5. Android FrameWork之安卓14Activity启动流程 万字长文：从点击图标到Activity.onCreate()的每一行代码

鹏程十八少
284 阅读38分钟

1.Activity的热启动流程

startActivityForResult()
  Instrumentation----> execStartActivity() 检查xml中activity是否注册了?
                    ATMS---->startActivity() 
                        ActivityStarter------startActivityMayWait()
                            ActivityStack------resumeTopActivityUncheckedLocked() 管理堆栈,历史记录
                                ActivityStackSupervisor--->realStartActivityLocked   是否创建了进程
                                  ApplicationThread--------->scheduleTransaction()      切换到了客户端
                                     ActivityThread--------->scheduleTransaction()      切换线程,发送handler消息
                                          ActivityThread---> handleLaunchActivity ---最终结果
                                             ActivityThread---> performLaunchActivity ---反射创建activity

清单文件的校验过程：

  • 最终抛出熟悉的异常：ActivityNotFoundException: Unable to find explicit activity class; have you declared this activity in your AndroidManifest.xml? 客户端校验：
// frameworks/base/core/java/android/app/Instrumentation.java
public static void checkStartActivityResult(int res, Object intent) {
    switch (res) {
        case ActivityManager.START_INTENT_NOT_RESOLVED:
        case ActivityManager.START_CLASS_NOT_FOUND:
            // 这里抛出的异常就是常见的"找不到Activity"错误
            throw new ActivityNotFoundException(
                "Unable to find explicit activity class " + intent +
                "; have you declared this activity in your AndroidManifest.xml?");
        case ActivityManager.START_PERMISSION_DENIED:
            throw new SecurityException("Not allowed to start activity " + intent);
        // ... 其他错误码处理
    }
}

服务端校验： execStartActivity() 的核心代码

// frameworks/base/core/java/android/app/Instrumentation.java
public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token,
        Activity target, Intent intent, int requestCode, Bundle options) {
    // 1. 获取IApplicationThread，代表客户端进程
    IApplicationThread appThread = (IApplicationThread) contextThread;
    
    // 2. 获取ActivityTaskManagerService的Binder代理
    IActivityTaskManager atm = ActivityTaskManager.getService();
    
    try {
        // 3. 关键调用：通过Binder IPC将启动请求发送到系统进程的ATMS
        int result = atm.startActivity(appThread, who.getBasePackageName(), intent,
                intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
                
        // 4. 检查启动结果（这里会进行初步的异常转换）
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

2.Activity的冷启动流程

image.png

2.1 启动流程源码分析

// 冷启动完整流程序列
Launcher.startActivity() 
    → Instrumentation.execStartActivity()
        → ActivityTaskManager.getService().startActivity() // IPC到ATMS
            → ActivityTaskManagerService.startActivity()
                → ActivityStarter.execute() 
                    → ActivityStarter.startActivityUnchecked()
                        → RootActivityContainer.resumeFocusedStacksTopActivities()
                            → ActivityStack.resumeTopActivityUncheckedLocked()
                                → ActivityStackSupervisor.startSpecificActivityLocked()
                                    → ActivityManagerService.startProcessAsync() // 如果进程不存在
                                        → ProcessList.startProcessLocked()
                                            → Process.start() // 请求Zygote fork进程
                                                → ZygoteProcess.start() // 通过socket与Zygote通信
                                                    → Zygote.forkAndSpecialize() // fork新进程
                                        ↓
                                        // 新进程入口
                                        → ActivityThread.main() // 新进程主入口
                                            → ActivityThread.attach()
                                                → ActivityManagerService.attachApplication() // IPC回AMS
                                                    → ActiveServices.attachApplicationLocked()
                                                    → ActivityStackSupervisor.attachApplicationLocked()
                                                        → RealStartActivityLocked()
                                                            → ApplicationThread.scheduleLaunchActivity() // IPC到应用进程
                                        ↓
                                        // 回到应用进程
                                        → ApplicationThread.scheduleLaunchActivity()
                                            → ActivityThread.sendMessage(H.LAUNCH_ACTIVITY)
                                        ↓
                                        // Handler处理消息
                                        → ActivityThread.H.handleMessage(LAUNCH_ACTIVITY)
                                            → ActivityThread.handleLaunchActivity()
                                                → Instrumentation.newActivity()
                                                → Instrumentation.callActivityOnCreate()
                                        ↓
                                        → ActivityThread.H.handleMessage(RESUME_ACTIVITY)
                                            → ActivityThread.handleResumeActivity()
                                                → WindowManagerGlobal.addView()
                                                    → WindowManagerService.addWindow() // IPC到WMS

2.1.1 进程创建流程 (AMS → Zygote)

// frameworks/base/services/core/java/com/android/server/am/ProcessList.java
public class ProcessList {
    final ProcessStartResult startResult = Process.start(entryPoint,
        app.processName, uid, uid, gids, runtimeFlags, mountExternal,
        app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
        app.info.dataDir, invokeWith, entryPointArgs);
}

// frameworks/base/core/java/android/os/Process.java
public static final ProcessStartResult start(final String processClass,
                                  final String niceName,
                                  int uid, int gid, int[] gids,
                                  int runtimeFlags, int mountExternal,
                                  int targetSdkVersion, String seInfo,
                                  String abi, String instructionSet,
                                  String appDataDir, String invokeWith,
                                  String[] zygoteArgs) {
    return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

// frameworks/base/core/java/android/os/ZygoteProcess.java
public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              // ... 参数) {
    return startViaZygote(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, false /* startChildZygote */,
            zygoteArgs);
}

private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  // ... 参数) {
    // 通过socket与Zygote进程通信
    return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}

2.1.2. 新进程初始化 (ActivityThread.main())

// frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
    // 初始化主线程Looper - 这是Handler机制的核心
    Looper.prepareMainLooper();
    
    // 创建ActivityThread实例
    ActivityThread thread = new ActivityThread();
    
    // 关联到系统服务
    thread.attach(false);
    
    // 创建主线程Handler
    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }
    
    // 启动消息循环 - 进入无限循环处理消息
    Looper.loop();
    
    throw new RuntimeException("Main thread loop unexpectedly exited");
}

private void attach(boolean system) {
    // 获取AMS的Binder代理
    final IActivityManager mgr = ActivityManager.getService();
    try {
        // 向AMS注册应用进程，传入ApplicationThread Binder对象
        mgr.attachApplication(mAppThread);
    } catch (RemoteException ex) {
        throw ex.rethrowFromSystemServer();
    }
}

2.1.3. Handler机制在启动过程中的作用

// frameworks/base/core/java/android/app/ActivityThread.java
// 内部Handler类 - 负责将Binder线程的请求切换到主线程执行
class H extends Handler {
    public static final int LAUNCH_ACTIVITY = 100;
    public static final int RESUME_ACTIVITY = 107;
    public static final int BIND_APPLICATION = 110;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BIND_APPLICATION:
                // 处理应用绑定
                AppBindData data = (AppBindData)msg.obj;
                handleBindApplication(data);
                break;
                
            case LAUNCH_ACTIVITY:
                // 处理Activity启动
                ActivityClientRecord r = (ActivityClientRecord)msg.obj;
                handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");
                break;
                
            case RESUME_ACTIVITY:
                // 处理Activity恢复
                handleResumeActivity((IBinder)msg.obj, true, msg.arg1 != 0, true);
                break;
        }
    }
}

// ApplicationThread - Binder stub实现，运行在Binder线程池中
private class ApplicationThread extends IApplicationThread.Stub {
    public final void scheduleLaunchActivity(Intent intent, IBinder token, 
            int ident, ActivityInfo info, Configuration curConfig, 
            CompatibilityInfo compatInfo, int procState, Bundle state, 
            PersistableBundle persistentState, List<ResultInfo> pendingResults, 
            List<Intent> pendingNewIntents, boolean notResumed, 
            boolean isForward, ProfilerInfo profilerInfo) {
        // 创建ActivityClientRecord
        ActivityClientRecord r = new ActivityClientRecord();
        // ... 填充数据
        
        // 发送消息到主线程Handler - 这是线程切换的关键！
        sendMessage(H.LAUNCH_ACTIVITY, r);
    }
    
    public final void scheduleBindApplication(String processName,
            ApplicationInfo appInfo, List<ProviderInfo> providers,
            ComponentName testName, ProfilerInfo profilerInfo, Bundle testArgs,
            IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,
            int debugMode, boolean enableOpenGlTrace, boolean isRestrictedBackupMode,
            boolean persistent, Configuration config, CompatibilityInfo compatInfo,
            Map services, Bundle coreSettings) {
        // 创建绑定数据
        AppBindData data = new AppBindData();
        // ... 填充数据
        
        // 发送消息到主线程Handler
        sendMessage(H.BIND_APPLICATION, data);
    }
    
    // 发送消息到主线程的辅助方法
    private void sendMessage(int what, Object obj) {
        sendMessage(what, obj, 0, 0, false);
    }
    
    private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        // 通过Handler发送到主线程消息队列
        mH.sendMessage(msg);
    }
}

2.1.4. 应用进程初始化处理

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 1. 设置进程名
    Process.setArgV0(data.processName);
    
    // 2. 创建Application对象
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    
    // 3. 安装ContentProviders - 先于Application.onCreate()执行！
    if (!data.restrictedBackupMode) {
        List<ProviderInfo> providers = data.providers;
        if (providers != null) {
            installContentProviders(app, providers);
        }
    }
    
    // 4. 调用Application.onCreate()
    mInstrumentation.callApplicationOnCreate(app);
}

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent, String reason) {
    // 1. 创建Activity实例
    Activity activity = performLaunchActivity(r, customIntent);
    
    if (activity != null) {
        // 2. 处理onCreate生命周期
        handleResumeActivity(r.token, false, r.isForward, !r.activity.mFinished);
    }
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // 1. 通过Instrumentation创建Activity实例
    Activity activity = mInstrumentation.newActivity(
        cl, component.getClassName(), r.intent);
    
    // 2. 创建Application对象（如果尚未创建）
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    
    // 3. 关联Context和Activity
    activity.attach(appContext, this, getInstrumentation(), r.token,
        r.ident, app, r.intent, r.activityInfo, title, r.parent,
        r.embeddedID, r.lastNonConfigurationInstances, config,
        r.referrer, r.voiceInteractor, window, r.configCallback);
    
