android12 点击桌面应用图标启动Activity流程

启动一个桌面 Activity（即点击应用图标启动）是一个涉及多个进程交互的复杂过程。简单来说，它分为发起请求、系统处理、创建进程、初始化应用和生命周期回调几个核心阶段。

阶段一：发起请求，从Launcher到系统服务

当你点击桌面图标时，Launcher应用会调用startActivity()。这个调用会通过Instrumentation类，最终通过AIDL（Android接口定义语言）跨进程调用到系统服务ActivityTaskManagerService（ATMS）的startActivity()方法。

• 跨进程通信：应用进程与系统服务（运行在system_server进程）的通信，核心是ApplicationThread这个Binder对象，它被传递给ATMS，作为系统向应用进程发送回调的“通道”。

//frameworks/base/core/java/android/app/ContextImpl.java
public void startActivity(Intent intent, Bundle options) {
    //检查调用方是否为系统进程
    warnIfCallingFromSystemProcess();
    //targetSdkVersion校验
    //Android N 之前必须加 NEW_TASK 标志    
    //Android N - Android O允许不加 NEW_TASK（兼容期） 
    //Android P 及以上 恢复强制要求 NEW_TASK
    final int targetSdkVersion = getApplicationInfo().targetSdkVersion;

    if ((intent.getFlags() & Intent.FLAG_ACTIVITY_NEW_TASK) == 0
            && (targetSdkVersion < Build.VERSION_CODES.N
                    || targetSdkVersion >= Build.VERSION_CODES.P)
            && (options == null
                    || ActivityOptions.fromBundle(options).getLaunchTaskId() == -1)) {
        throw new AndroidRuntimeException(
                "Calling startActivity() from outside of an Activity "
                        + " context requires the FLAG_ACTIVITY_NEW_TASK flag."
                        + " Is this really what you want?");
    }
    //mMainThread = ActivityThread
    //Instrumentation.execStartActivity()
    mMainThread.getInstrumentation().execStartActivity(
            getOuterContext(), mMainThread.getApplicationThread(), null,
            (Activity) null, intent, -1, options);
}


//frameworks/base/core/java/android/app/Instrumentation.java

    Context who,           // 调用上下文
    IBinder contextThread, // 应用主线程
    IBinder token,         // Activity Token
    Activity target,       // 目标 Activity（可为null）
    Intent intent,         // 启动意图
    int requestCode,       // 请求码
    Bundle options        // 启动选项

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    //获取其referrer信息, 用于来源统计和安全校验（如防止点击劫持）
    Uri referrer = target != null ? target.onProvideReferrer() : null;
    if (referrer != null) {
        intent.putExtra(Intent.EXTRA_REFERRER, referrer);
    }
    ...
    try {
        intent.migrateExtraStreamToClipData(who); //处理大文件传输（URI权限）
        intent.prepareToLeaveProcess(who); //准备跨进程传递
        int result = 
        //ActivityTaskManagerService.startActivity()
        ActivityTaskManager.getService().startActivity(whoThread,
                who.getOpPackageName(), who.getAttributionTag(), intent,
                intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
        //检查启动结果码
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}


//frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
public final int startActivity(IApplicationThread caller, String callingPackage,
        String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
        String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
        Bundle bOptions) {
    return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType,
            resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions,
            UserHandle.getCallingUserId());
}


private int startActivityAsUser(IApplicationThread caller, String callingPackage,
        @Nullable String callingFeatureId, Intent intent, String resolvedType,
        IBinder resultTo, String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
    //确保调用包名与 UID 匹配，防止伪造包名
    assertPackageMatchesCallingUid(callingPackage);
    //禁止孤立进程（Isolated Process）启动 Activity，
    //这类进程通常用于 WebView 渲染等沙箱场景
    enforceNotIsolatedCaller("startActivityAsUser");
    //校验目标用户是否合法
    userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser,
            Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");

   //将启动参数封装为 `ActivityStarter` 对象
    return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
            .setCaller(caller)
            .setCallingPackage(callingPackage)
            .setCallingFeatureId(callingFeatureId)
            .setResolvedType(resolvedType)
            .setResultTo(resultTo)
            .setResultWho(resultWho)
            .setRequestCode(requestCode)
            .setStartFlags(startFlags)
            .setProfilerInfo(profilerInfo)
            .setActivityOptions(bOptions)
            .setUserId(userId)
            .execute();

}

阶段二：系统处理，解析与调度

ATMS接收到启动请求后，真正干活的“幕后管家”是ActivityStarter。它负责处理启动过程中的核心逻辑：

1. Intent解析与校验：根据Intent找到要启动的目标Activity，并校验其在AndroidManifest.xml中是否声明、调用方是否有权限等。

2. 任务栈与启动模式计算：根据android:launchMode和Intent中的FLAG_ACTIVITY_*标志，计算目标Activity应该放在哪个任务栈（Task）中。

3. 判断进程状态：最重要的一步，检查目标应用进程是否存在。

   • 如果进程已存在（热启动），则直接通知该进程创建Activity实例。
   • 如果进程不存在（冷启动），则需要请求创建一个新的应用进程。

//frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
## 性能优化点
1.  **对象池复用**：`ActivityStarter` 对象不频繁创建
2.  **锁粒度优化**：仅在必要时持锁
3.  **延迟解析**：避免不必要的 PackageManager 查询
4.  **异步日志**：`ActivityMetricsLogger` 异步记录
int execute() {
    try {
         //禁止通过 Intent 传递 FileDescriptor
        //原因：FD 是进程级资源，跨进程传递会导致**资源泄露**和**安全问题**
        //正确方式：使用 `ContentProvider` 或 `FileProvider` 共享文件
        if (mRequest.intent != null && mRequest.intent.hasFileDescriptors()) {
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        ...
        if (mRequest.activityInfo == null) {
            //Intent 解析（延迟解析）
            //查询PackageManager,处理Intent过滤匹配, 处理组件别名activity-alias
            mRequest.resolveActivity(mSupervisor);
        }

        
        if (mRequest.intent != null) {
            String intentAction = mRequest.intent.getAction();
            String callingPackage = mRequest.callingPackage;
          //特殊处理关机/重启 Intent,`ShutdownCheckPoints` 用于记录关机操作的调用来源
            if (intentAction != null && callingPackage != null
                    && (Intent.ACTION_REQUEST_SHUTDOWN.equals(intentAction)
                            || Intent.ACTION_SHUTDOWN.equals(intentAction)
                            || Intent.ACTION_REBOOT.equals(intentAction))) {
                ShutdownCheckPoints.recordCheckPoint(intentAction, callingPackage, null);
            }
        }

        int res;
        synchronized (mService.mGlobalLock) {
            //检查是否需要全局配置变更（如：语言、屏幕方向、密度等）
            final boolean globalConfigWillChange = mRequest.globalConfig != null
                    && mService.getGlobalConfiguration().diff(mRequest.globalConfig) != 0;
            final Task rootTask = mRootWindowContainer.getTopDisplayFocusedRootTask();
            if (rootTask != null) {
                rootTask.mConfigWillChange = globalConfigWillChange;
            }
            

            final long origId = Binder.clearCallingIdentity();
            ...
            //最核心的启动逻辑
            res = executeRequest(mRequest);

            Binder.restoreCallingIdentity(origId);
            //如果配置变更
            if (globalConfigWillChange) {
               //权限检查
                mService.mAmInternal.enforceCallingPermission(
                        android.Manifest.permission.CHANGE_CONFIGURATION,
                        "updateConfiguration()");
                if (rootTask != null) {
                    rootTask.mConfigWillChange = false;
                }
               //更新配置
                mService.updateConfigurationLocked(mRequest.globalConfig, null, false);
            }

           
          ...
//通知监控系统启动完成 ,用于ANR 检测、启动耗时统计
mSupervisor.getActivityMetricsLogger().notifyActivityLaunched(launchingState, res,
                    newActivityCreated, mLastStartActivityRecord, originalOptions);
            if (mRequest.waitResult != null) {
                mRequest.waitResult.result = res;
                //同步等待启动完成,
                //主要用于 `startActivityForResult` 或测试场景
                //会阻塞直到 Activity 完全启动并绘制完成
                res = waitResultIfNeeded(mRequest.waitResult, mLastStartActivityRecord,
                        launchingState);
            }
            //`START_SUCCESS` → `Activity.RESULT_OK`
            return getExternalResult(res);
        }
    } finally {
       //释放 `ActivityStarter` 对象回对象池,重置内部状态
        onExecutionComplete();
    }
}


private int executeRequest(Request request) {
    //每个启动请求必须有 `reason`（用于调试和日志）
    if (TextUtils.isEmpty(request.reason)) {
        throw new IllegalArgumentException("Need to specify a reason.");
    }
    //提取所有参数到局部变量（性能优化）
    mLastStartReason = request.reason;
    mLastStartActivityTimeMs = System.currentTimeMillis();
    mLastStartActivityRecord = null;

    final IApplicationThread caller = request.caller;
    Intent intent = request.intent;
    ...

    WindowProcessController callerApp = null;
    //调用者进程解析
    if (caller != null) {
        callerApp = mService.getProcessController(caller);
        if (callerApp != null) {
            callingPid = callerApp.getPid();
            callingUid = callerApp.mInfo.uid;
        } else {
            // 如果进程不存在，返回权限拒绝
            err = ActivityManager.START_PERMISSION_DENIED;
        }
    }

    final int userId = aInfo != null && aInfo.applicationInfo != null
            ? UserHandle.getUserId(aInfo.applicationInfo.uid) : 0;
    if (err == ActivityManager.START_SUCCESS) {
        
    }

    ActivityRecord sourceRecord = null;
    ActivityRecord resultRecord = null;
    //`resultTo` 是启动者的 Activity Token
    if (resultTo != null) {
       //查找对应的 `ActivityRecord`，用于 `startActivityForResult`
        sourceRecord = mRootWindowContainer.isInAnyTask(resultTo);
        if (sourceRecord != null) {
            if (requestCode >= 0 && !sourceRecord.finishing) {
                resultRecord = sourceRecord;
            }
        }
    }

    final int launchFlags = intent.getFlags();
    //FLAG_ACTIVITY_FORWARD_RESULT 处理
    if ((launchFlags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0 && sourceRecord != null) {
        //冲突
        if (requestCode >= 0) {
            SafeActivityOptions.abort(options);
            return ActivityManager.START_FORWARD_AND_REQUEST_CONFLICT;
        }
        //将结果传递链转发
        resultRecord = sourceRecord.resultTo;
        if (resultRecord != null && !resultRecord.isInRootTaskLocked()) {
            resultRecord = null;
        }
        resultWho = sourceRecord.resultWho;
        requestCode = sourceRecord.requestCode;
        sourceRecord.resultTo = null;
        if (resultRecord != null) {
            resultRecord.removeResultsLocked(sourceRecord, resultWho, requestCode);
        }
        if (sourceRecord.launchedFromUid == callingUid) {
            
            callingPackage = sourceRecord.launchedFromPackage;
            callingFeatureId = sourceRecord.launchedFromFeatureId;
        }
    }

    ...

