boolean forAllRootTasks(Predicate<Task> callback, boolean traverseTopToBottom) {
return isRootTask() ? callback.test(this) : false; //调用到test函数
}
}
11,在frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java中
public class ActivityTaskSupervisor implements RecentTasks.Callbacks {
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,boolean andResume, boolean checkConfig) throws RemoteException {
// Create activity launch transaction.
final ClientTransaction clientTransaction = ClientTransaction.obtain(
proc.getThread(), r.token);// 创建ClientTransaction：通过ClientTransaction.obtain方法创建一个ClientTransaction对象，用于封装启动Activity的IPC请求。Activity的token用于唯一标识Activity
final boolean isTransitionForward = r.isTransitionForward();
final IBinder fragmentToken = r.getTaskFragment().getFragmentToken();
// 此处添加callback,后面会在TransactionExecutor类中执行
// 使用clientTransaction.addCallback方法向ClientTransaction对象中添加一个LaunchActivityItem回调，这个回调包含了启动Activity所需的所有信息，如Intent、Activity信息、配置信息等。
clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
System.identityHashCode(r), r.info,mergedConfiguration.getGlobalConfiguration(),mergedConfiguration.getOverrideConfiguration(), r.compat,
r.getFilteredReferrer(r.launchedFromPackage), task.voiceInteractor,proc.getReportedProcState(), r.getSavedState(), r.getPersistentSavedState(),
results, newIntents, r.takeOptions(), isTransitionForward,proc.createProfilerInfoIfNeeded(), r.assistToken, activityClientController,
r.shareableActivityToken, r.getLaunchedFromBubble(), fragmentToken));
// Schedule transaction.
mService.getLifecycleManager().scheduleTransaction(clientTransaction); //通过mService.getLifecycleManager().scheduleTransaction(clientTransaction)方法将封装好的ClientTransaction对象调度到目标进程中。这实际上是通过IPC机制，将启动Activity的请求发送到目标进程。
}
}
上面的代码调用scheduleTransaction函数。
12，在frameworks/base/services/core/java/com/android/server/wm/ClientLifecycleManager.java中
class ClientLifecycleManager {
void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
final IApplicationThread client = transaction.getClient();
transaction.schedule(); //调用ClientTransaction类的schedule函数
if (!(client instanceof Binder)) {
// If client is not an instance of Binder - it's a remote call and at this point it is
// safe to recycle the object. All objects used for local calls will be recycled after
// the transaction is executed on client in ActivityThread.
transaction.recycle();
}
}
}
上面的代码调用schedule()函数。
13,在frameworks/base/core/java/android/app/servertransaction/ClientTransaction.java中
public class ClientTransaction implements Parcelable, ObjectPoolItem {
private IApplicationThread mClient;
public static ClientTransaction obtain(IApplicationThread client, IBinder activityToken) {
ClientTransaction instance = ObjectPool.obtain(ClientTransaction.class);
if (instance == null) {
instance = new ClientTransaction();
}
instance.mClient = client;
instance.mActivityToken = activityToken;
return instance;
}
public void schedule() throws RemoteException {
mClient.scheduleTransaction(this); //mClient为IApplicationThread对象
}
}
上面的代码调用scheduleTransaction函数。
14，在frameworks/base/core/java/android/app/ActivityThread.java中
@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
//已有类定义public final class ActivityThread extends ClientTransactionHandler，代码会进一步走到ClientTransactionHandler类的scheduleTransaction
ActivityThread.this.scheduleTransaction(transaction);
}
15，在frameworks/base/core/java/android/app/ClientTransactionHandler.java中
public abstract class ClientTransactionHandler {
void scheduleTransaction(ClientTransaction transaction) {
transaction.preExecute(this);
sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);//在ActivityThread类中定义有class H extends Handler
}
}
16，在frameworks/base/core/java/android/app/ActivityThread.java中
private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);
public void handleMessage(Message msg) {
switch (msg.what) {
case EXECUTE_TRANSACTION:
final ClientTransaction transaction = (ClientTransaction) msg.obj;
mTransactionExecutor.execute(transaction);//调用TransactionExecutor类的execute函数
break;
}
}
17,在frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java中
public class TransactionExecutor {
public void execute(ClientTransaction transaction) {
executeCallbacks(transaction);//调用TransactionExecutor类的executeCallbacks函数
}
public void executeCallbacks(ClientTransaction transaction) { // 由于在ActivityTaskSupervisor.java中，clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent)，此处执行的就是添加的callback
final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
final int size = callbacks.size();
for (int i = 0; i < size; ++i) {
final ClientTransactionItem item = callbacks.get(i); // 获取到LaunchActivityItem对象,callbacks的内容是在ActivityTaskSupervisor.java中添加的
item.execute(mTransactionHandler, token, mPendingActions);//执行LaunchActivityItem的execute函数
}
}
}
上面的代码调用execute()函数。
18，在frameworks/base/core/java/android/app/Servertransaction/LaunchActivityItem.java中
public class LaunchActivityItem extends ClientTransactionItem {
@Override
public void execute(ClientTransactionHandler client, IBinder token,
PendingTransactionActions pendingActions) {
Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
mPendingResults, mPendingNewIntents, mActivityOptions, mIsForward, mProfilerInfo,
client, mAssistToken, mShareableActivityToken, mLaunchedFromBubble,
mTaskFragmentToken);
client.handleLaunchActivity(r, pendingActions, null /* customIntent */); //执行ClientTransactionHandler的handleLaunchActivity
Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}
}
19，在frameworks/base/core/java/android/app/ActivityThread.java中
@Override
public Activity handleLaunchActivity(ActivityClientRecord r,PendingTransactionActions pendingActions, Intent customIntent) { //handleLaunchActivity是ClientTransactionHandler抽象类中的函数
final Activity a = performLaunchActivity(r, customIntent);//执行performLaunchActivity
}
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
ContextImpl appContext = createBaseContextForActivity(r);
Activity activity = null;
try {
java.lang.ClassLoader cl = appContext.getClassLoader();
activity = mInstrumentation.newActivity(
cl, component.getClassName(), r.intent);//创建新的activity
StrictMode.incrementExpectedActivityCount(activity.getClass());
r.intent.setExtrasClassLoader(cl);
r.intent.prepareToEnterProcess(isProtectedComponent(r.activityInfo),
appContext.getAttributionSource());
if (r.state != null) {
r.state.setClassLoader(cl);
}
} catch (Exception e) {
if (!mInstrumentation.onException(activity, e)) {
throw new RuntimeException(
"Unable to instantiate activity " + component
+ ": " + e.toString(), e);
}
}
r.activity = activity;
if (r.isPersistable()) {
mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState); //调用callActivityOnCreate函数
} else {
mInstrumentation.callActivityOnCreate(activity, r.state);
}
return activity;
}
上面的代码调用callActivityOnCreate函数。
20，在frameworks/base/core/java/android/app/Instrumentation.java中
public class Instrumentation {
public void callApplicationOnCreate(Application app) {
app.onCreate();
}
public void callActivityOnCreate(Activity activity, Bundle icicle,PersistableBundle persistentState) {
prePerformCreate(activity);
activity.performCreate(icicle, persistentState); //调用performCreate函数
postPerformCreate(activity);
}
}
21，在frameworks/base/core/java/android/app/Activity.java中
public class Activity extends ContextThemeWrapper implements LayoutInflater.Factory2,Window.Callback, KeyEvent.Callback,
OnCreateContextMenuListener, ComponentCallbacks2,
Window.OnWindowDismissedCallback,ContentCaptureManager.ContentCaptureClient {
final void performCreate(Bundle icicle) {
performCreate(icicle, null);
}
final void performCreate(Bundle icicle, PersistableBundle persistentState) {
if (persistentState != null) {
onCreate(icicle, persistentState); // 调用onCreate函数
} else {
onCreate(icicle);
}
}
}
经过上面的步骤，就可以执行到activity的onCreate函数。