    // 4. 调用Activity.onCreate()
    if (r.isPersistable()) {
        mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
    } else {
        mInstrumentation.callActivityOnCreate(activity, r.state);
    }
    
    return activity;
}

2.1.5. Window管理及界面显示

// frameworks/base/core/java/android/app/ActivityThread.java
final void handleResumeActivity(IBinder token, boolean clearHide, boolean isForward, 
        boolean reallyResume) {
    // 1. 调用Activity.onResume()
    ActivityClientRecord r = performResumeActivity(token, clearHide);
    
    if (r != null) {
        final Activity a = r.activity;
        if (r.window == null && !a.mFinished && willBeVisible) {
            // 2. 获取Window
            r.window = r.activity.getWindow();
            View decor = r.window.getDecorView();
            decor.setVisibility(View.INVISIBLE);
            
            // 3. 获取ViewManager（通常是WindowManager）
            ViewManager wm = a.getWindowManager();
            WindowManager.LayoutParams l = r.window.getAttributes();
            
            // 4. 添加View到WindowManager - 这会触发WMS调用
            wm.addView(decor, l);
            
            // 5. 设置View可见
            decor.setVisibility(View.VISIBLE);
        }
    }
}

2.2 启动流程的核心类

在启动流程中，有几个关键角色2：

  • Zygote：进程孵化器，预加载常用类和资源，加速进程创建。
  • ActivityManagerService (AMS) ：Android 系统核心服务，全局管理 Activity、任务栈和进程。
  • ActivityThread：应用主线程的核心类，管理应用组件（Activity、Service等）的生命周期12。
  • ApplicationThread：AMS 用于与应用进程通信的 Binder 桥梁，AMS 通过它控制应用进程28。
  • Instrumentation：监控和控制组件生命周期的工具类，负责创建 Activity 和调用生命周期方法

系统服务端核心类

类名所在进程主要职责关键方法
ActivityTaskManagerService (ATMS)System ServerActivity和任务栈的管理，处理startActivity请求startActivity(), startActivityAsUser()
ActivityManagerService (AMS)System Server进程管理和组件生命周期调度，与ATMS协同工作attachApplication(), startProcessLocked()
PackageManagerService (PMS)System Server包管理，解析APK和AndroidManifest.xml，组件查询resolveIntent(), getActivityInfo()
WindowManagerService (WMS)System Server窗口管理，界面绘制和输入事件分发addWindow(), relayoutWindow()
ActivityStarterSystem ServerActivity启动策略处理，权限和逻辑校验executeRequest(), startActivityUnchecked()
ActivityStackSystem ServerActivity回退栈管理，生命周期状态维护resumeTopActivityUncheckedLocked()
ActivityStackSupervisorSystem Server多栈协同管理，启动特定ActivitystartSpecificActivityLocked(), attachApplicationLocked()
ProcessListSystem Server进程管理，与Zygote通信创建新进程startProcessLocked()

应用进程端核心类

类名所在进程主要职责关键方法
ActivityThreadApp应用主线程管理器，Android应用的入口点main(), attach(), handleLaunchActivity()
ApplicationThreadAppAMS与应用进程通信的Binder桥梁scheduleLaunchActivity(), scheduleBindApplication()
InstrumentationApp监控应用与系统交互，负责生命周期方法调用newActivity(), callActivityOnCreate()
H (Handler)App主线程消息处理，将Binder线程请求切换到主线程handleMessage(), sendMessage()
TransactionExecutorApp执行AMS发送的生命周期事务execute(), executeCallbacks()
ActivityApp用户交互的组件，生命周期由系统管理onCreate(), onStart(), onResume()
ApplicationApp应用全局对象，维护应用级的状态和资源onCreate(), onConfigurationChanged()

进程间通信相关类

类名所在进程主要职责接口类型
IApplicationThreadSystem/AppAMS控制应用进程的Binder接口AIDL Interface
IActivityTaskManagerSystem/App应用进程调用ATMS的Binder接口AIDL Interface
IActivityManagerSystem/App应用进程调用AMS的Binder接口AIDL Interface
IWindowManagerSystem/App应用进程调用WMS的Binder接口AIDL Interface

Zygote相关类

类名所在进程主要职责关键方法
ZygoteProcessSystem Server与Zygote进程通信，请求fork新进程start(), startViaZygote()
ZygoteZygoteAndroid进程孵化器，fork新应用进程forkAndSpecialize()

各类在启动流程中的分工

  1. 决策与调度层 (ATMS/AMS)：负责启动决策、权限校验、进程管理
  2. 信息提供层 (PMS)：提供组件信息和Intent解析服务
  3. 进程孵化层 (Zygote)：负责创建新应用进程
  4. 通信桥梁层 (ApplicationThread)：连接系统服务和应用进程
  5. 线程调度层 (Handler)：负责B线程到主线程的切换
  6. 生命周期执行层 (Instrumentation)：实际执行生命周期方法调用
  7. 界面展示层 (WMS/Activity)：管理窗口显示和用户交互

2.3.启动中的AMS, PMS, WMS的交互是怎么样的

交互流程：Launcher -> (ATMS/AMS) -> PMS -> (ATMS/AMS) -> (Zygote) -> App进程 -> (ATMS/AMS) -> WMS

AMS、PMS、WMS在Activity启动过程中的作用对比

阶段AMS (ActivityManagerService)PMS (PackageManagerService)WMS (WindowManagerService)
启动前期准备接收startActivity请求，初始化启动流程提供APK路径、资源路径等应用基本信息-
Intent解析委托PMS解析Intent，获取目标组件信息核心作用：解析Intent，查询匹配的Activity，返回ActivityInfo（包含launchMode、permission等清单信息）-
权限校验核心作用：检查调用者权限、进程权限、跨用户权限等提供权限定义和权限状态查询支持-
进程管理核心作用：检查目标进程是否存在，不存在则请求Zygote创建新进程，维护进程记录(ProcessRecord)--
应用初始化通过Binder调用应用进程的bindApplication()，调度Application创建提供ApplicationInfo、ProviderInfo等应用组件信息-
Activity创建通过Binder调用应用进程的scheduleLaunchActivity()，调度Activity生命周期--
窗口准备通知WMS准备Activity切换动画和起始窗口-核心作用：准备AppTransition动画，创建并显示StartingWindow（启动预览窗口）
窗口创建--核心作用：接收addView()请求，创建WindowState，分配SurfaceControl，管理窗口层级
界面绘制--核心作用：管理Surface，处理布局(performLayout)、测量(measure)、绘制(draw)流程，合成图层
输入准备--核心作用：创建InputChannel，设置输入事件路由，准备接收用户输入
生命周期同步核心作用：维护Activity状态机，调度生命周期回调，处理状态同步-同步窗口可见性与Activity状态（如onPause时隐藏窗口）
错误处理核心作用：处理权限拒绝、组件未找到、进程启动失败等错误提供组件存在性验证支持处理窗口创建失败、Surface分配失败等问题
跨进程协调核心作用：作为系统服务与应用进程间的协调中心，管理所有Binder通信提供组件查询接口供AMS调用提供窗口管理接口供应用进程调用

2.3.1 AMS

1. 启动请求接收与处理

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub {
    @Override
    public int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho,
            int requestCode, int flags, ProfilerInfo profilerInfo, Bundle options) {
        return mActivityTaskManager.startActivity(caller, callingPackage, intent,
                resolvedType, resultTo, resultWho, requestCode, flags, profilerInfo, options);
    }
}

虽然ATMS接管了大部分Activity启动逻辑，但AMS仍然负责进程管理相关的工作。

2. 进程检查与创建

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
class ActivityStackSupervisor {
    void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // 检查进程是否已存在
        final ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);
        
        if (app != null && app.thread != null) {
            // 进程已存在，直接启动Activity
            try {
                realStartActivityLocked(r, app, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                // 处理异常
            }
        }
        
        // 进程不存在，需要创建新进程
        mService.startProcessLocked(r.processName, r.info.applicationInfo,
                true, 0, "activity", r.intent.getComponent(), false, false, true);
    }
}

3. 进程创建核心方法

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
        boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
        boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
        String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
    
    // 获取或创建ProcessRecord
    ProcessRecord app = getProcessRecordLocked(processName, info.uid, true);
    
    if (app == null) {
        // 创建新的ProcessRecord
        app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
        mProcessNames.put(processName, app.uid, app);
        updateLruProcessLocked(app, false, null);
    }
    
    // 启动进程
    startProcessLocked(app, hostingType, hostingName, abiOverride, entryPoint, entryPointArgs);
    
    return app;
}

private void startProcessLocked(ProcessRecord app, String hostingType,
        ComponentName hostingName, String abiOverride, String entryPoint, String[] entryPointArgs) {
    
    // 准备启动参数
    final String entryPointStr = (entryPoint != null) ? entryPoint : "android.app.ActivityThread";
    
    // 请求Zygote创建进程
    Process.ProcessStartResult startResult = Process.start(entryPointStr,
            app.processName, uid, uid, gids, runtimeFlags, mountExternal,
            app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
            app.info.dataDir, invokeWith, entryPointArgs);
    
    // 更新进程记录
    synchronized (mPidsSelfLocked) {
        this.mPidsSelfLocked.put(startResult.pid, app);
        app.setPid(startResult.pid);
        app.usingWrapper = startResult.usingWrapper;
        app.removed = false;
    }
    
    // 设置进程启动超时监控
    Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
    msg.obj = app;
    mHandler.sendMessageDelayed(msg, startResult.usingWrapper
            ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
}

4. 应用进程注册处理

当新进程创建完成后，会调用AMS的attachApplication方法进行注册：

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
@Override
public final void attachApplication(IApplicationThread thread) {
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        final long origId = Binder.clearCallingIdentity();
        try {
            // 处理应用进程注册
            attachApplicationLocked(thread, callingPid);
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
    }
}

private boolean attachApplicationLocked(IApplicationThread thread, int pid) {
    // 根据pid查找ProcessRecord
    ProcessRecord app = findProcessLocked(pid);
    if (app == null) {
        return false;
    }
    
    // 绑定ApplicationThread到进程记录
    app.makeActive(thread, mProcessStats);
    app.isolatedEntryPoint = null;
    app.isolatedEntryPointArgs = null;
    