    //调用者是否有权限启动目标 Activity
    boolean abort = !mSupervisor.checkStartAnyActivityPermission(intent, aInfo, resultWho,
            requestCode, callingPid, callingUid, callingPackage, callingFeatureId,
            request.ignoreTargetSecurity, inTask != null, callerApp, resultRecord,
            resultRootTask);
    //系统级 Intent 防火墙（由 OEM 或 IT 策略配置）
    abort |= !mService.mIntentFirewall.checkStartActivity(intent, callingUid,
            callingPid, resolvedType, aInfo.applicationInfo);
    //Android 10+ 的权限策略检查
    abort |= !mService.getPermissionPolicyInternal().checkStartActivity(intent, callingUid,
            callingPackage);

    boolean restrictedBgActivity = false;
    if (!abort) {
        try {
          
            restrictedBgActivity = 
            //后台 Activity 启动限制 (Android 10+),防止后台应用突然弹窗干扰用户
            //触发条件：应用在后台, 没有 `SYSTEM_ALERT_WINDOW` 权限,没有用户交互
            //违反时会静默失败或通知用户
            shouldAbortBackgroundActivityStart(callingUid,
                    callingPid, callingPackage, realCallingUid, realCallingPid, callerApp,
                    request.originatingPendingIntent, request.allowBackgroundActivityStart,
                    intent);
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);
        }
    }


    ...
    //创建 ActivityRecord
    final ActivityRecord r = new ActivityRecord.Builder(mService)
            .setCaller(callerApp)
            .setLaunchedFromPid(callingPid)
            .setLaunchedFromUid(callingUid)
            .setLaunchedFromPackage(callingPackage)
            .setLaunchedFromFeature(callingFeatureId)
            .setIntent(intent)
            .setResolvedType(resolvedType)
            .setActivityInfo(aInfo)
            .setConfiguration(mService.getGlobalConfiguration())
            .setResultTo(resultRecord)
            .setResultWho(resultWho)
            .setRequestCode(requestCode)
            .setComponentSpecified(request.componentSpecified)
            .setRootVoiceInteraction(voiceSession != null)
            .setActivityOptions(checkedOptions)
            .setSourceRecord(sourceRecord)
            .build();

    mLastStartActivityRecord = r;

    ...
    //执行启动
    mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
            request.voiceInteractor, startFlags, true /* doResume */, checkedOptions, inTask,
            restrictedBgActivity, intentGrants);

    if (request.outActivity != null) {
        request.outActivity[0] = mLastStartActivityRecord;
    }

    return mLastStartActivityResult;
}

//它是 Activity 启动流程中任务栈管理的前置处理层，负责协调窗口过渡动画、延迟布局和调用真正的栈操作
private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            boolean restrictedBgActivity, NeededUriGrants intentGrants) {
    int result = START_CANCELED;
    final Task startedActivityRootTask;

    //Transition（过渡动画）
    //替代旧的 `ActivityOptions.makeSceneTransitionAnimation()`
    //支持跨 Activity/Window 的复杂动画编排
    //创建过渡动画
    final Transition newTransition = (!mService.getTransitionController().isCollecting()
            && mService.getTransitionController().getTransitionPlayer() != null)
            ? mService.getTransitionController().createTransition(TRANSIT_OPEN) : null;
    //远程过渡动画:由其他进程（如 Launcher）提供的动画
    //用于跨进程转场（例如：从 Launcher 启动应用）
    //`takeRemoteTransition()` 从 ActivityRecord 中取出预置的远程动画
    IRemoteTransition remoteTransition = r.takeRemoteTransition();
    if (newTransition != null && remoteTransition != null) {
        newTransition.setRemoteTransition(remoteTransition);
    }
    //收集动画参与者
    mService.getTransitionController().collect(r);
    try {
        //延迟窗口布局（性能优化）
        //1.暂停窗口布局计算
        //2.批量处理多个窗口变化
        //3.减少重绘次数，提升启动性能
        mService.deferWindowLayout();
        //启动Activity
        result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, restrictedBgActivity, intentGrants);
    } finally {
        //启动结果处理
        //返回结果所在的 RootTask，用于后续动画和日志
        startedActivityRootTask = handleStartResult(r, result);
        mService.continueWindowLayout();
        mSupervisor.mUserLeaving = false;

        // Transition housekeeping
        if (!ActivityManager.isStartResultSuccessful(result)) {
            if (newTransition != null) {
               //终止动画
                newTransition.abort();
            }
        } else {
           //允许移动到前台，需要 Resume (`mDoResume`)，
           //启动者的 UID 在通知栏上方有可见窗口，
           //启动者不是通知栏所有者
            if (!mAvoidMoveToFront && mDoResume
                    && mRootWindowContainer.hasVisibleWindowAboveButDoesNotOwnNotificationShade(
                        r.launchedFromUid)) {
                
                StatusBarManagerInternal statusBar = mService.getStatusBarManagerInternal();
                if (statusBar != null) {
                   //收起通知栏，防止通知栏遮挡新启动的 Activity
                    statusBar.collapsePanels();
                }
            }
            if (result == START_SUCCESS || result == START_TASK_TO_FRONT) {
                mService.getTransitionController().collectExistenceChange(r);
            }
            if (newTransition != null) {
//启动动画               mService.getTransitionController().requestStartTransition(newTransition,
                        mTargetTask, remoteTransition);
            } else {
                mService.getTransitionController().setReady(false);
            }
        }
    }
    //执行后续清理工作
    postStartActivityProcessing(r, result, startedActivityRootTask);

    return result;
}


-   `r`：要启动的 Activity 记录
-   `sourceRecord`：发起启动的源 Activity
-   `voiceSession`/`voiceInteractor`：语音交互相关
-   `startFlags`：启动标志
-   `doResume`：是否立即恢复
-   `options`：启动选项（动画、尺寸等）
-   `inTask`：指定放入的 Task
-   `restrictedBgActivity`：是否受限后台启动
-   `intentGrants`：URI 权限授予信息
int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, Task inTask,
        boolean restrictedBgActivity, NeededUriGrants intentGrants) {
    ...
   //根据 Intent Flags 和 LaunchMode 计算启动任务标志
    computeLaunchingTaskFlags();
   //计算源 Activity 所在的 RootTask（根任务容器）。
   //从 `mSourceRecord` 追溯其所属的 RootTask。
    computeSourceRootTask();

    mIntent.setFlags(mLaunchFlags);
   //将计算后的最终启动标志设置回 Intent 中。
    final Task reusedTask = getReusableTask();

    //冻结最近任务列表的重排序
    if (mOptions != null && mOptions.freezeRecentTasksReordering()
            && mSupervisor.mRecentTasks.isCallerRecents(r.launchedFromUid)
            && !mSupervisor.mRecentTasks.isFreezeTaskListReorderingSet()) {
        mFrozeTaskList = true;
        mSupervisor.mRecentTasks.setFreezeTaskListReordering();
    }

    //查找是否有可以复用的 Task
    //复用条件包括：
    //1.  `FLAG_ACTIVITY_NEW_TASK` 且 `taskAffinity` 匹配
    //2.  `singleTask` 或 `singleInstance` 模式
    //3.  `allowTaskReparenting` 为 true
    // 如果有复用 Task，使用它
   //否则调用 `computeTargetTask()` 计算目标
    final Task targetTask = reusedTask != null ? reusedTask : computeTargetTask();
    //`newTask = true` 表示需要创建新 Task
    final boolean newTask = targetTask == null;
    mTargetTask = targetTask;

    //计算启动参数，主要是窗口尺寸和位置：
    //1. 如果 `options` 中指定了尺寸，使用指定值
    //2. 否则从源 Activity 继承或使用默认值
    //3. 用于分屏、自由窗口等场景
    computeLaunchParams(r, sourceRecord, targetTask);

    // 启动许可检查。
    //检查项：
    //1.  权限检查（`checkStartAnyActivityPermission`）
    //2.  设备策略限制（锁屏、设备管理器）
    //3.  是否允许创建新 Task
   //4.  是否允许在指定 Task 中启动
   //返回 `START_SUCCESS` 或错误码。
    int startResult = isAllowedToStart(r, newTask, targetTask);
    if (startResult != START_SUCCESS) {
        return startResult;
    }

    //获取目标 Task 的栈顶 Activity（非 finishing 状态）。
    //如果是新 Task，为 null
   //否则从 targetTask 获取顶部 Activity
    final ActivityRecord targetTaskTop = newTask
            ? null : targetTask.getTopNonFinishingActivity();
    if (targetTaskTop != null) {
         //Task 回收/复用处理。
         //如果 Task 有顶部 Activity：  
         //调用 `recycleTask()`，执行：
         //1.  如果目标 Activity 已在栈顶 → 调用 `onNewIntent()`
         //2.  如果目标 Activity 在栈中 → 清除其上所有 Activity
         //3.  处理 `FLAG_ACTIVITY_CLEAR_TOP`
         //4.  处理 `FLAG_ACTIVITY_SINGLE_TOP`
         //如果 Task 为空：设置 `mAddingToTask = true`，
         //表示要向空 Task 添加 Activity。
        startResult = recycleTask(targetTask, targetTaskTop, reusedTask, intentGrants);
        if (startResult != START_SUCCESS) {
            return startResult;
        }
    } else {
        mAddingToTask = true;
    }

    //处理栈顶重复启动。
    //获取当前聚焦的 RootTask，调用 `deliverToCurrentTopIfNeeded()`：
    //场景：当前栈顶是 Activity A，再次启动 A
    final Task topRootTask = mPreferredTaskDisplayArea.getFocusedRootTask();
    if (topRootTask != null) {
        startResult = deliverToCurrentTopIfNeeded(topRootTask, intentGrants);
        if (startResult != START_SUCCESS) {
            return startResult;
        }
    }

    if (mTargetRootTask == null) {
        //获取/计算启动 RootTask。
        //如果尚未设置目标 RootTask：
        //根据 `launchFlags` 和 `targetTask` 计算
        //选择根容器（RootTaskContainer 或 DisplayArea）
        mTargetRootTask = getLaunchRootTask(mStartActivity, mLaunchFlags, targetTask, mOptions);
    }
    //创建新 Task 或添加到已有 Task。
    if (newTask) {
        //如果 `mLaunchTaskBehind` 为 true 且有源 Activity，
        //关联到源 Task
        final Task taskToAffiliate = (mLaunchTaskBehind && mSourceRecord != null)
                ? mSourceRecord.getTask() : null;
        //创建 Task,设置 Affinity、TaskId、DisplayId
        setNewTask(taskToAffiliate);
    } else if (mAddingToTask) {
        //将 Activity 添加或移动到 targetTask
        addOrReparentStartingActivity(targetTask, "adding to task");
    }
    //允许移到前台且 `mDoResume`（需要恢复）
    if (!mAvoidMoveToFront && mDoResume) {
       //将 Task 移到前台,将 RootTask 移到显示区域最前面
        mTargetRootTask.getRootTask().moveToFront("reuseOrNewTask", targetTask);
        if (mOptions != null) {
            if (mOptions.getTaskAlwaysOnTop()) {
                //设置 Task 置顶
                
                mTargetRootTask.setAlwaysOnTop(true);
            }
        }
        //如果目标 Task 不在最前面，
        //且系统处于 Dream（屏保/白日梦）状态
        if (!mTargetRootTask.isTopRootTaskInDisplayArea() && mService.mInternal.isDreaming()) {
           //1.将 Activity 启动在 Dream 后面
           //2.设置 `mLaunchTaskBehind = true`
           //3.这样 Activity 在可见状态下启动，但被 Dream 遮挡
            mLaunchTaskBehind = true;
            r.mLaunchTaskBehind = true;
        }
    }