    // 检查应用是否处于待启动状态
    if (mPendingStartActivityUids.get(app.uid) > 0 || 
        normalMode && mProcessesOnHold.contains(app)) {
        // 应用需要等待
        return true;
    }
    
    // 发送绑定应用请求
    try {
        // 准备绑定数据
        List<ProviderInfo> providers = null;
        if (app.isolatedEntryPoint == null) {
            providers = generateApplicationProvidersLocked(app);
        }
        
        // 检查应用调试状态
        if (app.isDebugging() && mDebugApp != null && !app.processName.equals(mDebugApp)) {
            // 调试处理
        }
        
        // 调用应用进程的bindApplication方法
        thread.bindApplication(processName, appInfo, providers,
                app.instrumentationClass, profilerInfo, app.instrumentationArguments,
                app.instrumentationWatcher, app.instrumentationUiAutomationConnection,
                testMode, enableOpenGlTrace, isRestrictedBackupMode || !normalMode,
                app.isPersistent(), new Configuration(mConfiguration),
                app.compat, getCommonServicesLocked(app.isolated),
                mCoreSettingsObserver.getCoreSettingsLocked());
                
    } catch (Exception e) {
        // 异常处理
        app.resetPackageList(mProcessStats);
        startProcessLocked(app, "bind fail", processName);
        return false;
    }
    
    // 更新进程状态
    updateProcessForegroundLocked(app, false, 0);
    app.setPendingStart(false);
    app.setDebugging(false);
    
    // 检查是否有待启动的Activity
    if (normalMode) {
        try {
            // 调度待启动的Activity
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            // 异常处理
            badApp = true;
        }
    }
    
    return true;
}

5. Activity调度与启动

// frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
boolean attachApplicationLocked(ProcessRecord app) {
    boolean didSomething = false;
    for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; displayNdx--) {
        final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
        for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; stackNdx--) {
            final ActivityStack stack = display.getChildAt(stackNdx);
            // 尝试恢复栈顶Activity
            if (stack.getVisibility(null) == STACK_VISIBILITY_VISIBLE) {
                didSomething |= stack.attachApplicationLocked(app);
            }
        }
    }
    return didSomething;
}

// frameworks/base/services/core/java/com/android/server/am/ActivityStack.java
boolean attachApplicationLocked(ProcessRecord app) {
    final ActivityRecord top = topRunningActivityLocked();
    if (top != null && top.app == null && app.uid == top.appInfo.uid
            && top.processName.equals(app.processName)) {
        try {
            // 真正启动Activity
            realStartActivityLocked(top, app, true, true);
            return true;
        } catch (RemoteException e) {
            // 异常处理
        }
    }
    return false;
}

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
    
    // 设置启动时间
    r.setLaunchTime(System.currentTimeMillis());
    
    // 更新进程状态
    app.setWaitingToKill(null);
    app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_TOP);
    
    // 创建Activity启动事务
    final ClientTransaction clientTransaction = ClientTransaction.obtain(
            app.thread, r.appToken);
    
    // 添加LaunchActivityItem到事务
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
            System.identityHashCode(r), r.info,
            mergedConfiguration.getGlobalConfiguration(),
            mergedConfiguration.getOverrideConfiguration(), r.compat,
            r.launchedFromPackage, task.voiceInteractor, app.repProcState,
            r.icicle, r.persistentState, results, newIntents,
            app.isNextTransitionForward(), profilerInfo));
    
    // 设置最终的生命周期状态
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) {
        lifecycleItem = ResumeActivityItem.obtain(false /* isForward */);
    } else {
        lifecycleItem = PauseActivityItem.obtain();
    }
    clientTransaction.setLifecycleStateRequest(lifecycleItem);
    
    // 调度事务执行
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    
    // 更新统计信息
    if (andResume) {
        app.getCurAdjTime();
        app.setRecentActivityTime(r.lastLaunchTime);
        mService.updateOomAdjLocked(app, true);
    }
    
    return true;
}

2.3.2 WMS

WMS在冷启动中的核心职责

WindowManagerService（WMS）在冷启动过程中主要负责窗口管理、界面绘制和输入事件处理，确保Activity能够正确显示并与用户交互。

源码分析调用链

2.3.2.1. 启动窗口（Starting Window）创建

// frameworks/base/services/core/java/com/android/server/wm/ActivityRecord.java
void showStartingWindow(ActivityRecord prev, boolean newTask, boolean taskSwitch) {
    if (mStartingWindowState != STARTING_WINDOW_STATE_NOT_SHOWN) {
        return;
    }
    
    // 请求WMS添加启动窗口
    mTaskSupervisor.mService.mWindowManager.setAppStartingWindow(
        this, packageName, theme, compatInfo, nonLocalizedLabel, 
        labelRes, icon, logo, windowFlags, overrideConfig, 
        !newTask, taskSwitch, displayId);
}

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
public void setAppStartingWindow(IBinder appToken, String packageName, int theme,
        CompatibilityInfo compatInfo, CharSequence nonLocalizedLabel, int labelRes, 
        int icon, int logo, int windowFlags, Configuration overrideConfig, 
        boolean processRunning, boolean allowTaskSnapshot, int displayId) {
    
    synchronized (mWindowMap) {
        // 查找对应的AppWindowToken
        AppWindowToken atoken = mRoot.getAppWindowToken(appToken);
        if (atoken == null) {
            return;
        }
        
        // 创建启动窗口数据
        StartingData startingData = new StartingData(packageName, theme, compatInfo,
                nonLocalizedLabel, labelRes, icon, logo, windowFlags, overrideConfig);
        
        // 发送消息到Handler处理
        mH.sendMessage(mH.obtainMessage(H.ADD_STARTING, atoken, startingData));
    }
}

2.3.2.2. 启动窗口处理Handler

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
private final class H extends Handler {
    public static final int ADD_STARTING = 10;
    public static final int REMOVE_STARTING = 11;
    
    @Override
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case ADD_STARTING:
                addStartingWindow((AppWindowToken)msg.obj, (StartingData)msg.obj);
                break;
            case REMOVE_STARTING:
                removeStartingWindow((AppWindowToken)msg.obj, (WindowState)msg.obj);
                break;
        }
    }
}

private void addStartingWindow(AppWindowToken atoken, StartingData sd) {
    try {
        // 创建启动窗口的View
        View view = sd.createStartingWindow(atoken.token, mContext);
        
        if (view != null) {
            // 创建窗口布局参数
            WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
                LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT,
                WindowManager.LayoutParams.TYPE_APPLICATION_STARTING,
                WindowManager.LayoutParams.FLAG_HARDWARE_ACCELERATED,
                PixelFormat.OPAQUE);
            
            lp.setTitle("Starting " + sd.pkg);
            lp.privateFlags |= WindowManager.LayoutParams.PRIVATE_FLAG_FAKE_HARDWARE_ACCELERATED;
            lp.layoutInDisplayCutoutMode = LAYOUT_IN_DISPLAY_CUTOUT_MODE_ALWAYS;
            
            // 添加窗口到WMS
            addWindow(view, lp, atoken);
            
            // 记录启动窗口
            atoken.startingData = sd;
            atoken.startingWindow = view;
            atoken.startingSurface = view.getWindowToken();
        }
    } catch (Exception e) {
        // 异常处理
    }
}

2.3.2.3. 应用主窗口创建

当Activity调用setContentView()时，会通过WindowManager添加主窗口：

// frameworks/base/core/java/android/view/WindowManagerGlobal.java
public void addView(View view, ViewGroup.LayoutParams params,
        Display display, Window parentWindow) {
    
    // 创建ViewRootImpl
    ViewRootImpl root = new ViewRootImpl(view.getContext(), display);
    
    view.setLayoutParams(wparams);
    
    mViews.add(view);
    mRoots.add(root);
    mParams.add(wparams);
    
    // 通过ViewRootImpl添加窗口到WMS
    try {
        root.setView(view, wparams, panelParentView);
    } catch (RuntimeException e) {
        // 异常处理
    }
}

// frameworks/base/core/java/android/view/ViewRootImpl.java
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
    synchronized (this) {
        if (mView == null) {
            mView = view;
            
            // 请求布局
            requestLayout();
            
            // 通过WindowSession添加窗口到WMS
            try {
                mOrigWindowType = attrs.type;
                mAttachInfo.mRecomputeGlobalAttributes = true;
                collectViewAttributes();
                res = mWindowSession.addToDisplay(mWindow, mSeq, attrs,
                        View.VISIBLE, getContext().getDisplayId(), mTmpFrame,
                        mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
                        mAttachInfo.mOutsets, mAttachInfo.mDisplayCutout, mInputChannel);
            } catch (RemoteException e) {
                // 异常处理
            }
        }
    }
}

2.3.2.4. WMS处理窗口添加请求

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
public int addWindow(Session session, IWindow client, int seq,
        WindowManager.LayoutParams attrs, int viewVisibility, int displayId,
        Rect outFrame, Rect outContentInsets, Rect outStableInsets, Rect outOutsets,
        DisplayCutout.ParcelableWrapper outDisplayCutout, InputChannel outInputChannel) {
    
    synchronized (mWindowMap) {
        // 1. 权限检查
        int res = mPolicy.checkAddPermission(attrs, appOp, callingPid, callingUid);
        if (res != WindowManagerGlobal.ADD_OKAY) {
            return res;
        }
        
        // 2. 查找或创建WindowToken
        WindowToken token = getWindowToken(attrs.token);
        if (token == null) {
            if (attrs.type >= FIRST_APPLICATION_WINDOW && attrs.type <= LAST_APPLICATION_WINDOW) {
                // 应用窗口必须有有效的WindowToken
                return WindowManagerGlobal.ADD_BAD_APP_TOKEN;
            }
            // 创建新的WindowToken
            token = new WindowToken(this, attrs.token, -1, false);
            mTokenMap.put(attrs.token, token);
        }
        
        // 3. 创建WindowState
        WindowState win = new WindowState(this, session, client, token,
                attachedWindow, appOp[0], seq, attrs, viewVisibility, session.mUid,
                session.mCanAddInternalSystemWindow);
        
        // 4. 为窗口分配SurfaceControl
        win.createSurfaceControl();
        
        // 5. 添加到窗口列表
        mWindowMap.put(client.asBinder(), win);
        
        // 6. 创建InputChannel用于输入事件
        if (outInputChannel != null && (attrs.inputFeatures
                & WindowManager.LayoutParams.INPUT_FEATURE_NO_INPUT_CHANNEL) == 0) {
            String inputChannelName = win.makeInputChannelName();
            InputChannel[] inputChannels = InputChannel.openInputChannelPair(inputChannelName);
            win.setInputChannel(inputChannels[0]);
            inputChannels[1].copyTo(outInputChannel);
            inputChannels[1].dispose();
            
            // 注册输入通道
            mInputManager.registerInputChannel(win.mInputChannel, win.getInputDisplayId());
        }
        
        // 7. 更新窗口层级
        win.getParent().assignChildLayers();
        
        return WindowManagerGlobal.ADD_OKAY;
    }
}

2.3.2.5. Surface创建与管理

// frameworks/base/services/core/java/com/android/server/wm/WindowState.java
void createSurfaceControl() {
    if (mSurfaceControl != null) {
        return;
    }
    
    // 创建SurfaceSession
    if (mSession.mSurfaceSession == null) {
        mSession.mSurfaceSession = new SurfaceSession();
        mService.mSessions.add(mSession);
    }
    
    // 创建SurfaceControl
    mSurfaceControl = new SurfaceControl.Builder(mSession.mSurfaceSession)
            .setName(getSurfaceControlName())
            .setBufferSize(mRequestedWidth, mRequestedHeight)
            .setFormat(mAttrs.format)
            .setFlags(getSurfaceFlags())
            .setParent(mToken.getSurfaceControl())
            .build();
    
    // 设置Surface位置和层级
    mSurfaceControl.setLayer(mLayer);
    mSurfaceControl.setPosition(mXOffset, mYOffset);
    mSurfaceControl.setAlpha(mAlpha);
}

2.3.3 PMS

PackageManagerService（PMS）在冷启动过程中扮演着信息提供者的角色，负责解析Intent、查询组件信息、验证权限，为AMS提供启动Activity所需的所有元数据信息。

源码分析调用链

2.3.3.1. Intent解析与组件查询

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
public class PackageManagerService extends IPackageManager.Stub {
    @Override
    public ResolveInfo resolveIntent(Intent intent, String resolvedType, 
            int flags, int userId) {
        // 验证用户权限
        enforceCrossUserPermission(Binder.getCallingUid(), userId, 
            false, false, "resolve intent");
        
        // 生成缓存键
        String key = intent.toShortString(false, true, false, false) + "|" 
            + resolvedType + "|" + flags + "|" + userId;
        
        // 检查缓存
        ResolveInfo cached = mResolveCache.get(key);
        if (cached != null) {
            return cached;
        }
        
        // 查询所有匹配的组件
        List<ResolveInfo> query = mActivities.queryIntent(intent, resolvedType, flags, userId);
        
        // 选择最佳匹配
        ResolveInfo bestChoice = chooseBestActivity(intent, resolvedType, flags, query, userId);
        
        // 缓存结果
        if (bestChoice != null) {
            mResolveCache.put(key, bestChoice);
        }
        
        return bestChoice;
    }
}

2.3.3.2. Intent查询核心实现

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
class ActivityIntentResolver extends IntentResolver<PackageParser.ActivityIntentInfo, ResolveInfo> {
    public List<ResolveInfo> queryIntent(Intent intent, String resolvedType, 
            int flags, int userId) {
        
        // 构建查询条件
        String scheme = intent.getScheme();
        Set<String> categories = intent.getCategories();
        
        // 查询匹配的组件
        ArrayList<ResolveInfo> list = new ArrayList<>();
        for (PackageParser.ActivityIntentInfo info : mActivities) {
            // 检查Intent是否匹配
            int match = info.match(intent, resolvedType, scheme, categories);
            if (match >= 0) {
                // 检查用户权限和组件可用性
                if (checkComponentPermission(info.activity.info, userId, flags)) {
                    ResolveInfo res = new ResolveInfo();
                    res.activityInfo = info.activity.info;
                    res.priority = info.getPriority();
                    res.preferredOrder = info.activity.owner.mPreferredOrder;
                    res.match = match;
                    res.isDefault = info.isDefault();
                    res.labelRes = info.labelRes;
                    res.nonLocalizedLabel = info.nonLocalizedLabel;
                    res.icon = info.icon;
                    list.add(res);
                }
            }
        }
        
        // 按优先级排序
        Collections.sort(list, new Comparator<ResolveInfo>() {
            @Override
-            public int compare(ResolveInfo o1, ResolveInfo o2) {
-                return o2.priority - o1.priority;
-            }
-        });
-        
-        return list;
-    }
-}

2.3.3.3. 组件权限检查

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
private boolean checkComponentPermission(ComponentInfo component, int userId, int flags) {
    // 1. 检查组件是否对当前用户可用
    if (!isComponentAvailableToUser(component, userId)) {
        return false;
    }
    
    // 2. 检查导出属性
    if (!component.exported) {
        // 未导出的组件只能被同一应用或相同user ID的应用调用
        if (Binder.getCallingUid() != component.applicationInfo.uid) {
            return false;
        }
    }
    
    // 3. 检查权限要求
    if (component.permission != null) {
        // 验证调用者是否有权限
        if (checkPermission(component.permission, Binder.getCallingPid(), 
                Binder.getCallingUid(), userId) != PackageManager.PERMISSION_GRANTED) {
            return false;
        }
    }
    
    // 4. 检查其他限制
    if ((flags & PackageManager.MATCH_DIRECT_BOOT_AWARE) == 0 &&
            !isDirectBootAware(component.applicationInfo)) {
        // 直接启动aware检查
        return false;
    }
    
    return true;
}

2.3.3.4. 权限验证实现

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
@Override
public int checkPermission(String permName, String pkgName, int userId) {
    // 1. 系统进程有所有权限
    if (Binder.getCallingUid() == Process.SYSTEM_UID) {
        return PackageManager.PERMISSION_GRANTED;
    }
    
    // 2. 查找包信息
    PackageParser.Package pkg = mPackages.get(pkgName);
    if (pkg == null) {
        return PackageManager.PERMISSION_DENIED;
    }
    
    // 3. 检查权限是否被声明
    if (!pkg.requestedPermissions.contains(permName)) {
        return PackageManager.PERMISSION_DENIED;
    }
    
    // 4. 检查权限是否被授予
-    PackageSetting ps = mSettings.mPackages.get(pkgName);
-    if (ps == null) {
-        return PackageManager.PERMISSION_DENIED;
-    }
-    
-    if (ps.getPermissionsState().hasPermission(permName, userId)) {
-        return PackageManager.PERMISSION_GRANTED;
-    }
-    
-    return PackageManager.PERMISSION_DENIED;
-}

2.3.3.5. ActivityInfo查询

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
@Override
public ActivityInfo getActivityInfo(ComponentName component, int flags, int userId) {
    // 验证用户权限
    enforceCrossUserPermission(Binder.getCallingUid(), userId, 
        false, false, "get activity info");
    
    // 查找组件信息
    PackageParser.Package pkg = mPackages.get(component.getPackageName());
    if (pkg == null) {
        return null;
    }
    
    // 查找Activity信息
    PackageParser.Activity a = pkg.activities.get(component.getClassName());
    if (a == null) {
        return null;
    }
    
    // 检查组件是否对用户可用
    if (!isComponentAvailableToUser(a.info, userId)) {
        return null;
    }
    
    // 返回ActivityInfo
    return PackageParser.generateActivityInfo(a, flags, userId);
}

2.4.启动中的AMS Activity生命周期是谁控制的? (问题)

  • 决策权：AMS（决定什么时候应该调用什么生命周期方法）

  • 执行权：应用进程的主线程（实际执行生命周期方法）

  • 执行工具：Instrumentation（负责具体的方法调用和监控）

  • AMS是大脑：AMS掌握着所有组件的状态信息（通过ActivityRecord, Task等）。它根据系统状态（如内存、电源、当前焦点）、Activity的启动模式、Intent的Flag等做出决策，决定下一个应该进入哪个生命周期的状态（onCreate, onStart, onResume, onPause等）。

  • 应用进程是四肢：AMS将决策结果（一个ClientTransaction，其中包含LaunchActivityItem, ResumeActivityItem等生命周期项）通过Binder IPC发送给应用进程的ApplicationThread。

  • 应用进程的主线程执行：ApplicationThread将AMS的请求抛到主线程的消息队列，由ActivityThread的HHandler处理，最终通过TransactionExecutor执行事务，调用Instrumentation去真正执行生命周期回调（如callActivityOnCreate）。

所以，生命周期方法是在应用主线程中由Instrumentation调用的，但调用的时机和顺序是由AMS远程控制的。

2.4.1. AMS的角色：决策者（大脑）

// frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java
class ActivityStack {
    boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
        // 获取栈顶Activity
        final ActivityRecord next = topRunningActivityLocked(true);
        
        if (next.app != null && next.app.thread != null) {
            // 决策：这个Activity应该进入RESUMED状态
            next.app.getThread().scheduleTransaction(
                ClientTransaction.obtain(next.app.getThread(), 
                    next.token, ActivityLifecycleItem.obtain(ON_RESUME)));
        }
        return true;
    }
}

AMS通过维护全局的Activity状态机来做出决策：

// frameworks/base/services/core/java/com/android/server/wm/ActivityRecord.java
class ActivityRecord {
    // AMS维护的Activity状态
    private int mState = INITIALIZING;
    
    // 状态常量定义
    static final int INITIALIZING = 0;
    static final int RESUMED = 1;
    static final int PAUSED = 2;
    static final int STOPPED = 3;
    static final int DESTROYED = 4;
    
    void setState(int state, String reason) {
        mState = state;
        // 根据状态决策下一步操作
        scheduleActivityLifecycleState();
    }
}

2.4. 2. 应用进程的角色：执行者ActivityThread

// frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
    private class ApplicationThread extends IApplicationThread.Stub {
        @Override
        public void scheduleTransaction(ClientTransaction transaction) {
            // 接收AMS的指令，抛到主线程执行
            sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
        }
    }
    
    class H extends Handler {
        public void handleMessage(Message msg) {
            switch (msg.what) {
                case EXECUTE_TRANSACTION:
                    // 在主线程执行事务
                    handleExecuteTransaction((ClientTransaction) msg.obj);
                    break;
            }
        }
    }
    
    private void handleExecuteTransaction(ClientTransaction transaction) {
        // 使用TransactionExecutor执行生命周期操作
        mTransactionExecutor.execute(transaction);
    }
}