   //从 Intent 中提取 URI 权限授予信息
    mService.mUgmInternal.grantUriPermissionUncheckedFromIntent(intentGrants,
            mStartActivity.getUriPermissionsLocked());
     //隐式权限授予（Android 10+ 特性）
    if (mStartActivity.resultTo != null && mStartActivity.resultTo.info != null) {
        
        final PackageManagerInternal pmInternal =
                mService.getPackageManagerInternalLocked();
                // 获取结果接收者的 UID
        final int resultToUid = pmInternal.getPackageUid(
                mStartActivity.resultTo.info.packageName, 0 /* flags */,
                mStartActivity.mUserId);
                //授予隐式权限,简化跨应用组件调用的权限管理
        pmInternal.grantImplicitAccess(mStartActivity.mUserId, mIntent,
                UserHandle.getAppId(mStartActivity.info.applicationInfo.uid) /*recipient*/,
                resultToUid /*visible*/, true /*direct*/);
    }
    ...
    //清空目标 RootTask 的最后暂停 Activity。
    
    mTargetRootTask.mLastPausedActivity = null;
    //启动电源模式（如果必要）
    //用于处理低功耗场景
    //启动 Activity 可能需要提升 CPU/GPU 频率
   //`forceSend = false`：仅在必要时发送
    mRootWindowContainer.startPowerModeLaunchIfNeeded(
            false /* forceSend */, mStartActivity);
   //添加 Activity 到 Task
    mTargetRootTask.startActivityLocked(mStartActivity,
            topRootTask != null ? topRootTask.getTopNonFinishingActivity() : null, newTask,
            mKeepCurTransition, mOptions, sourceRecord);
    if (mDoResume) {
        //处理Resume
        final ActivityRecord topTaskActivity =
                mStartActivity.getTask().topRunningActivityLocked();
        //没有焦点或 Task Overlay
        if (!mTargetRootTask.isTopActivityFocusable()
                || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                && mStartActivity != topTaskActivity)) {
            //确保所有 Activity 可见（但不获取焦点）
            mTargetRootTask.ensureActivitiesVisible(null /* starting */,
                    0 /* configChanges */, !PRESERVE_WINDOWS);
           //执行过渡动画
            mTargetRootTask.mDisplayContent.executeAppTransition();
        } else {
            // 如果目标 RootTask 有焦点但不在最前面，移到最前面
            if (mTargetRootTask.isTopActivityFocusable()
                    && !mRootWindowContainer.isTopDisplayFocusedRootTask(mTargetRootTask)) {
                mTargetRootTask.moveToFront("startActivityInner");
            }
            //恢复栈顶 Activity ，RootWindowContainer
            mRootWindowContainer.resumeFocusedTasksTopActivities(
                    mTargetRootTask, mStartActivity, mOptions, mTransientLaunch);
        }
    }
    //更新用户与 RootTask 的映射
    //用于多用户支持，关联用户 ID 和对应的 RootTask
    mRootWindowContainer.updateUserRootTask(mStartActivity.mUserId, mTargetRootTask);

    // 更新最近任务列表
    //将当前 Task 添加到 Recents
    //确保用户可以通过最近任务切换回来
    mSupervisor.mRecentTasks.add(mStartActivity.getTask());
     //处理不可调整大小的 Task。
    //1.用于分屏/多窗口场景
    //2.如果 Task 不支持调整大小，进行相应处理
    //3.`mPreferredWindowingMode`：偏好窗口模式（全屏/分屏/自由窗口）
    mSupervisor.handleNonResizableTaskIfNeeded(mStartActivity.getTask(),
            mPreferredWindowingMode, mPreferredTaskDisplayArea, mTargetRootTask);
    //返回成功
    return START_SUCCESS;
}


//添加目标Activity 到 Task
//frameworks/base/services/core/java/com/android/server/wm/Task.java
-   `r`：要启动的 ActivityRecord
-   `focusedTopActivity`：当前聚焦的顶部 Activity（用于 PIP 判断）
-   `newTask`：是否是新 Task
-   `keepCurTransition`：是否保持当前过渡动画
-   `options`：启动选项
-   `sourceRecord`：源 Activity
void startActivityLocked(ActivityRecord r, @Nullable ActivityRecord focusedTopActivity,
        boolean newTask, boolean keepCurTransition, ActivityOptions options,
        @Nullable ActivityRecord sourceRecord) {
    //获取 r 所属的 Task。此时 r 已经在之前的步骤中被分配了 Task
    Task rTask = r.getTask();
    //**检查是否允许移到前台**：
    //`options == null`：允许（没有限制）
    //`options.getAvoidMoveToFront()`：如果为 true，禁止移到前台（分屏场景使用）
    final boolean allowMoveToFront = options == null || !options.getAvoidMoveToFront();
    //**检查 Task 关系**：
   //`rTask == this`：r 的 Task 就是当前 RootTask
   // `hasChild(rTask)`：当前 RootTask 包含 rTask（用于 Task 嵌套）
    final boolean isOrhasTask = rTask == this || hasChild(rTask);
    // mLaunchTaskBehind tasks get placed at the back of the task stack.
    if (!r.mLaunchTaskBehind && allowMoveToFront && (!isOrhasTask || newTask)) {
        //`!r.mLaunchTaskBehind`：不是"启动在背后"模式
        //`allowMoveToFront`：允许移到前台
        // `(!isOrhasTask || newTask)`：Task 不属于当前 RootTask，或者是新 Task
        //将 Task 移到 RootTask 顶部**。
        positionChildAtTop(rTask);
    }
    Task task = null;
    //非新 Task (`!newTask`) 且 Task 属于当前 RootTask (`isOrhasTask`)
    if (!newTask && isOrhasTask) {
        //检查目标 Activity 上面是否有遮挡 Activity
        final ActivityRecord occludingActivity = getOccludingActivityAbove(r);
            // 如果有遮挡 Activity：
        
        if (occludingActivity != null) {
             //直接将 Activity 添加到 Task 顶部 (`positionChildAtTop(r)`)
             //Abort options
             //`return` 提前返回，不启动 Activity
            //等用户导航回来再启动
            rTask.positionChildAtTop(r);
            ActivityOptions.abort(options);
            return;
        }
    }

    //获取 r 所在的 Task
    final Task activityTask = r.getTask();
   
    if (task == activityTask && mChildren.indexOf(task) != (getChildCount() - 1)) {  
       //task 变量（之前声明）等于 activityTask
       //该 Task 不在 RootTask 的最后一个位置（即不在最前面）
        //设置 `mTaskSupervisor.mUserLeaving = false`
        //当新 Activity 启动在背后时，不触发前台 Activity 的 `onUserLeaving()` 回调
        mTaskSupervisor.mUserLeaving = false;
       
    }

    task = activityTask;

    //**将 Activity 添加到 Task 顶部**。
    task.positionChildAtTop(r);
    //不是空的 Home/Recents Task，或者该 Task 有 Activity
    //允许移到前台
    if ((!isHomeOrRecentsRootTask() || hasActivity()) && allowMoveToFront) {
        final DisplayContent dc = mDisplayContent;
        //**准备过渡动画**。
        if ((r.intent.getFlags() & Intent.FLAG_ACTIVITY_NO_ANIMATION) != 0) {
            //设置无动画
            dc.prepareAppTransition(TRANSIT_NONE);
            //添加到无动画列表
            mTaskSupervisor.mNoAnimActivities.add(r);
        } else {
            // 默认动画类型
            int transit = TRANSIT_OLD_ACTIVITY_OPEN;
            if (newTask) {
                if (r.mLaunchTaskBehind) {
                    //设置动画类型
                    transit = TRANSIT_OLD_TASK_OPEN_BEHIND;
                } else {
                    
                    if (canEnterPipOnTaskSwitch(focusedTopActivity,
                            null /* toFrontTask */, r, options)) {
                        focusedTopActivity.supportsEnterPipOnTaskSwitch = true;
                    }
                    //设置动画类型
                    transit = TRANSIT_OLD_TASK_OPEN;
                }
            }
            //准备打开过渡动画
            dc.prepareAppTransition(TRANSIT_OPEN);
            //从无动画列表移除
            mTaskSupervisor.mNoAnimActivities.remove(r);
        }
        //是否显示启动窗口
        boolean doShow = true;
        if (newTask) {
            
            if ((r.intent.getFlags() & Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED) != 0) {
                //重置 Task（移动匹配 Affinity 的 Activity）
                resetTaskIfNeeded(r, r);
                //如果 r 是栈顶 Activity，显示启动窗口
                doShow = topRunningNonDelayedActivityLocked(null) == r;
            }
        } else if (options != null && options.getAnimationType()
                == ActivityOptions.ANIM_SCENE_TRANSITION) {
            //如果使用场景过渡动画
            //不显示启动窗口（场景过渡有自己的加载状态）
            doShow = false;
        }
        //**是否显示启动窗口**
        if (r.mLaunchTaskBehind) {
           
            r.setVisibility(true);
            //确保所有 Activity 可见
            ensureActivitiesVisible(null, 0, !PRESERVE_WINDOWS);
            //立即执行过渡动画（不通过 Resume 通道）
            mDisplayContent.executeAppTransition();
        } else if (SHOW_APP_STARTING_PREVIEW && doShow) {
           
            Task prevTask = r.getTask();
            //获取有启动窗口的顶部 Activity
            ActivityRecord prev = prevTask.topActivityWithStartingWindow();
            if (prev != null) {
                //在不同 Task，不复用
                if (prev.getTask() != prevTask) {
                    prev = null;
                }
                //已可见，不复用
                else if (prev.nowVisible) {
                    prev = null;
                }
            }
           //显示启动窗口
            r.showStartingWindow(prev, newTask, isTaskSwitch(r, focusedTopActivity),
                    true /* startActivity */, sourceRecord);
        }
    } else {
        //不需要动画，因为没有任何东西在它上面做动画
        // 释放 options 资源
        ActivityOptions.abort(options);
    }
}



//恢复栈顶Activity（包含刚添加到栈顶的Activity）
//frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java
boolean resumeFocusedTasksTopActivities(
        Task targetRootTask, ActivityRecord target, ActivityOptions targetOptions,
        boolean deferPause) {
    if (!mTaskSupervisor.readyToResume()) {
        return false;
    }

    boolean result = false;
    //有指定的目标 RootTask，目标 RootTask 在显示区域顶部，目标 RootTask有焦点
    if (targetRootTask != null && (targetRootTask.isTopRootTaskInDisplayArea()
            || getTopDisplayFocusedRootTask() == targetRootTask)) {
        //执行 Resume
        //启动新 Activity 
        result = targetRootTask.resumeTopActivityUncheckedLocked(target, targetOptions,
                deferPause);
    }