2.4.3. 生命周期执行的具体过程

// frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java
public class TransactionExecutor {
    public void execute(ClientTransaction transaction) {
        // 1. 执行回调（如LaunchActivityItem）
        executeCallbacks(transaction);
        
        // 2. 执行生命周期状态变更（如ResumeActivityItem）
        executeLifecycleState(transaction);
    }
    
    private void executeLifecycleState(ClientTransaction transaction) {
        final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
        if (lifecycleItem == null) {
            return;
        }
        
        // 执行具体的生命周期项
        lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
    }
}

// frameworks/base/core/java/android/app/servertransaction/ResumeActivityItem.java
public class ResumeActivityItem extends ActivityLifecycleItem {
    @Override
    public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
        // 最终调用到ActivityThread的handleResumeActivity方法
        client.handleResumeActivity(token, true /* finalStateRequest */,
                mIsForward, "RESUME_ACTIVITY");
    }
}

// frameworks/base/core/java/android/app/ActivityThread.java
public class ActivityThread implements ClientTransactionHandler {
    @Override
    public void handleResumeActivity(IBinder token, boolean finalStateRequest,
            boolean isForward, String reason) {
        // 1. 执行onResume前的工作
        final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);
        
        if (r != null) {
            // 2. 设置窗口可见性等
            if (r.window == null && !a.mFinished && willBeVisible) {
                r.window = r.activity.getWindow();
                View decor = r.window.getDecorView();
                decor.setVisibility(View.INVISIBLE);
                ViewManager wm = a.getWindowManager();
                wm.addView(decor, l);
            }
        }
    }
    
    public ActivityClientRecord performResumeActivity(IBinder token, 
            boolean finalStateRequest, String reason) {
        // 最终通过Instrumentation调用Activity的onResume方法
        final ActivityClientRecord r = mActivities.get(token);
        if (r.activity.mFinished) {
            return null;
        }
        
        try {
            r.activity.onStateNotSaved();
            r.activity.mCalled = false;
            // 这里调用Instrumentation执行生命周期方法
            mInstrumentation.callActivityOnResume(r.activity);
            if (!r.activity.mCalled) {
                throw new SuperNotCalledException("Activity " + r.intent.getComponent().toShortString()
                        + " did not call through to super.onResume()");
            }
        } catch (Exception e) {
            // 异常处理
        }
        
        return r;
    }
}

2.4.4. Instrumentation：实际的执行工具

// frameworks/base/core/java/android/app/Instrumentation.java
public class Instrumentation {
    public void callActivityOnResume(Activity activity) {
        activity.mResumed = true;
        // 真正调用Activity的onResume方法
        activity.onResume();
        
        // 监控回调（用于测试等目的）
        if (mActivityMonitors != null) {
            synchronized (mSync) {
                for (ActivityMonitor am : mActivityMonitors) {
                    am.onActivityResumed(activity);
                }
            }
        }
    }
    
    public void callActivityOnCreate(Activity activity, Bundle icicle) {
        // 预处理
        activity.performCreate(icicle);
        // 后处理
    }
}

2.5 会有几次跨进程的动作？

重点介绍下，服务端和和客户端，怎么使用Binder进行跨进程的！

1. Launcher → ATMS：启动请求 (第一次IPC)

// frameworks/base/core/java/android/app/Instrumentation.java
public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token,
        Activity target, Intent intent, int requestCode, Bundle options) {
    // 获取ATMS的Binder代理
    IActivityTaskManager atm = ActivityTaskManager.getService();
    
    // 第一次Binder IPC：Launcher进程 -> ATMS系统进程
    int result = atm.startActivity(appThread, who.getBasePackageName(), intent,
            intent.resolveTypeIfNeeded(who.getContentResolver()), token,
            target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
}

2. ATMS → PMS：Intent解析 (第二次IPC)

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private ActivityInfo resolveActivity(Request request) {
    try {
        // 第二次Binder IPC：ATMS -> PMS
        ResolveInfo rInfo = AppGlobals.getPackageManager()
            .resolveIntent(request.intent, request.resolvedType, 
                PackageManager.MATCH_DEFAULT_ONLY, request.userId);
    }
}

3. AMS → Zygote：进程创建 (Socket通信，非Binder)

// frameworks/base/services/core/java/com/android/server/am/ProcessList.java
final ProcessStartResult startResult = Process.start(entryPoint,
    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
    app.info.dataDir, invokeWith, entryPointArgs);

注意：这是通过 Socket 而不是 Binder 进行的 IPC。

4. 应用进程 → AMS：进程注册 (第三次IPC)

// frameworks/base/core/java/android/app/ActivityThread.java
private void attach(boolean system) {
    final IActivityManager mgr = ActivityManager.getService();
    // 第三次Binder IPC：新应用进程 -> AMS
    mgr.attachApplication(mAppThread);
}

5. AMS → 应用进程：应用绑定 (第四次IPC)

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
private boolean attachApplicationLocked(IApplicationThread thread, int pid) {
    // 第四次Binder IPC：AMS -> 应用进程
    thread.bindApplication(processName, appInfo, providers,
            app.instrumentationClass, profilerInfo, app.instrumentationArguments,
            app.instrumentationWatcher, app.instrumentationUiAutomationConnection,
            testMode, enableOpenGlTrace, isRestrictedBackupMode || !normalMode,
            app.isPersistent(), new Configuration(mConfiguration),
            app.compat, getCommonServicesLocked(app.isolated),
            mCoreSettingsObserver.getCoreSettingsLocked());
}

6. AMS → 应用进程：Activity启动 (第五次IPC)

// frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
void realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
    
    // 第五次Binder IPC：AMS -> 应用进程
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
}

7. 应用进程 → WMS：窗口创建 (第六次IPC)

// frameworks/base/core/java/android/view/ViewRootImpl.java
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
    try {
        // 第六次Binder IPC：应用进程 -> WMS
        res = mWindowSession.addToDisplay(mWindow, mSeq, attrs,
                View.VISIBLE, getContext().getDisplayId(), mTmpFrame,
                mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
                mAttachInfo.mOutsets, mAttachInfo.mDisplayCutout, mInputChannel);
    }
}

8. 应用进程 → AMS：生命周期回调 (第七次及更多IPC)

// 各种生命周期状态通知
@Override
public final void activityIdle(IBinder token, Configuration config, boolean stopProfiling) {
    // 第七次Binder IPC：应用进程 -> AMS
    mServices.activityIdle(token, config, stopProfiling);
}

@Override
public final void activityResumed(IBinder token) {
    // 可能还有更多的状态通知IPC
}

Binder IPC 机制详解

服务端和客户端如何使用Binder：
以AMS（服务端）和ApplicationThread（客户端）为例：

  • 服务端（AMS） ：持有IApplicationThread接口的代理对象（ApplicationThreadProxy）。它想通知客户端时，就调用这个代理对象的方法（如scheduleTransaction），调用会通过Binder驱动传递到客户端。
  • 客户端（App进程） ：ApplicationThread实现了IApplicationThread.Stub，它是一个Binder本地对象（Bn端）。它接收来自Binder驱动的请求，并在onTransact方法中处理这些请求，最终将任务抛到主线程执行。

服务端和客户端如何使用Binder

服务端（System Server）实现：
// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub {
    // 实现Binder接口
    @Override
    public int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho,
            int requestCode, int flags, ProfilerInfo profilerInfo, Bundle options) {
        // 服务端实现具体逻辑
        return startActivityAsUser(caller, callingPackage, intent, resolvedType,
                resultTo, resultWho, requestCode, flags, profilerInfo, options,
                UserHandle.getCallingUserId());
    }
}
客户端（Launcher/App）调用：
// 获取AMS的Binder代理
IActivityManager am = ActivityManager.getService();

// 发起Binder调用
int result = am.startActivity(...);
Binder代理对象生成：
// frameworks/base/core/java/android/app/ActivityManager.java
public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                // 获取ServiceManager中的AMS引用
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                // 创建Binder代理对象
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

Binder数据传输机制

// 数据序列化示例
@Override
public boolean onTransact(int code, Parcel data, Parcel reply, int flags) {
    switch (code) {
        case START_ACTIVITY_TRANSACTION:
            // 从Parcel中读取数据
            data.enforceInterface(IActivityManager.descriptor);
            IBinder b = data.readStrongBinder();
            Intent intent = Intent.CREATOR.createFromParcel(data);
            
            // 执行实际操作
            int result = startActivity(...);
            
            // 将结果写入回复Parcel
            reply.writeNoException();
            reply.writeInt(result);
            return true;
    }
}

2.6 启动模式与任务栈的核心管理机制

在Android系统中，启动模式(Launch Mode)和任务栈(Task)的管理主要由ActivityTaskManagerService (ATMS)  和 ActivityStarter 负责。

1. 启动模式处理入口

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
class ActivityStarter {
    private int executeRequest(Request request) {
        // 解析ActivityInfo，其中包含launchMode
        ActivityInfo aInfo = resolveActivity(request);
        
        // 处理启动模式
        return startActivityUnchecked(request, aInfo);
    }
    
    private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord) {
        // 计算启动标志和任务栈
        computeLaunchingTaskFlags();
        
        // 处理启动模式
        handleLaunchMode();
        
        // 设置目标栈
        setTargetStack();
    }
}

2. 启动模式处理核心逻辑

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private void handleLaunchMode() {
    final int launchMode = mStartActivity.info.launchMode;
    
    switch (launchMode) {
        case ActivityInfo.LAUNCH_MULTIPLE: // standard
            // 默认模式，总是创建新实例
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_TOP: // singleTop
            if (isTopActivity(mTargetStack, mStartActivity)) {
                // 栈顶已是该Activity，复用并调用onNewIntent
                deliverNewIntent();
                return START_DELIVERED_TO_TOP;
            }
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_TASK: // singleTask
            // 查找或创建任务栈
            final Task reusedTask = findTaskLocked();
            if (reusedTask != null) {
                // 找到现有任务栈
                reuseTask(reusedTask);
                return START_DELIVERED_TO_TOP;
            }
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_INSTANCE: // singleInstance
            // 创建新栈并设置为单实例模式
            createNewTaskAndStack();
            break;
    }
    