    //**遍历所有 Display**（从后往前，即从最顶层开始）
    //支持多显示器场景（外接屏幕、投屏等）。
    for (int displayNdx = getChildCount() - 1; displayNdx >= 0; --displayNdx) {       //获取当前 DisplayContent
        final DisplayContent display = getChildAt(displayNdx);
        //保存之前的执行结果
        final boolean curResult = result;
        boolean[] resumedOnDisplay = new boolean[1];
        //**遍历当前 Display 下的所有 RootTask**
        display.forAllRootTasks(rootTask -> {
             //获取当前 RootTask 的顶部 Activity。
            final ActivityRecord topRunningActivity = rootTask.topRunningActivity();
            if (!rootTask.isFocusableAndVisible() || topRunningActivity == null) {         //RootTask没有焦点或不可见，没有正在运行的 Activity
                return;
            }
            //如果当前 RootTask 就是目标 RootTask：
            if (rootTask == targetRootTask) {
               //将之前的结果保存到 `resumedOnDisplay`
                resumedOnDisplay[0] |= curResult;
                return;
            }
            //**处理非目标 RootTask**：
            //**RootTask 在顶部且 Activity 已处于 RESUMED 状态**
            if (rootTask.getDisplayArea().isTopRootTask(rootTask)
                    && topRunningActivity.isState(RESUMED)) {
                //执行过渡动画
                //确保动画正确执行，但不需要额外的生命周期变化
                rootTask.executeAppTransition(targetOptions);
            } else {
                //尝试激活该 Activity
                //会检查是否需要 Resume/Pause
                resumedOnDisplay[0] |= topRunningActivity.makeActiveIfNeeded(target);
            }
        });
        //**合并结果**。如果任一 Display 有 Resume 操作，整体结果为 true。
        result |= resumedOnDisplay[0];
        //**处理当前 Display 没有任何 Resume 的情况**。
        if (!resumedOnDisplay[0]) {
            //获取当前 Display 的聚焦 RootTask。
            final Task focusedRoot = display.getFocusedRootTask();
            //如果有聚焦的 RootTask
            if (focusedRoot != null) {
                result |= focusedRoot.resumeTopActivityUncheckedLocked(target, targetOptions);
            } else if (targetRootTask == null) {
                //启动 Home Activity（桌面）
                result |= resumeHomeActivity(null /* prev */, "no-focusable-task",
                        display.getDefaultTaskDisplayArea());
            }
        }
    }

    return result;
}


//启动新 Activity 
//frameworks/base/services/core/java/com/android/server/wm/Task.java
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options,
        boolean deferPause) {
    //如果是正在执行Resume的Activity
    if (mInResumeTopActivity) {
        return false;
    }

    boolean someActivityResumed = false;
    try {
      
        mInResumeTopActivity = true;
        //检查是否直接包含 Activity（没有子 Task）
        if (isLeafTask()) {
            //检查是否可聚焦且可见
            if (isFocusableAndVisible()) {
                //执行真正的 Resume
                someActivityResumed = resumeTopActivityInnerLocked(prev, options, deferPause);
            }
        } else {
            //非叶子 Task 处理（Task 嵌套）
            //从最后一个子 Task 开始（最顶层）
            int idx = mChildren.size() - 1;
            while (idx >= 0) {
                //获取子 Task
                final Task child = (Task) getChildAt(idx--);
                //跳过不可聚焦的子 Task
                if (!child.isTopActivityFocusable()) {
                    continue;
                }
                //如果子 Task 不可见，停止遍历
                if (child.getVisibility(null /* starting */) != TASK_VISIBILITY_VISIBLE) {
                    break;
                }
                //递归调用子 Task 的 Resume
                someActivityResumed |= child.resumeTopActivityUncheckedLocked(prev, options,
                        deferPause);
                //如果递归过程中层级结构变化，重新调整索引
                if (idx >= mChildren.size()) {
                    idx = mChildren.size() - 1;
                }
            }
        }

        //获取当前正在运行的顶部 Activity
        final ActivityRecord next = topRunningActivity(true /* focusableOnly */);
        //没有 Activity）或 `!next.canTurnScreenOn()`（不能点亮屏幕）
        if (next == null || !next.canTurnScreenOn()) {
           //检查是否需要让系统进入休眠（如锁屏场景）
            checkReadyForSleep();
        }
    } finally {
        //无论成功还是异常，都清除递归保护标志。
        mInResumeTopActivity = false;
    }

    return someActivityResumed;
}



1.  找到要恢复的 Activity
2.  暂停当前 Activity
3.  恢复目标 Activity
4.  触发生命周期回调
//frameworks/base/services/core/java/com/android/server/wm/Task.java
-   `prev`：之前显示的 Activity（用于生命周期回调）
-   `options`：启动选项（动画等）
-   `deferPause`：是否延迟暂停当前 Activity
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options,
        boolean deferPause) {
    //系统正在启动中
    if (!mAtmService.isBooting() && !mAtmService.isBooted()) {
        //系统还未准备好
        return false;
    }

    //获取栈顶可聚焦的 Activity(focusableOnly = true ,只返回可聚焦的 Activity)
    ActivityRecord next = topRunningActivity(true /* focusableOnly */);
    //是否有可运行的 Activity
    final boolean hasRunningActivity = next != null;

    //检查 Task 是否已附加到 Display
    //如果 Task 未附加到显示区域，无法恢复 Activity
    if (hasRunningActivity && !isAttached()) {
        return false;
    }
    //取消正在初始化的 Activity,确保不会干扰当前的 Resume 操作
    mRootWindowContainer.cancelInitializingActivities();
    //如果当前 Task 没有可运行的 Activity
    if (!hasRunningActivity) {
        //查找下一个可聚焦的 Task
        return resumeNextFocusableActivityWhenRootTaskIsEmpty(prev, options);
    }
    //取消延迟 Resume
    next.delayedResume = false;
    //获取 Task 所在的显示区域
    final TaskDisplayArea taskDisplayArea = getDisplayArea();

    //**目标 Activity 已经处于 RESUMED 状态**
    if (mResumedActivity == next && next.isState(RESUMED)
            && taskDisplayArea.allResumedActivitiesComplete()) {
        //执行过渡动画
        executeAppTransition(options);
        //如果在多窗口模式，确保 Activity 可见
        if (taskDisplayArea.inMultiWindowMode()) {
            taskDisplayArea.ensureActivitiesVisible(null /* starting */, 0 /* configChanges */,
                    false /* preserveWindows */, true /* notifyClients */);
        }
        
        return false;
    }
  
    //检查 Activity 是否可以通过兼容性方式恢复
    if (!next.canResumeByCompat()) {
        return false;
    }

    //检查是否有 Activity 正在暂停
    final boolean allPausedComplete = mRootWindowContainer.allPausedActivitiesComplete();
    //如果有 Activity 正在暂停，等待完成后再 Resume
    if (!allPausedComplete) {
        return false;
    }

    //如果系统正在休眠，且目标 Activity 是最后暂停的 Activity
    if (mLastPausedActivity == next && shouldSleepOrShutDownActivities()) {
        //执行过渡动画，不进行 Resume
        executeAppTransition(options);
       
        return false;
    }

    //确保 Activity 所属的用户已启动
    //如果用户未启动，跳过 Resume（多用户场景）
    if (!mAtmService.mAmInternal.hasStartedUserState(next.mUserId)) {
        
        return false;
    }

    //从停止列表中移除（即将 Resume，不再需要 Stop）
    mTaskSupervisor.mStoppingActivities.remove(next);
   
    //设置启动来源 UID（用于统计和权限检查）
    mTaskSupervisor.setLaunchSource(next.info.applicationInfo.uid);

    ActivityRecord lastResumed = null;
    //获取最后聚焦的 RootTask
    final Task lastFocusedRootTask = taskDisplayArea.getLastFocusedRootTask();
    //如果最后聚焦的 RootTask 不是当前 Task，
    if (lastFocusedRootTask != null && lastFocusedRootTask != getRootTask()) {
        //获取其恢复的 Activity
        lastResumed = lastFocusedRootTask.getResumedActivity();
    }

    //暂停当前 Activity
    boolean pausing = !deferPause && taskDisplayArea.pauseBackTasks(next);
    if (mResumedActivity != null) {
        //开始暂停当前 Activity,调用当前 Activity 的 `onPause()`
        pausing |= startPausingLocked(false /* uiSleeping */, next,
                "resumeTopActivityInnerLocked");
    }
    //如果需要暂停
    if (pausing) {
        //如果目标 Activity 进程已存在，
        if (next.attachedToProcess()) {
            //更新进程信息（提高优先级）
            next.app.updateProcessInfo(false /* updateServiceConnectionActivities */,
                    true /* activityChange */, false /* updateOomAdj */,
                    false /* addPendingTopUid */);
        } else if (!next.isProcessRunning()) {
           //如果目标 Activity 进程未运行，提前启动进程
            final boolean isTop = this == taskDisplayArea.getFocusedRootTask();
            mAtmService.startProcessAsync(next, false /* knownToBeDead */, isTop,
                    isTop ? "pre-top-activity" : "pre-activity");
        }
        if (lastResumed != null) {
            //设置 PIP 关闭标志
            lastResumed.setWillCloseOrEnterPip(true);
        }
        return true;
        //如果目标 Activity 已经是 RESUMED 状态
    } else if (mResumedActivity == next && next.isState(RESUMED)
            && taskDisplayArea.allResumedActivitiesComplete()) {
        //执行过渡动画
        executeAppTransition(options);
       
        return true; //等待暂停完成
    }

    //如果系统正在休眠
    if (shouldSleepActivities()) {
        //完成 noHistory Activity,确保这些 Activity 不会保留在栈中
        mTaskSupervisor.finishNoHistoryActivitiesIfNeeded(next);
    }
    
    //如果下一个 Activity 已经可见,
    if (prev != null && prev != next && next.nowVisible) {
        //且前一个 Activity 正在 finishing，立即隐藏其窗口
        if (prev.finishing) {
            prev.setVisibility(false);
            
        } else {
          //否则等待正常的隐藏流程
            
        }

    }

  
    try {
        //应用被停止（stopped）时不能启动 Activity
        mTaskSupervisor.getActivityMetricsLogger()
                .notifyBeforePackageUnstopped(next.packageName);
        //调用 PackageManager 取消停止状态
        mAtmService.getPackageManager().setPackageStoppedState(
                next.packageName, false, next.mUserId); /* TODO: Verify if correct userid */
    } catch (RemoteException e1) {
    } catch (IllegalArgumentException e) {
        Slog.w(TAG, "Failed trying to unstop package "
                + next.packageName + ": " + e);
    }

    //**准备过渡动画**
    boolean anim = true;
    final DisplayContent dc = taskDisplayArea.mDisplayContent;
    if (prev != null) {
        //前一个 Activity 正在 finishing
        if (prev.finishing) {
            //前一个 Activity包含在无动画列表
            if (mTaskSupervisor.mNoAnimActivities.contains(prev)) {
                anim = false;
                //设置无动画
                dc.prepareAppTransition(TRANSIT_NONE);
            } else {
                //设置关闭动画
                dc.prepareAppTransition(TRANSIT_CLOSE);
            }
            prev.setVisibility(false);
        } else {
              //下一个 Activity包含在无动画列表
            if (mTaskSupervisor.mNoAnimActivities.contains(next)) {
                anim = false;
                //设置无动画
                dc.prepareAppTransition(TRANSIT_NONE);
            } else {
                //设置打开动画
                dc.prepareAppTransition(TRANSIT_OPEN,
                        next.mLaunchTaskBehind ? TRANSIT_FLAG_OPEN_BEHIND : 0);
            }
        }
    } else {
        
        if (mTaskSupervisor.mNoAnimActivities.contains(next)) {
            anim = false;
            //设置无动画
            dc.prepareAppTransition(TRANSIT_NONE);
        } else {
            //设置打开动画
            dc.prepareAppTransition(TRANSIT_OPEN);
        }
    }

    if (anim) {
        next.applyOptionsAnimation();
    } else {
        next.abortAndClearOptionsAnimation();
    }

    mTaskSupervisor.mNoAnimActivities.clear();

    //处理已经绑定到Activity
    if (next.attachedToProcess()) {
        //检查前一个 Activity 是否透明（用于正确的过渡动画）
        final boolean lastActivityTranslucent = lastFocusedRootTask != null
                && (lastFocusedRootTask.inMultiWindowMode()
                || (lastFocusedRootTask.mLastPausedActivity != null
                && !lastFocusedRootTask.mLastPausedActivity.occludesParent()));

        
        if (!next.mVisibleRequested || next.stopped || lastActivityTranslucent) {
            //设置 Activity 为可见
            next.setVisibility(true);
        }

        ...

        try {
            //创建 ClientTransaction,用于跨进程调用应用进程
            final ClientTransaction transaction =
                    ClientTransaction.obtain(next.app.getThread(), next.appToken);
            
            ArrayList<ResultInfo> a = next.results;
            if (a != null) {
                final int N = a.size();
                if (!next.finishing && N > 0) {
                    //传递待处理结果， `startActivityForResult` 的结果
                    transaction.addCallback(ActivityResultItem.obtain(a));
                }
            }

            if (next.newIntents != null) {
                //传递新 Intent， `onNewIntent()` 回调
                transaction.addCallback(
                        NewIntentItem.obtain(next.newIntents, true /* resume */));
            }

           
            next.notifyAppResumed(next.stopped);
            ...
            next.abortAndClearOptionsAnimation();
            //设置生命周期请求，请求应用进程执行 `onResume()`
            transaction.setLifecycleStateRequest(
                    ResumeActivityItem.obtain(next.app.getReportedProcState(),
                            dc.isNextTransitionForward()));
            
 //跨进程调用到应用进程ClientLifecycleManager          
 mAtmService.getLifecycleManager().scheduleTransaction(transaction);
       
        } catch (Exception e) {
            ...
            // 如果 Resume 失败，恢复状态
            //显示启动窗口
            //启动 Activity
            mTaskSupervisor.startSpecificActivity(next, true, false);
            return true;
        }

       
        try {
            //完成 Resume 后的收尾工作,更新状态、停止启动计时等
            next.completeResumeLocked();
        } catch (Exception e) {
            //异常，finish 当前 Activity
            next.finishIfPossible("resume-exception", true /* oomAdj */);
            return true;
        }
    } else {
        //Activity 所属的应用进程已经存在，但该 Activity 还没有被正确绑定到该进程中
        if (!next.hasBeenLaunched) {
            next.hasBeenLaunched = true;
        } else {
            if (SHOW_APP_STARTING_PREVIEW) {
                //显示启动窗口
                next.showStartingWindow(false /* taskSwich */);
            }
            
        }
        //启动 Activity
        mTaskSupervisor.startSpecificActivity(next, true, true);
    }

    return true;
}

//frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java
void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
   //根据进程名和 UID 查找进程
    final WindowProcessController wpc =
            mService.getProcessController(r.processName, r.info.applicationInfo.uid);

    boolean knownToBeDead = false;
    //进程记录存在，进程有 `IApplicationThread`（已绑定）
    if (wpc != null && wpc.hasThread()) {
        try {
            //真正的 Activity 启动方法
            realStartActivityLocked(r, wpc, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
           
        }
        //是否已知进程死亡
        knownToBeDead = true;
    }
    ...
    //判断该 Activity 是否在栈顶
    final boolean isTop = andResume && r.isTopRunningActivity();
    //异步创建进程，mService=ActivityTaskManagerService
    mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
}

//启动Activity
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
        boolean andResume, boolean checkConfig) throws RemoteException {

    ...

   

        try {
            ...
            final ClientTransaction clientTransaction = ClientTransaction.obtain(
                    proc.getThread(), r.appToken);

            final boolean isTransitionForward = r.isTransitionForward();
            //添加 LaunchActivityItem（回调）
            //`LaunchActivityItem.execute()` → `Activity.onCreate()`
            clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                    System.identityHashCode(r), r.info,
                    
                    mergedConfiguration.getGlobalConfiguration(),
                    mergedConfiguration.getOverrideConfiguration(), r.compat,
                    r.launchedFromPackage, task.voiceInteractor, proc.getReportedProcState(),
                    r.getSavedState(), r.getPersistentSavedState(), results, newIntents,
                    r.takeOptions(), isTransitionForward,
                    proc.createProfilerInfoIfNeeded(), r.assistToken, activityClientController,
                    r.createFixedRotationAdjustmentsIfNeeded(), r.shareableActivityToken,
                    r.getLaunchedFromBubble()));

           
            final ActivityLifecycleItem lifecycleItem;
            if (andResume) {
                //onResume()
                //`ResumeActivityItem.execute()` → `Activity.onResume()`
                lifecycleItem = ResumeActivityItem.obtain(isTransitionForward);
            } else {
                //onPause()
                lifecycleItem = PauseActivityItem.obtain();
            }
            clientTransaction.setLifecycleStateRequest(lifecycleItem);

           
    //调度事务       mService.getLifecycleManager().scheduleTransaction(clientTransaction);

            ...

        } catch (RemoteException e) {
            ...
            
            throw e;
        }
    } finally {
        endDeferResume();
        proc.resumeConfigurationDispatch();
    }

    ...

    return true;
}

阶段三：创建进程，Zygote的孵化

对于冷启动，AMS会通过socket向Zygote进程发送一个“孵化”新进程的请求。Zygote是Android系统的“孵化器”，所有应用进程都是由它fork（拷贝自身）出来的，这样能高效地让新进程继承预先加载好的Java虚拟机实例和系统资源。

新进程创建后，会执行ActivityThread类的main()方法，这是每个Android应用Java世界的入口。

//创建进程
//frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
void startProcessAsync(ActivityRecord activity, boolean knownToBeDead, boolean isTop,
        String hostingType) {
    try {
        final Message m = PooledLambda.obtainMessage(ActivityManagerInternal::startProcess,
                mAmInternal, activity.processName, activity.info.applicationInfo, knownToBeDead,
                isTop, hostingType, activity.intent.getComponent());
        mH.sendMessage(m);
    } finally {
        
    }
}

//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public void startProcess(String processName, ApplicationInfo info, boolean knownToBeDead,
        boolean isTop, String hostingType, ComponentName hostingName) {
    try {
        
        ...
            //创建进程
            startProcessLocked(processName, info, knownToBeDead, 0 /* intentFlags */,
                    new HostingRecord(hostingType, hostingName, isTop),
                    ZYGOTE_POLICY_FLAG_LATENCY_SENSITIVE, false /* allowWhileBooting */,
                    false /* isolated */);
        ...
    } 
}


final ProcessRecord startProcessLocked(String processName,
        ApplicationInfo info, boolean knownToBeDead, int intentFlags,
        HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting,
        boolean isolated) {
           //mProcessList = ProcessList
    return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
            hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */,
            null /* ABI override */, null /* entryPoint */,
            null /* entryPointArgs */, null /* crashHandler */);
}


//frameworks/base/services/core/java/com/android/server/am/ProcessList.java
boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,
        int zygotePolicyFlags, boolean disableHiddenApiChecks, boolean disableTestApiChecks,
        String abiOverride) {
    //如果进程正在启动中，直接返回 true（避免重复启动）
    if (app.isPendingStart()) {
        return true;
    }
    long startTime = SystemClock.uptimeMillis();
    //清理旧的进程状态
    if (app.getPid() > 0 && app.getPid() != ActivityManagerService.MY_PID) {
        //从 PID 映射表中移除
        mService.removePidLocked(app.getPid(), app);
        app.setBindMountPending(false);
        // 移除启动超时消息（进程已启动，不需要超时监控）
        mService.mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
        checkSlow(startTime, "startProcess: done removing from pids map");
        //重置 PID
        app.setPid(0);
        //重置启动序列号
        app.setStartSeq(0);
    }
    //解除死亡监听（进程记录可能被复用）
    app.unlinkDeathRecipient();
    //重置 dying PID
    app.setDyingPid(0);
    //从等待列表中移除
    mService.mProcessesOnHold.remove(app);
    //记录耗时操作
    checkSlow(startTime, "startProcess: starting to update cpu stats");
    //更新 CPU 统计
    mService.updateCpuStats();
    //记录耗时操作
    checkSlow(startTime, "startProcess: done updating cpu stats");

    try {
        final int userId = UserHandle.getUserId(app.uid);
        try {
           //检查包是否可启动并初始化变量
           AppGlobals.getPackageManager().checkPackageStartable(app.info.packageName, userId);
        } catch (RemoteException e) {
            throw e.rethrowAsRuntimeException();
        }
        ...
        
        if (enableNativeHeapZeroInit(app)) {
            runtimeFlags |= Zygote.NATIVE_HEAP_ZERO_INIT;
        }

        // the per-user SELinux context must be set
        if (TextUtils.isEmpty(app.info.seInfoUser)) {
           