    // 没有复用现有Activity，需要创建新实例
    return startActivityUnchecked();
}

3. 任务栈查找算法

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private Task findTaskLocked() {
    // 获取所有可能匹配的任务栈
    final ArrayList<Task> tasks = mRootWindowContainer.getTasks();
    
    for (int i = tasks.size() - 1; i >= 0; i--) {
        final Task task = tasks.get(i);
        
        // 检查任务栈是否匹配
        if (matchTask(task)) {
            return task;
        }
    }
    
    return null;
}

private boolean matchTask(Task task) {
    // 1. 检查affinity匹配
    if (task.affinity != null && task.affinity.equals(mStartActivity.taskAffinity)) {
        return true;
    }
    
    // 2. 检查Intent匹配
    if (task.intent != null && task.intent.filterEquals(mIntent)) {
        return true;
    }
    
    // 3. 检查组件匹配
    if (task.realActivity != null && 
        task.realActivity.equals(mStartActivity.realActivity)) {
        return true;
    }
    
    return false;
}

4. singleTask模式的具体实现

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private void reuseTask(Task task) {
    // 将任务栈移到前台
    moveTaskToFront(task);
    
    // 清除该任务栈中目标Activity之上的所有Activity
    final ActivityRecord top = task.getTopActivity();
    if (top != null && !top.realActivity.equals(mStartActivity.realActivity)) {
        task.performClearTaskForReuse();
    }
    
    // 找到或创建目标Activity
    ActivityRecord activity = findActivityInTask(task);
    if (activity != null) {
        // 复用现有Activity
        mStartActivity = activity;
        deliverNewIntent();
    } else {
        // 在现有任务栈中创建新实例
        task.addActivityToTop(mStartActivity);
    }
}

5. 任务栈创建与管理

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
class ActivityStackSupervisor {
    Task createTask(int taskId, ActivityInfo info, Intent intent, 
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor) {
        
        // 创建新任务栈
        final Task task = new Task(taskId, info, intent, voiceSession, voiceInteractor);
        
        // 设置任务栈属性
        task.setIntent(intent);
        task.setRootActivity(mStartActivity);
        
        // 添加到任务栈列表
        mRootWindowContainer.addTask(task, null);
        
        return task;
    }
    
    void setTaskToFront(Task task) {
        // 将任务栈移到前台
        mRootWindowContainer.moveTaskToFront(task);
        
        // 更新栈焦点
        updateStackFocus();
    }
}

6. 栈管理核心类

ActivityStack
// frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java
class ActivityStack extends ConfigurationContainer {
    // 栈中的Activity记录
    final ArrayList<ActivityRecord> mActivities = new ArrayList<>();
    
    // 栈管理方法
    void addActivityToTop(ActivityRecord r) {
        mActivities.add(r);
        r.setStack(this);
        updateLRUListLocked(r);
    }
    
    void removeActivity(ActivityRecord r) {
        mActivities.remove(r);
        r.setStack(null);
    }
    
    ActivityRecord topRunningActivityLocked() {
        for (int i = mActivities.size() - 1; i >= 0; i--) {
            ActivityRecord r = mActivities.get(i);
            if (r.isState(RESUMED, PAUSED, STOPPED)) {
                return r;
            }
        }
        return null;
    }
}
Task
// frameworks/base/services/core/java/com/android/server/wm/Task.java
class Task extends ConfigurationContainer {
    // 任务栈属性
    int taskId;
    String affinity;
    Intent intent;
    ComponentName realActivity;
    
    // 栈中的Activity列表
    final ArrayList<ActivityRecord> mActivities = new ArrayList<>();
    
    void performClearTaskForReuse() {
        // 清除栈顶的Activity直到找到匹配的
        for (int i = mActivities.size() - 1; i >= 0; i--) {
            ActivityRecord r = mActivities.get(i);
            if (r.realActivity.equals(mStartActivity.realActivity)) {
                break;
            }
            removeActivity(r);
        }
    }
}

2.7 启动过程中，Handler, 干嘛的? 之前是在什么线程的? 源码分析下

线程切换：将Binder线程的请求切换到主线程执行

  • 之前所在线程：Binder线程池（Binder:domain_ 开头的线程）
  • 目标线程：主线程（main 线程）
// frameworks/base/core/java/android/app/ActivityThread.java
private class ApplicationThread extends IApplicationThread.Stub {
    @Override
    public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        // 这是Binder线程池中的线程
        // 核心操作：将事务发送到主线程的Handler处理
        ActivityThread.this.scheduleTransaction(transaction);
    }
}

// ActivityThread中的实现
public class ActivityThread extends ClientTransactionHandler {
    void scheduleTransaction(ClientTransaction transaction) {
        // 通过Handler发送到主线程消息队列
        transaction.schedule();
    }
}

// Binder线程处理耗时操作，不阻塞主线程
public void scheduleTransaction(ClientTransaction transaction) {
    // 快速处理Binder调用
    sendMessage(EXECUTE_TRANSACTION, transaction);
    // Binder线程立即返回，不阻塞
}

// frameworks/base/core/java/android/app/ActivityThread.java
class H extends Handler {
    public static final int EXECUTE_TRANSACTION = 159;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case EXECUTE_TRANSACTION:
                // 获取事务并执行
                final ClientTransaction transaction = (ClientTransaction) msg.obj;
                mTransactionExecutor.execute(transaction);
                break;
        }
    }
}

2.8. 第一次启动应用白屏是什么原因

冷启动时，系统需要创建进程和初始化应用（执行Application.onCreate()和Activity.onCreate()），这需要时间。在这段时间内，如果Window背景是空的，用户会看到黑屏或白屏。 当你点击应用图标时，系统需要时间创建进程、初始化应用组件（如Application、主Activity），并完成首帧绘制。为了告知用户应用已响应，系统在应用完成初始化并渲染出它的主界面之前，会先显示一个临时窗口，即 Starting Window（预览窗口）  5810。

这个 Starting Window 的外观由你在 AndroidManifest.xml 中为启动 Activity（通常设置了 <intent-filter action:MAIN category:LAUNCHER> 的那个）所设置的主题的 android:windowBackground 属性决定：

  • 若主题为 Light 系列或 windowBackground 为浅色，则通常显示白屏5810。
  • 若主题为 Black/Dark 系列或 windowBackground 为深色/黑色，则通常显示黑屏5810。

Starting Window 的出现意味着系统已经接收到了启动应用的指令并在处理5810。白屏或黑屏显示多久，取决于冷启动的耗时5。

🔍 冷启动流程（从点击图标到首帧绘制）

解决方案. 定制预览窗口背景（常用且有效）

这是提升感知体验最直接的方法。为你的启动Activity设置一个自定义主题，并指定 android:windowBackground458：

  1. 创建自定义启动主题 (在 res/values/styles.xml 中)：

    <style name="SplashTheme" parent="Theme.AppCompat.Light.NoActionBar">
    <!-- 设置一张与启动图一致的背景图 -->
    <item name="android:windowBackground">@drawable/splash_background</item>
    <item name="android:windowFullscreen">true</item> <!-- 可选：全屏 -->
    <item name="windowNoTitle">true</item> <!-- 可选：无标题栏 -->
    <!-- 或者设置一个纯色背景 -->
    <!-- <item name="android:windowBackground">@color/splashBackgroundColor</item> -->
</style>

  2. 在 AndroidManifest.xml 中应用给启动Activity：

    <activity
    android:name=".SplashActivity" <!-- 或你的主Activity -->
    android:theme="@style/SplashTheme">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>

  3. 在Activity的onCreate中切换回正常主题（在调用super.onCreate()之前）：

    public class SplashActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        setTheme(R.style.AppTheme); // 切换回应用正常主题
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_splash);
        // ... 后续初始化工作
    }
}

这样做的效果是：系统会立即显示 splash_background 定义的画面，取代默认的白屏/黑屏。当应用初始化完成后，再切换到真正的应用界面，实现无缝过渡，给人“秒开”的感觉45。

2.9 关键的一些问题

2.9.1 . 为什么activity不能直接new出来

ActivityThread中的创建过程

// frameworks/base/core/java/android/app/ActivityThread.java
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // 1. 获取ActivityInfo
    ActivityInfo aInfo = r.activityInfo;
    
    // 2. 获取Context
    ContextImpl appContext = createBaseContextForActivity(r);
    
    // 3. 通过Instrumentation创建Activity实例
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
    } catch (Exception e) {
        // 异常处理
    }
    
    try {
        // 4. 获取Application
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);
        
        // 5. 调用attach方法完成关键初始化
        activity.attach(appContext, this, getInstrumentation(), r.token,
            r.ident, app, r.intent, r.activityInfo, title, r.parent,
            r.embeddedID, r.lastNonConfigurationInstances, config,
            r.referrer, r.voiceInteractor, window, r.configCallback);
        
        // 6. 调用onCreate生命周期
        if (r.isPersistable()) {
            mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
        } else {
            mInstrumentation.callActivityOnCreate(activity, r.state);
        }
    } catch (Exception e) {
        // 异常处理
    }
    
    return activity;
}
  1. 反射创建实例：通过Instrumentation.newActivity()使用反射创建Activity对象
  2. 生命周期触发：通过Instrumentation调用onCreate()等生命周期方法
  3. 为什么打开一个页面用startActivity，而不是new一个？

因为Activity的打开需要受AMS管理，Activity打开有四种启动模式，根据不同的启动模式有不同的处理。如果是new的话每次打开一个activity都创建一个实例，只相当于只有一种启动模式了（starder模式）

2.9.2. 进程是在哪个类创建的?

为什么要用zygin进程产生app进程？

如果程序员管理太乱了，会有太多进程。但是我们自己xml中也可以产生进程 。如果在init（）不行。那个时候太多进程初始化，systemServer()也不行。里面有很多进程！

2.9.2.1. 进程创建决策点

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
    // 检查进程是否已存在
    final ProcessRecord app = mService.getProcessRecordLocked(r.processName,
            r.info.applicationInfo.uid, true);
    
    if (app != null && app.thread != null) {
        // 进程已存在，直接启动Activity
        try {
            realStartActivityLocked(r, app, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            // 处理异常
        }
    }
    
    // 进程不存在，需要创建新进程
    mService.startProcessLocked(r.processName, r.info.applicationInfo,
            true, 0, "activity", r.intent.getComponent(), false, false, true);
}

2.9.2.2. AMS中的进程创建入口

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
        boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
        boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
        String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
    
    // 获取或创建ProcessRecord
    ProcessRecord app = getProcessRecordLocked(processName, info.uid, true);
    
    if (app == null) {
        // 创建新的ProcessRecord
        app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
        mProcessNames.put(processName, app.uid, app);
        updateLruProcessLocked(app, false, null);
    }
    
    // 启动进程
    startProcessLocked(app, hostingType, hostingName, abiOverride, entryPoint, entryPointArgs);
    
    return app;
}

private void startProcessLocked(ProcessRecord app, String hostingType,
        ComponentName hostingName, String abiOverride, String entryPoint, String[] entryPointArgs) {
    
    // 准备启动参数
    final String entryPointStr = (entryPoint != null) ? entryPoint : "android.app.ActivityThread";
    
    // 请求Zygote创建进程
    Process.ProcessStartResult startResult = Process.start(entryPointStr,
            app.processName, uid, uid, gids, runtimeFlags, mountExternal,
            app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
            app.info.dataDir, invokeWith, entryPointArgs);
    
    // 更新进程记录
    synchronized (mPidsSelfLocked) {
        this.mPidsSelfLocked.put(startResult.pid, app);
        app.setPid(startResult.pid);
        app.usingWrapper = startResult.usingWrapper;
        app.removed = false;
    }
    
    // 设置进程启动超时监控
    Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
    msg.obj = app;
    mHandler.sendMessageDelayed(msg, startResult.usingWrapper
            ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
}

2.9.2.3. Process.start() - 进程创建的核心

// frameworks/base/core/java/android/os/Process.java
public static final ProcessStartResult start(final String processClass,
                                  final String niceName,
                                  int uid, int gid, int[] gids,
                                  int runtimeFlags, int mountExternal,
                                  int targetSdkVersion, String seInfo,
                                  String abi, String instructionSet,
                                  String appDataDir, String invokeWith,
                                  String[] zygoteArgs) {
    return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

2.9.2.4. ZygoteProcess与Zygote通信

// frameworks/base/core/java/android/os/ZygoteProcess.java
public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              int uid, int gid, int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion, String seInfo,
                                              String abi, String instructionSet,
                                              String appDataDir, String invokeWith,
                                              String[] zygoteArgs) {
    try {
        // 通过socket与Zygote通信
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, false, zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        // 异常处理
        throw new RuntimeException("Starting VM process through Zygote failed", ex);
    }
}

private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  final String niceName,
                                                  final int uid, final int gid,
                                                  final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion, String seInfo,
                                                  String abi, String instructionSet,
                                                  String appDataDir, String invokeWith,
                                                  boolean startChildZygote,
                                                  String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
    
    // 构建发送给Zygote的参数
    ArrayList<String> argsForZygote = new ArrayList<>();
    argsForZygote.add("--runtime-args");
    argsForZygote.add("--setuid=" + uid);
    argsForZygote.add("--setgid=" + gid);
    argsForZygote.add("--runtime-flags=" + runtimeFlags);
    if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {
        argsForZygote.add("--mount-external-default");
    }
    // ... 添加更多参数
    
    argsForZygote.add(processClass);
    
    if (extraArgs != null) {
        for (String arg : extraArgs) {
            argsForZygote.add(arg);
        }
    }
    
    // 与Zygote通信并启动进程
    return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}

2.9.2.5. 与Zygote的Socket通信

// frameworks/base/core/java/android/os/ZygoteProcess.java
private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
        ZygoteState zygoteState, ArrayList<String> args)
        throws ZygoteStartFailedEx {
    try {
        // 获取Zygote的socket输出流
        final BufferedWriter writer = zygoteState.writer;
        final DataInputStream inputStream = zygoteState.inputStream;
        
        // 写入参数
        writer.write(Integer.toString(args.size()));
        writer.newLine();
        
        for (int i = 0; i < args.size(); i++) {
            String arg = args.get(i);
            writer.write(arg);
            writer.newLine();
        }
        
        writer.flush();
        
        // 读取Zygote返回的结果
        Process.ProcessStartResult result = new Process.ProcessStartResult();
        result.pid = inputStream.readInt();
        result.usingWrapper = inputStream.readBoolean();
        
        return result;
    } catch (IOException ex) {
        zygoteState.close();
        throw new ZygoteStartFailedEx(ex);
    }
}

2.9.2.6. Zygote端的进程创建

// frameworks/base/core/java/com/android/internal/os/Zygote.java
public static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
        int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
        int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir) {
    
    // 通过native方法fork新进程
    int pid = nativeForkAndSpecialize(
            uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName,
            fdsToClose, fdsToIgnore, startChildZygote, instructionSet, appDataDir);
    
    return pid;
}

// Native层的fork实现
native private static int nativeForkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
        int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
        int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir);

Android进程创建的核心类包括：

  1. ActivityManagerService：决策者，决定何时创建进程
  2. ProcessList：执行者，协调进程创建过程
  3. ZygoteProcess：通信桥梁，与Zygote进程交互
  4. Zygote：进程孵化器，实际fork新进程

进程创建过程经历了从AMS决策 → ProcessList协调 → ZygoteProcess通信 → Zygote fork → 新进程初始化的完整链条

2.9.3. App的程序入口到底是哪里？

一个应用程序的开始可以说就是从ActivityThread.java中的main()方法开始的。

2.9.3.1. 用户点击与 Launcher 处理

当你在 Launcher（桌面）点击应用图标时，Launcher 会收集目标 Activity 的信息（包名、类名），封装成一个带有 FLAG_ACTIVITY_NEW_TASK 标志的 Intent，然后调用 startActivity()。这个过程本质上是 Launcher 应用跨进程通知系统服务要启动另一个应用。

关键代码在 Instrumentation.execStartActivity() 中，它通过 Binder IPC 调用 ActivityManagerService (AMS) 的 startActivity 方法。

2.9.3.2. AMS 与进程创建

AMS 是 Android 系统的核心服务，负责管理 Activity 生命周期、任务栈和进程。它收到启动请求后：

  • 检查目标进程：判断应用进程是否已存在。
  • 请求创建进程：若进程不存在，AMS 会通过 Process.start() 方法，经由 ZygoteProcess 与 Zygote 进程通过 Socket 通信，请求 fork 出新应用进程。新进程的入口参数是 "android.app.ActivityThread"。
2.9.3.3. 程序入口：ActivityThread.main()

新进程创建后，执行的首要方法就是 ActivityThread.main(String[] args) 。这是真正的程序入口。

// frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
    ...
    Looper.prepareMainLooper(); // 1. 初始化主线程Looper
    ActivityThread thread = new ActivityThread(); 
    thread.attach(false); // 2. 关联到系统服务（AMS）
    Looper.loop(); // 3. 启动主线程消息循环
}

main 方法主要完成：

  1. 初始化主线程 Looper：为应用主线程(UI线程)创建消息循环。
  2. 创建 ActivityThread 实例：它是应用进程的核心类，管理应用组件和主线程。
  3. 调用 attach() ：通过 Binder IPC 向 AMS 注册当前应用进程（传递 ApplicationThread 对象）。
  4. 启动消息循环：开始处理消息。
2.9.3.4. 应用进程初始化与 Application 创建

AMS 在收到应用进程的注册请求后，会通过 Binder IPC 回调应用进程的 ApplicationThread 接口，发送 BIND_APPLICATION 命令。该命令通过 Handler 切换到主线程后，由 ActivityThread.handleBindApplication() 处理。

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    ...
    // 1. 创建LoadedApk、ContextImpl对象
    LoadedApk loadedApk = getLoadedApk(data.appInfo);
    ContextImpl appContext = ContextImpl.createAppContext(this, loadedApk);
    // 2. 创建Instrumentation
    Instrumentation instr = new Instrumentation();
    // 3. 创建Application实例
    Application app = loadedApk.makeApplication(false, instr);
    // 4. 调用Application.onCreate()
    instr.callApplicationOnCreate(app);
}

此方法关键步骤2：

  1. 创建 Application 实例：通过 LoadedApk.makeApplication() 利用反射创建。
  2. 调用 Application.onCreate() ：通过 Instrumentation.callApplicationOnCreate() 调用。这是我们常说的“应用入口”，适合进行全局初始化（但应避免耗时操作）。
5. Activity 的启动与生命周期

AMS 在确认应用进程和 Application 初始化完成后，会通过 Binder IPC 回调应用进程的 ApplicationThread 接口，发送 LAUNCH_ACTIVITY 命令。该命令通过 Handler 切换到主线程后，由 ActivityThread.handleLaunchActivity() 处理28。

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleLaunchActivity(ActivityClientRecord r) {
    ...
    // 1. 创建Activity实例 (通过Instrumentation.newActivity())
    Activity activity = mInstrumentation.newActivity(cl, component, r.intent);
    // 2. 创建Application和ContextImpl
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    ContextImpl appContext = createBaseContextForActivity(r);
    // 3. 关联Activity和Context
    activity.attach(appContext, this, ...);
    // 4. 调用Activity.onCreate()
    mInstrumentation.callActivityOnCreate(activity, r.state);
    // 5. 执行onStart()和onResume()
    handleStartActivity() -> handleResumeActivity();
}

此过程主要包括2：

  1. 创建 Activity 实例：通过 Instrumentation.newActivity() 利用反射创建。
  2. 调用 attach() 方法：为 Activity 关联上下文、绑定 Window 等。
  3. 触发生命周期：依次调用 onCreate(), onStart(), onResume()。
  4. UI 绘制：在 onResume() 之后，会进行 View 的测量 (measure)、布局 (layout)、绘制 (draw)，最终将界面显示出来。

2.9.4. ContentProvider的oncreate方法和Application的oncrete()方法，谁先执行

核心结论

ContentProvider的onCreate()方法先于Application的onCreate()方法执行。

Application->attachBaseContext()
ContentProvider->onCreate()
Application->onCreate()
Activity->onCreate()

关键代码位置：ActivityThread.handleBindApplication()

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 1. 创建Application对象（但尚未调用onCreate）
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    
    // 2. 安装并初始化ContentProviders - 这里会先调用ContentProvider的onCreate()
    if (!data.restrictedBackupMode) {
        List<ProviderInfo> providers = data.providers;
        if (providers != null) {
            installContentProviders(app, providers);
        }
    }
    
    // 3. 最后才调用Application的onCreate()
    mInstrumentation.callApplicationOnCreate(app);
}

ContentProvider初始化过程

// frameworks/base/core/java/android/app/ActivityThread.java
private void installContentProviders(Context context, List<ProviderInfo> providers) {
    for (ProviderInfo cpi : providers) {
        // 创建ContentProvider实例
        ContentProvider cp = installProvider(context, null, cpi, false, true, false);
        
        if (cp != null) {
            // 调用ContentProvider的onCreate()方法
            cp.onCreate();
        }
    }
}

Application创建过程

// frameworks/base/core/java/android/app/LoadedApk.java
public Application makeApplication(boolean forceDefaultAppClass, Instrumentation instrumentation) {
    // 创建Application实例
    Application app = mActivityThread.mInstrumentation.newApplication(cl, appClass, appContext);
    
    return app; // 注意：这里还没有调用onCreate()
}

2.9.5. 切线程是哪个类处理的?