        }
        //SELinux 上下文
        final String seInfo = app.info.seInfo
                + (TextUtils.isEmpty(app.info.seInfoUser) ? "" : app.info.seInfoUser);
        //入口类（`ActivityThread`）
        final String entryPoint = "android.app.ActivityThread";
        //创建进程
        return startProcessLocked(hostingRecord, entryPoint, app, uid, gids,
                runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi,
                instructionSet, invokeWith, startTime);
    } catch (RuntimeException e) {
        ...
        return false;
    }
}

boolean startProcessLocked(HostingRecord hostingRecord, String entryPoint, ProcessRecord app,
        int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    //标记进程正在启动中（防止重复启动）
    app.setPendingStart(true);
    //清除"已移除"标记
    app.setRemoved(false);
    synchronized (mProcLock) {
        //清除"被 AMS 杀死"标记
        app.setKilledByAm(false);
        //清除"已杀死"标记
        app.setKilled(false);
    }
    
    if (app.getStartSeq() != 0) {
      //说明进程状态异常
    }
    if (app.getPid() != 0) {
       //说明进程已经存在
    }
    //获取针对该应用禁用的兼容性变更列表
    app.setDisabledCompatChanges(null);
    if (mPlatformCompat != null) {
      app.setDisabledCompatChanges(mPlatformCompat.getDisabledChanges(app.info));
    }
    //### 分配启动序列号,每次启动进程分配一个唯一的序列号,用于跟踪和验证进程启动
    final long startSeq = ++mProcStartSeqCounter;
    //保存到 ProcessRecord
    app.setStartSeq(startSeq);
    //保存启动参数
    app.setStartParams(uid, hostingRecord, seInfo, startTime);
    //是否使用包装器
    app.setUsingWrapper(invokeWith != null
            || Zygote.getWrapProperty(app.processName) != null);
    //加入待启动队列
    mPendingStarts.put(startSeq, app);
    //根据配置选择同步或异步启动
    if (mService.mConstants.FLAG_PROCESS_START_ASYNC) {
        //异步启动（Android 12+ 默认）
        mService.mProcStartHandler.post(() -> handleProcessStart(
                app, entryPoint, gids, runtimeFlags, zygotePolicyFlags, mountExternal,
                requiredAbi, instructionSet, invokeWith, startSeq));
        return true;
    } else {
        try {
            //同步启动
            final Process.ProcessStartResult startResult = startProcess(hostingRecord,
                    entryPoint, app,
                    uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo,
                    requiredAbi, instructionSet, invokeWith, startTime);
            handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                    startSeq, false);
        } catch (RuntimeException e) {
            ...
        }
        return app.getPid() > 0;
    }
}

//异步启动进程
1.  等待前序进程死亡（如果有）
2.  调用 Zygote 启动新进程
3.  处理启动结果
private void handleProcessStart(final ProcessRecord app, final String entryPoint,
        final int[] gids, final int runtimeFlags, int zygotePolicyFlags,
        final int mountExternal, final String requiredAbi, final String instructionSet,
        final String invokeWith, final long startSeq) {
    //前一个进程记录（如进程被杀死后重建）
    final ProcessRecord predecessor = app.mPredecessor;
    int prevPid;
    //getDyingPid（）获取正在死亡中的进程 PID
    if (predecessor != null && (prevPid = predecessor.getDyingPid()) > 0) {
        //如果有前序进程且正在死亡，需要等待它完全结束
        long now = System.currentTimeMillis();
        final long end = now + PROC_KILL_TIMEOUT;
        final int oldPolicy = StrictMode.getThreadPolicyMask();
        try {
            //临时禁用 StrictMode：避免等待过程中的磁盘访问检测
            StrictMode.setThreadPolicyMask(0);
            //阻塞直到进程死亡或超时
            Process.waitForProcessDeath(prevPid, PROC_KILL_TIMEOUT);
          
            synchronized (predecessor) {
                if (app.mPredecessor != null) {
                    now = System.currentTimeMillis();
                    if (now < end) {
                        try {
                            //进程死亡后，系统可能需要时间清理资源
                            //等待清理完成
                            predecessor.wait(end - now);
                        } catch (InterruptedException e) {
                        }
                        
                    }
                }
                
            
        } catch (Exception e) {
            
        } finally {
            StrictMode.setThreadPolicyMask(oldPolicy);
        }
    }
    try {
        //启动新进程
        //返回 ProcessStartResult (pid)
        final Process.ProcessStartResult startResult = startProcess(app.getHostingRecord(),
                entryPoint, app, app.getStartUid(), gids, runtimeFlags, zygotePolicyFlags,
                mountExternal, app.getSeInfo(), requiredAbi, instructionSet, invokeWith,
                app.getStartTime());

        synchronized (mService) {
             //处理启动结果
             //记录 PID
             //从 mPendingStarts 移除
            //设置进程状态
            //取消启动超时消息
            handleProcessStartedLocked(app, startResult, startSeq);
        }
    } catch (RuntimeException e) {
        ...
        }
    }
}


private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags,
        int mountExternal, String seInfo, String requiredAbi, String instructionSet,
        String invokeWith, long startTime) {
    try {
        //是否栈顶 Activity
        final boolean isTopApp = hostingRecord.isTopApp();
        if (isTopApp) {
            //临时设置 `hasForegroundActivities`
            //在进程附着期间保持调度优先级，防止被降低
            app.mState.setHasForegroundActivities(true);
        }
        ...
        final Process.ProcessStartResult startResult;
        boolean regularZygote = false;
        //**根据 HostingRecord 选择 Zygote 类型**
        if (hostingRecord.usesWebviewZygote()) {
             //WebView Zygote,启动 WebView 进程
            startResult = startWebView(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null, app.info.packageName,
                    app.getDisabledCompatChanges(),
                    new String[]{PROC_START_SEQ_IDENT + app.getStartSeq()});
        } else if (hostingRecord.usesAppZygote()) {
            //App Zygote,应用专属 Zygote（如 Chrome）
            final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app);

            
            startResult = appZygote.getProcess().start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null, app.info.packageName,
                    /*zygotePolicyFlags=*/ ZYGOTE_POLICY_FLAG_EMPTY, isTopApp,
                    app.getDisabledCompatChanges(), pkgDataInfoMap, allowlistedAppDataInfoMap,
                    false, false,
                    new String[]{PROC_START_SEQ_IDENT + app.getStartSeq()});
        } else {
            //普通应用,默认 Zygote 进程 
            regularZygote = true;
            startResult = Process.start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, invokeWith, app.info.packageName, zygotePolicyFlags,
                    isTopApp, app.getDisabledCompatChanges(), pkgDataInfoMap,
                    allowlistedAppDataInfoMap, bindMountAppsData, bindMountAppStorageDirs,
                    new String[]{PROC_START_SEQ_IDENT + app.getStartSeq()});
        }

        if (!regularZygote) {
            //**创建进程组**。
            //WebView Zygote 和 App Zygote 没有权限创建进程组,系统需要显式创建
            //用于 CPU 调度和 cgroup 管理
            if (Process.createProcessGroup(uid, startResult.pid) < 0) {
               
            }
        }
        ...
        return startResult;
    } finally {
    }
}


//frameworks/base/core/java/android/os/ZygoteProcess.java
public final Process.ProcessStartResult start(@NonNull final String processClass,
                                              final String niceName,
                                              int uid, int gid, @Nullable int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion,
                                              @Nullable String seInfo,
                                              @NonNull String abi,
                                              @Nullable String instructionSet,
                                              @Nullable String appDataDir,
                                              @Nullable String invokeWith,
                                              @Nullable String packageName,
                                              int zygotePolicyFlags,
                                              boolean isTopApp,
                                              @Nullable long[] disabledCompatChanges,
                                              @Nullable Map<String, Pair<String, Long>>
                                                      pkgDataInfoMap,
                                              @Nullable Map<String, Pair<String, Long>>
                                                      allowlistedDataInfoList,
                                              boolean bindMountAppsData,
                                              boolean bindMountAppStorageDirs,
                                              @Nullable String[] zygoteArgs) {
    
    ...

    try {
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, /*startChildZygote=*/ false,
                packageName, zygotePolicyFlags, isTopApp, disabledCompatChanges,
                pkgDataInfoMap, allowlistedDataInfoList, bindMountAppsData,
                bindMountAppStorageDirs, zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        ...
    }
}


private Process.ProcessStartResult startViaZygote(@NonNull final String processClass,
                                                  @Nullable final String niceName,
                                                  final int uid, final int gid,
                                                  @Nullable final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion,
                                                  @Nullable String seInfo,
                                                  @NonNull String abi,
                                                  @Nullable String instructionSet,
                                                  @Nullable String appDataDir,
                                                  @Nullable String invokeWith,
                                                  boolean startChildZygote,
                                                  @Nullable String packageName,
                                                  int zygotePolicyFlags,
                                                  boolean isTopApp,
                                                  @Nullable long[] disabledCompatChanges,
                                                  @Nullable Map<String, Pair<String, Long>>
                                                          pkgDataInfoMap,
                                                  @Nullable Map<String, Pair<String, Long>>
                                                          allowlistedDataInfoList,
                                                  boolean bindMountAppsData,
                                                  boolean bindMountAppStorageDirs,
                                                  @Nullable String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
     //构建参数列表
    ArrayList<String> argsForZygote = new ArrayList<>();
    //标记这是一个运行时参数请求
    argsForZygote.add("--runtime-args");
    //设置用户 ID
    argsForZygote.add("--setuid=" + uid);
    //设置组 ID
    argsForZygote.add("--setgid=" + gid);
    argsForZygote.add("--runtime-flags=" + runtimeFlags);
    ...
    //数据信息映射
    if (pkgDataInfoMap != null && pkgDataInfoMap.size() > 0) {
        ...
        argsForZygote.add(sb.toString());
    }
    //白名单数据信息
    if (allowlistedDataInfoList != null && allowlistedDataInfoList.size() > 0) {
        ...
        argsForZygote.add(sb.toString());
    }
    //挂载标志
    if (bindMountAppStorageDirs) {
        argsForZygote.add(Zygote.BIND_MOUNT_APP_STORAGE_DIRS);
    }

    if (bindMountAppsData) {
        argsForZygote.add(Zygote.BIND_MOUNT_APP_DATA_DIRS);
    }

    ...
    //入口类
    argsForZygote.add(processClass);

    ...

    synchronized(mLock) {
               //发送参数并获取结果
        return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),
                                          zygotePolicyFlags,
                                          argsForZygote);
    }
}


1.  根据 ABI 选择对应的 Zygote（64位/32位）
2.  建立 Socket 连接
3.  返回 ZygoteState 对象
private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
    try {
        //尝试连接主 Zygote（64位)
        //主 Zygote Socket 地址（`/dev/socket/zygote`）
        //如果未连接或已断开，重新连接
        attemptConnectionToPrimaryZygote();
        //检查主 Zygote 是否匹配请求的 AB
        //主 Zygote（64位）支持：`arm64-v8a`, `x86_64`
        if (primaryZygoteState.matches(abi)) {
            //直接返回主 Zygote
            return primaryZygoteState;
        }

        if (mZygoteSecondarySocketAddress != null) {
            //尝试连接次 Zygote（32位)
            //次 Zygote Socket 地址（`/dev/socket/zygote_secondary`）
            //次 Zygote（32位）支持：`armeabi-v7a`, `x86`
            attemptConnectionToSecondaryZygote();

            if (secondaryZygoteState.matches(abi)) {
                return secondaryZygoteState;
            }
        }
    } catch (IOException ioe) {
        throw new ZygoteStartFailedEx("Error connecting to zygote", ioe);
    }

    throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);
}


Zygot进程
//frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
Runnable runSelectLoop(String abiList) {
        ...
        while (true) {
           
            ...

            if (pollReturnValue == 0) {
               ...

            } else {
                boolean usapPoolFDRead = false;

                while (--pollIndex >= 0) {
                    if ((pollFDs[pollIndex].revents & POLLIN) == 0) {
                        continue;
                    }
                    //接受新连接
                    if (pollIndex == 0) {
                        //接受连接并创建 `ZygoteConnection`
                        ZygoteConnection newPeer = acceptCommandPeer(abiList);
                        peers.add(newPeer);
                        socketFDs.add(newPeer.getFileDescriptor());
                    } else if (pollIndex < usapPoolEventFDIndex) {
                       
                        try {
                            ZygoteConnection connection = peers.get(pollIndex);
                            ...
                            //解析并执行启动命令
                            final Runnable command =
                                    connection.processCommand(this, multipleForksOK);

                             ...
                       }

                ...
            }
        }
    }
}


//处理连接请求
//frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java
Runnable processCommand(ZygoteServer zygoteServer, boolean multipleOK) {
    ZygoteArguments parsedArgs;
    //从 Socket 读取参数
    try (ZygoteCommandBuffer argBuffer = new ZygoteCommandBuffer(mSocket)) {
        while (true) {
            try {
                //解析参数为结构化对象
                parsedArgs = ZygoteArguments.getInstance(argBuffer);
               
            } catch (IOException ex) {
                throw new IllegalStateException("IOException on command socket", ex);
            }
            //连接关闭
            if (parsedArgs == null) {
                isEof = true;
                return null;
            }
            //fork 后的进程 ID
            int pid;
            FileDescriptor childPipeFd = null;
            FileDescriptor serverPipeFd = null;
            //通知 Zygote 系统已启动完成
            if (parsedArgs.mBootCompleted) {
                handleBootCompleted();
                return null;
            }
            //客户端请求查询 Zygote 支持的 ABI 列表
            if (parsedArgs.mAbiListQuery) {
                handleAbiListQuery();
                return null;
            }
            //处理 PID 查询
            if (parsedArgs.mPidQuery) {
                handlePidQuery();
                return null;
            }

            ...
            //处理预加载
            if (parsedArgs.mPreloadDefault) {
                handlePreload();
                return null;
            }
            //### 预加载包
            if (parsedArgs.mPreloadPackage != null) {
                handlePreloadPackage(parsedArgs.mPreloadPackage,
                        parsedArgs.mPreloadPackageLibs,
                        parsedArgs.mPreloadPackageLibFileName,
                        parsedArgs.mPreloadPackageCacheKey);
                return null;
            }
             //预加载应用
            if (canPreloadApp() && parsedArgs.mPreloadApp != null) {
                ...
                if (appInfo != null) {
                    handlePreloadApp(appInfo);
                } else {
                    throw new IllegalArgumentException("Failed to deserialize --preload-app");
                }
                return null;
            }
            //安全策略检查
            if (parsedArgs.mPermittedCapabilities != 0
                    || parsedArgs.mEffectiveCapabilities != 0) {
                ...
            }

            ...

            if (parsedArgs.mInvokeWith != null || parsedArgs.mStartChildZygote
                    || !multipleOK || peer.getUid() != Process.SYSTEM_UID) {
                //fork进程
                pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid,
                        parsedArgs.mGids, parsedArgs.mRuntimeFlags, rlimits,
                        parsedArgs.mMountExternal, parsedArgs.mSeInfo, parsedArgs.mNiceName,
                        fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,
                        parsedArgs.mInstructionSet, parsedArgs.mAppDataDir,
                        parsedArgs.mIsTopApp, parsedArgs.mPkgDataInfoList,
                        parsedArgs.mAllowlistedDataInfoList, parsedArgs.mBindMountAppDataDirs,
                        parsedArgs.mBindMountAppStorageDirs);

                try {
                    if (pid == 0) {
                        //子进程
                        zygoteServer.setForkChild();
                        //关闭 Zygote Socket
                        zygoteServer.closeServerSocket();
                        IoUtils.closeQuietly(serverPipeFd);
                        serverPipeFd = null;
                        //返回 `Runnable`
                        return handleChildProc(parsedArgs, childPipeFd,
                                parsedArgs.mStartChildZygote);
                    } else {
                       //父进程
                        IoUtils.closeQuietly(childPipeFd);
                        childPipeFd = null;
                        //清理资源
                        handleParentProc(pid, serverPipeFd);
                        return null;
                    }
                } finally {
                    IoUtils.closeQuietly(childPipeFd);
                    IoUtils.closeQuietly(serverPipeFd);
                }
            } else {
                   ...   
                    return result;
                }
            }
        }
    }
    ...
}



private Runnable handleChildProc(ZygoteArguments parsedArgs,
        FileDescriptor pipeFd, boolean isZygote) {
    
    //关闭 Java 层的 Socket，释放 `LocalSocket` 对象，确保不再与 Zygote 通信
    closeSocket();
   //**设置进程名称**
    Zygote.setAppProcessName(parsedArgs, TAG);

   //mInvokeWith 允许在应用进程启动前执行一个"包装器"程序，常用于调试工具
    if (parsedArgs.mInvokeWith != null) {
        //执行包装器命令，包装器最终会启动应用进程
        WrapperInit.execApplication(parsedArgs.mInvokeWith,
                parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
                VMRuntime.getCurrentInstructionSet(),
                pipeFd, parsedArgs.mRemainingArgs);

       
        throw new IllegalStateException("WrapperInit.execApplication unexpectedly returned");
    } else {
        //### 正常启动分支
        
        if (!isZygote) {
            //普通应用进程
            return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                    parsedArgs.mDisabledCompatChanges,
                    parsedArgs.mRemainingArgs, null /* classLoader */);
        } else {
            //子 Zygote 进程
            return ZygoteInit.childZygoteInit(
                    parsedArgs.mRemainingArgs  /* classLoader */);
        }
    }
}


//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
        String[] argv, ClassLoader classLoader) {
    RuntimeInit.redirectLogStreams();
    //RuntimeInit初始化
    RuntimeInit.commonInit();
    //打开Binder驱动，初始化 Binder 线程池
    ZygoteInit.nativeZygoteInit();
           //此处就会调用ActivityThread.main(),文章太长，不贴代码了。
    return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
            classLoader);
}

阶段四：应用初始化，建立通信

在ActivityThread.main()中：

1. 准备主线程Looper：启动主线程的消息循环（Looper.loop()），让应用可以开始处理系统消息。
2. 通知系统：应用进程会通过ApplicationThread这个Binder对象，向AMS发送一个“我已准备就绪”的通知（attachApplication方法）。这样，系统就知道了新进程的“联系方式”。

//frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
    //安装 Libcore 的 OS 实现
    //用于文件访问监控、权限检查等
    //是 Android 沙箱机制的一部分
    AndroidOs.install();

    //关闭 CloseGuard
    //`CloseGuard`：检测资源泄露（如未关闭的 Cursor、文件流）
    //为什么关闭？在 Release 版本中会产生大量日志，影响性能
    //何时开启？Debug 版本通过 StrictMode 选择性开启
    CloseGuard.setEnabled(false);
    //初始化用户环境,设置当前用户的应用数据目录
    Environment.initForCurrentUser();

    ...

    //Android 10+ 的模块化系统（Mainline）
    //初始化每个进程需要的模块（如 ART、Media、Network 等）
    //作用：加载模块特定的初始化代码
    initializeMainlineModules();
    //设置进程名称,后续会被替换为实际的应用包名
    Process.setArgV0("<pre-initialized>");
    //为当前线程（主线程）创建 Looper
    Looper.prepareMainLooper();

    ...
    //创建并初始化 ActivityThread
    ActivityThread thread = new ActivityThread();
    //向 AMS（ActivityManagerService）注册该进程
    //`false`：表示不是系统进程
    //`startSeq`：启动序列号
    thread.attach(false, startSeq);

  
    ..
    //进入消息循环
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}


-   `system`：是否为系统进程（`true` 表示 system_server 进程）
-   `startSeq`：启动序列号（由 AMS 分配）
private void attach(boolean system, long startSeq) {
    sCurrentActivityThread = this;
    //管理应用配置变化（如屏幕旋转、语言切换）
    mConfigurationController = new ConfigurationController(this);
    //保存是否为系统进程
    mSystemThread = system;
    if (!system) {
        //应用进程（常规 App），进入此分支
        
        //设置 DDMS 应用名称（临时）,后续会被真实包名替换
        android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                UserHandle.myUserId());
                                               
        //**向 RuntimeInit 注册应用线程 Binder 对象**
        RuntimeInit.setApplicationObject(mAppThread.asBinder());
        final IActivityManager mgr = ActivityManager.getService();
        try {
            //**向 AMS 注册应用进程**
            mgr.attachApplication(mAppThread, startSeq);
        } catch (RemoteException ex) {
            //如果 AMS 进程死亡，应用进程会崩溃
            throw ex.rethrowFromSystemServer();
        }
        // Watch for getting close to heap limit.
        ...
    } else {
        //设置 DDMS 应用名称system_process
        android.ddm.DdmHandleAppName.setAppName("system_process",
                UserHandle.myUserId());
        try {
            //创建 `Instrumentation`（系统进程也使用）
            mInstrumentation = new Instrumentation();
            //基础初始化（非完整初始化）
            mInstrumentation.basicInit(this);
            //为系统进程创建 Context
            ContextImpl context = ContextImpl.createAppContext(
                    this, getSystemContext().mPackageInfo);
            //创建Application 对象
            mInitialApplication = context.mPackageInfo.makeApplication(true, null);
            //调用`Application.onCreate()`
            mInitialApplication.onCreate();
        } catch (Exception e) {
            throw new RuntimeException(
                    "Unable to instantiate Application():" + e.toString(), e);
        }
    }
    ...
   
}


//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public final void attachApplication(IApplicationThread thread, long startSeq) {
    if (thread == null) {
        throw new SecurityException("Invalid application interface");
    }
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
        final long origId = Binder.clearCallingIdentity();
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}

private boolean attachApplicationLocked(@NonNull IApplicationThread thread,
        int pid, int callingUid, long startSeq) {

    //进程记录
    ProcessRecord app;
    //记录开始时间（性能追踪）
    long startTime = SystemClock.uptimeMillis();
    //记录绑定应用的时间
    long bindApplicationTimeMillis;
    if (pid != MY_PID && pid >= 0) {
        //不是系统进程且 PID 有效
        synchronized (mPidsSelfLocked) {
            //从 PID 映射表中查找 ProcessRecord
            app = mPidsSelfLocked.get(pid);
        }
        //检查 `startUid` 和 `startSeq` 是否匹配
        if (app != null && (app.getStartUid() != callingUid || app.getStartSeq() != startSeq)) {
            //如果不匹配，说明 PID 被复用或进程被篡改
            String processName = null;
            final ProcessRecord pending = mProcessList.mPendingStarts.get(startSeq);
            if (pending != null) {
                processName = pending.processName;
            }
            ...
            