Android线程切换机制：Handler与ApplicationThread的协同

在Android冷启动过程中，线程切换主要由两个类协同处理：

  1. ApplicationThread - 在Binder线程接收请求
  2. H (Handler)  - 切换到主线程执行

核心线程切换机制

ApplicationThread：Binder线程端的接收器

// frameworks/base/core/java/android/app/ActivityThread.java
private class ApplicationThread extends IApplicationThread.Stub {
    // 这些方法都在Binder线程池中执行！
    public final void scheduleLaunchActivity(Intent intent, IBinder token, 
            int ident, ActivityInfo info, Configuration curConfig, 
            CompatibilityInfo compatInfo, int procState, Bundle state, 
            PersistableBundle persistentState, List<ResultInfo> pendingResults, 
            List<Intent> pendingNewIntents, boolean notResumed, 
            boolean isForward, ProfilerInfo profilerInfo) {
        
        // 这是在Binder线程中执行的
        ActivityClientRecord r = new ActivityClientRecord();
        // 填充数据...
        
        // 关键：发送消息到主线程的Handler
        sendMessage(H.LAUNCH_ACTIVITY, r);
    }
    
    public final void scheduleBindApplication(String processName,
            ApplicationInfo appInfo, List<ProviderInfo> providers,
            ComponentName testName, ProfilerInfo profilerInfo, Bundle testArgs,
            IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,
            int debugMode, boolean enableOpenGlTrace, boolean isRestrictedBackupMode,
            boolean persistent, Configuration config, CompatibilityInfo compatInfo,
            Map services, Bundle coreSettings) {
        
        // 同样执行在Binder线程
        AppBindData data = new AppBindData();
        // 填充数据...
        
        // 发送到主线程Handler
        sendMessage(H.BIND_APPLICATION, data);
    }
    
    // 发送消息到主线程的辅助方法
    private void sendMessage(int what, Object obj) {
        sendMessage(what, obj, 0, 0, false);
    }
    
    private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        // 关键：通过Handler发送到主线程的消息队列
        mH.sendMessage(msg);
    }
}

H (Handler)：主线程端的处理器

// frameworks/base/core/java/android/app/ActivityThread.java
class H extends Handler {
    // 消息类型常量
    public static final int BIND_APPLICATION = 110;
    public static final int LAUNCH_ACTIVITY = 100;
    public static final int RESUME_ACTIVITY = 107;
    public static final int PAUSE_ACTIVITY = 101;
    public static final int EXECUTE_TRANSACTION = 159;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BIND_APPLICATION:
                // 现在在主线程执行了！
                handleBindApplication((AppBindData)msg.obj);
                break;
                
            case LAUNCH_ACTIVITY:
                // 在主线程处理Activity启动
                handleLaunchActivity((ActivityClientRecord)msg.obj, null, "LAUNCH_ACTIVITY");
                break;
                
            case RESUME_ACTIVITY:
                // 在主线程处理Activity恢复
                handleResumeActivity((IBinder)msg.obj, true, msg.arg1 != 0, true);
                break;
                
            case EXECUTE_TRANSACTION:
                // 处理事务执行
                final ClientTransaction transaction = (ClientTransaction) msg.obj;
                mTransactionExecutor.execute(transaction);
                break;
        }
    }
}

2.9.6. activityINfo的信息是怎么创建的?

Android 系统中 ActivityInfo 的创建主要发生在应用安装或系统启动时，由 PackageManagerService (PMS)  负责解析 APK 文件中的 AndroidManifest.xml 并生成。这个过程的核心是解析 <activity> 标签并将其属性转化为 ActivityInfo 对象的字段。

为了让你快速把握核心流程，我用一张图来展示 ActivityInfo 从创建到使用的全过程： ActivityInfo 的创建和封装主要发生在 PMS 解析 APK 文件的过程中。

  1. 解析时机：当 APK 被安装或系统启动扫描已安装应用时，PMS 会解析 APK 包中的 AndroidManifest.xml 文件5。
  2. 解析器：PMS 使用 PackageParser 来解析 APK。PackageParser 会遍历 AndroidManifest.xml 中的所有组件，包括 <activity>、<receiver>、<service> 和 <provider>5。
  3. 创建 ActivityInfo：对于每一个 <activity> 标签，PackageParser 都会创建一个 ActivityInfo 对象，并将标签中的属性（如 android:name, android:launchMode, android:screenOrientation, android:theme, android:exported 等）提取出来，填充到该 ActivityInfo 对象的相应字段中6。
  4. 存储：解析得到的 ActivityInfo 会存储在 PMS 的内部数据结构中（例如 mActivities 等），以便后续快速查询

2.9.7： 进程的pid和Uid

ActivityStarter.startActivityMayWait().里面得到pid,uid();

在Android系统中，PID（Process ID）  和 UID（User ID）  是进程管理和安全机制的核心标识符：

  • PID（进程ID） ：操作系统分配给每个进程的唯一数字标识，用于进程管理和调度
  • UID（用户ID） ：Android用于标识应用身份和权限的数字标识，是安全沙箱的基础

PID和UID在进程记录中的存储

// frameworks/base/services/core/java/com/android/server/am/ProcessRecord.java
final class ProcessRecord implements WindowProcessListener {
    // 进程基本信息
    final String processName;    // 进程名
    final ApplicationInfo info;  // 应用信息
    final int uid;               // 用户ID
    int pid;                     // 进程ID
    
    // 运行时状态
    IApplicationThread thread;   // 与应用进程通信的Binder接口
    
    // 组件状态
    ArraySet<ActivityRecord> activities = new ArraySet<>();     // 运行的Activity
    ArraySet<ServiceRecord> services = new ArraySet<>();        // 运行的服务
}

3.从Launcher启动应用的流程

总的架构图：

deepseek_mermaid_20250820_bed45a.png

分为4个步骤的总图：

image.png

3.1 从Launcher到AMS

3.2 从AMS到应用程序进程

3.3 在应用程序进程中创建进程

判断进程是否创建

ActivityStack  ------>startSpecificActivityLocked();

ActivityManagerService---->getProcessRecordLocked();

void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        // Is this activity's process already running?
        ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);

        r.task.stack.setLaunchTime(r);

        if (app != null && app.thread != null) {
            ...
        }
        
        ActivityManagerService---->startProcessLocked();
        // 主要分析进程的创建过程和 application 的创建绑定过程
        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
    }

3.4 在应用程序进程中创建和启动根Activity

ActivityThread--->scheduleLaunchActivity()

         ActivityThread---> handleLaunchActivity   

                  1）.ActivityThread--->   performLaunchActivity

                          mInstrumentation--->newActivity()通过反射创建的！

                              activity.attach()

                                  mInstrumentation.callActivityOnCreate()

                                       2). ActivityThread--->  handleResumeActivity

                                              setContent---->创建window。把绘制交给了WMS

4.从系统启动，到Launcher,到点击桌面启动应用全流程

1、点击桌面App图标，Launcher进程采用Binder IPC向system_server(AMS)进程发起startActivity请求；（launcher----AMS）
2、system_server进程接收到请求后，向zygote进程发送创建进程的请求；(AMS------zygote)
3、Zygote进程fork出新的子进程，即App进程；（APP进程被创建, 注意：如果是子进程在不会重新创建，而是热启动）
4、App进程，通过Binder IPC向sytem_server(AMS)进程发起attachApplication请求；
5、system_server进程在收到请求后，进行一系列准备工作后，再通过binder IPC向App进程发送scheduleLaunchActivity请求；
6、App进程的binder线程（ApplicationThread）在收到请求后，通过handler向主线程发送LAUNCH_ACTIVITY消息；
7、主线程在收到Message后，通过发射机制创建目标Activity，并回调Activity.onCreate()等方法

8  .到此,App 便正式启动，开始进入Activity 生命周期，执行完onCreate/onStart/onResume 方法，UI 渲染结束后便可以看到App 的主界面

image.png

Activity的启动流程总结：

1、Launcher被调用点击事件，转到Instrumentation类的startActivity方法。  Instrumentation通过AIDL方式使用Binder机制告诉ATMS要启动应用的需求。
2.、ATMS收到需求后，反馈Launcher，让Launcher进入Paused状态  .Launcher进入Paused状态，ATMS将创建进程的任务交给AMS，AMS通过socket与Zygote通信，告知Zygote需要新建进程。

3. Zygote进程fork出新的子进程，即App进程；并调用ActivityThread的main方法，也就是app的入口。还会创建Binder 线程池（ProcessState.startThreadPool()
4、在上面创建了APP进程之后。然后通过反射，进入到了 .ActivityThread的main方法新建了ActivityThread实例，并新建了Looper实例，开始loop循环。
5、ActivityThread也告知AMS，进程创建完毕，开始创建Application，Provider，并调用Applicaiton的attach，onCreate方法。
6、Ams处理后，向APP进程发送scheduleLaunchActivity请求，于是乎，activity真正启动了。是scheduleLaunchActivity??????

  1. 最后就是创建上下文，通过类加载器加载Activity，调用Activity的onCreate方法。
avatar
文章
阅读
粉丝