            //清理旧的进程记录
            cleanUpApplicationRecordLocked(app, pid, false, false, -1,
                    true /*replacingPid*/, false /* fromBinderDied */);
            removePidLocked(pid, app);
            app = null;
        }
    } else {
        app = null;
    }

    //未找到进程记录
    if (app == null && startSeq > 0) {
        //检查 `mPendingStarts`（正在启动中的进程）
        final ProcessRecord pending = mProcessList.mPendingStarts.get(startSeq);
        //验证 UID 和 startSeq 匹配
        //handleProcessStartedLocked()将待启动进程转换为正式进程记录
        if (pending != null && pending.getStartUid() == callingUid
                && pending.getStartSeq() == startSeq
                && mProcessList.handleProcessStartedLocked(pending, pid,
                    pending.isUsingWrapper(), startSeq, true)) {
            app = pending;
        }
    }

    //进程记录仍然不存在
    if (app == null) {
        //进程记录无效 → 终止进程
        EventLogTags.writeAmDropProcess(pid);
        if (pid > 0 && pid != MY_PID) {
            //强制杀死该进程
            killProcessQuiet(pid);
          
        } else {
            try {
                thread.scheduleExit();
            } catch (Exception e) {
                // Ignore exceptions.
            }
        }
        return false;
    }

   
    //清理旧进程
    if (app.getThread() != null) {
        //处理旧进程死亡
        handleAppDiedLocked(app, pid, true, true, false /* fromBinderDied */);
    }



    final String processName = app.processName;
    try {
        //创建 `AppDeathRecipient`：当应用进程死亡时回调
        AppDeathRecipient adr = new AppDeathRecipient(
                app, pid, thread);
        //绑定死亡通知
        thread.asBinder().linkToDeath(adr, 0);
        app.setDeathRecipient(adr);
    } catch (RemoteException e) {
        //绑定失败（进程已死亡），重新启动进程
        app.resetPackageList(mProcessStats);
        mProcessList.startProcessLocked(app,
                new HostingRecord("link fail", processName),
                ZYGOTE_POLICY_FLAG_EMPTY);
        return false;
    }

    EventLogTags.writeAmProcBound(app.userId, pid, app.processName);

    synchronized (mProcLock) {
        //重置 OOM 调整值
        app.mState.setCurAdj(ProcessList.INVALID_ADJ);
        app.mState.setSetAdj(ProcessList.INVALID_ADJ);
        app.mState.setVerifiedAdj(ProcessList.INVALID_ADJ);
        //设置调度组
        mOomAdjuster.setAttachingSchedGroupLSP(app);
        app.mState.setForcingToImportant(null);
        //更新前台状态
        updateProcessForegroundLocked(app, false, 0, false);
        ...
    }
    //移除进程启动超时消息（进程已成功启动）
    mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);

    boolean normalMode = mProcessesReady || isAllowedWhileBooting(app.info);
    //生成该应用需要安装的 Provider 列表
    List<ProviderInfo> providers = normalMode
                                        ? mCpHelper.generateApplicationProvidersLocked(app)
                                        : null;

    if (providers != null && mCpHelper.checkAppInLaunchingProvidersLocked(app)) {
        Message msg = mHandler.obtainMessage(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG);
        msg.obj = app;
        mHandler.sendMessageDelayed(msg,
                ContentResolver.CONTENT_PROVIDER_PUBLISH_TIMEOUT_MILLIS);
    }

       ...

     
        if (app.getIsolatedEntryPoint() != null) {
            ...
        } else if (instr2 != null) {
            //调用 bindApplication 通知应用进程初始化
            thread.bindApplication(processName, appInfo, providerList,
                    instr2.mClass,
                    profilerInfo, instr2.mArguments,
                    instr2.mWatcher,
                    instr2.mUiAutomationConnection, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.isPersistent(),
                    new Configuration(app.getWindowProcessController().getConfiguration()),
                    app.getCompat(), getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, autofillOptions, contentCaptureOptions,
                    app.getDisabledCompatChanges(), serializedSystemFontMap);
        } else {
            //调用 bindApplication 通知应用进程初始化
            thread.bindApplication(processName, appInfo, providerList, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.isPersistent(),
                    new Configuration(app.getWindowProcessController().getConfiguration()),
                    app.getCompat(), getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, autofillOptions, contentCaptureOptions,
                    app.getDisabledCompatChanges(), serializedSystemFontMap);
        }
        if (profilerInfo != null) {
             //关闭 profiler 文件描述符
            profilerInfo.closeFd();
            profilerInfo = null;
        }

        
        synchronized (mProcLock) {
            //标记进程为活跃状态
            app.makeActive(thread, mProcessStats);
            checkTime(startTime, "attachApplicationLocked: immediately after bindApplication");
        }
        //更新 LRU 和 OOM
        updateLruProcessLocked(app, false, null);
        ...
        synchronized (mAppProfiler.mProfilerLock) {
            //记录最后一次 GC 和 LowMemory 请求时间
            app.mProfile.setLastRequestedGc(now);
            app.mProfile.setLastLowMemory(now);
        }
    } catch (Exception e) {
        //如果 bindApplication 失败，杀死进程
        app.resetPackageList(mProcessStats);
        app.unlinkDeathRecipient();
        app.killLocked("error during bind", ApplicationExitInfo.REASON_INITIALIZATION_FAILURE,
                true);
        handleAppDiedLocked(app, pid, false, true, false /* fromBinderDied */);
        return false;
    }

    //从持久化启动列表中移除
    mPersistentStartingProcesses.remove(app);
    //从等待列表中移除
    mProcessesOnHold.remove(app);

    boolean badApp = false;
    boolean didSomething = false;

    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
            //**调度 Activity**
            //通知 ActivityTaskManager 该进程已就绪
            //如果有待启动的 Activity，此时会调度
            didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
        }
    }

    // Find any services that should be running in this process...
    if (!badApp) {
        try {
            //### 调度 Service 启动
            //如果有待启动的 Service，此时调度
            didSomething |= mServices.attachApplicationLocked(app, processName);
            checkTime(startTime, "attachApplicationLocked: after mServices.attachApplicationLocked");
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
            badApp = true;
        }
    }

    // ### 调度 Broadcast 启动
    if (!badApp && isPendingBroadcastProcessLocked(pid)) {
        try {
            //如果有待发送的 Broadcast，此时发送
            didSomething |= sendPendingBroadcastsLocked(app);
            ...
        } catch (Exception e) {
          
            badApp = true;
        }
    }

    // ### 调度 Backup Agent
    if (!badApp && backupTarget != null && backupTarget.app == app) {
        if (DEBUG_BACKUP) Slog.v(TAG_BACKUP,
                "New app is backup target, launching agent for " + app);
        notifyPackageUse(backupTarget.appInfo.packageName,
                         PackageManager.NOTIFY_PACKAGE_USE_BACKUP);
        try {
            thread.scheduleCreateBackupAgent(backupTarget.appInfo,
                    compatibilityInfoForPackage(backupTarget.appInfo),
                    backupTarget.backupMode, backupTarget.userId, backupTarget.operationType);
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown creating backup agent in " + app, e);
            badApp = true;
        }
    }

    //**如果有任何错误，杀死进程**
    if (badApp) {
        app.killLocked("error during init", ApplicationExitInfo.REASON_INITIALIZATION_FAILURE,
                true);
        handleAppDiedLocked(app, pid, false, true, false /* fromBinderDied */);
        return false;
    }

    if (!didSomething) {
        //**更新 OOM 调整值**
        updateOomAdjLocked(app, OomAdjuster.OOM_ADJ_REASON_PROCESS_BEGIN);
        checkTime(startTime, "attachApplicationLocked: after updateOomAdjLocked");
    }
   //记录进程启动时间统计（用于性能分析）
    FrameworkStatsLog.write(
            FrameworkStatsLog.PROCESS_START_TIME,
            app.info.uid,
            pid,
            app.info.packageName,
            FrameworkStatsLog.PROCESS_START_TIME__TYPE__COLD,
            app.getStartTime(),
            (int) (bindApplicationTimeMillis - app.getStartTime()),
            (int) (SystemClock.elapsedRealtime() - app.getStartTime()),
            app.getHostingRecord().getType(),
            (app.getHostingRecord().getName() != null ? app.getHostingRecord().getName() : ""));
    return true;
}

阶段五：Activity生命周期回调

AMS接收到应用进程就绪的消息后，会通过之前建立的Binder通道，通知应用进程执行以下核心步骤：

1. 初始化Application：通过反射创建Application对象，并依次回调attachBaseContext()和onCreate()方法。
2. 启动Activity：紧接着，系统会通知应用进程创建目标Activity实例，并开始执行它的生命周期方法：onCreate() -> onStart() -> onResume()。至此，应用的界面才真正呈现给用户。

//frameworks/base/core/java/android/app/ActivityThread.java
public final void bindApplication(String processName, ApplicationInfo appInfo,
        ProviderInfoList providerList, ComponentName instrumentationName,
        ProfilerInfo profilerInfo, Bundle instrumentationArgs,
        IInstrumentationWatcher instrumentationWatcher,
        IUiAutomationConnection instrumentationUiConnection, int debugMode,
        boolean enableBinderTracking, boolean trackAllocation,
        boolean isRestrictedBackupMode, boolean persistent, Configuration config,
        CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
        String buildSerial, AutofillOptions autofillOptions,
        ContentCaptureOptions contentCaptureOptions, long[] disabledCompatChanges,
        SharedMemory serializedSystemFontMap) {
    ...
    //将系统设置（如 `ENABLE_AUTOFILL`、`ENABLE_CONTENT_CAPTURE` 等）
    //保存到 `ActivityThread`, 应用可以通过 `Settings.Global` 获取这些设置
    setCoreSettings(coreSettings);
    //创建并填充 AppBindData
    AppBindData data = new AppBindData();
    data.processName = processName;
    data.appInfo = appInfo;
    data.providers = providerList.getList();
    data.instrumentationName = instrumentationName;
    data.instrumentationArgs = instrumentationArgs;
    data.instrumentationWatcher = instrumentationWatcher;
    data.instrumentationUiAutomationConnection = instrumentationUiConnection;
    data.debugMode = debugMode;
    data.enableBinderTracking = enableBinderTracking;
    data.trackAllocation = trackAllocation;
    data.restrictedBackupMode = isRestrictedBackupMode;
    data.persistent = persistent;
    data.config = config;
    data.compatInfo = compatInfo;
    data.initProfilerInfo = profilerInfo;
    data.buildSerial = buildSerial;
    data.autofillOptions = autofillOptions;
    data.contentCaptureOptions = contentCaptureOptions;
    data.disabledCompatChanges = disabledCompatChanges;
    data.mSerializedSystemFontMap = serializedSystemFontMap;
    sendMessage(H.BIND_APPLICATION, data);
}


private void handleBindApplication(AppBindData data) {

    ...
    //更新配置信息（屏幕方向、语言等）
    mConfigurationController.setConfiguration(data.config);
    mConfigurationController.setCompatConfiguration(data.config);
    mConfiguration = mConfigurationController.getConfiguration();
    //Profiler 初始化
    mProfiler = new Profiler();
    String agent = null;
    if (data.initProfilerInfo != null) {
         //保存 profile 文件路径和文件描述符
        mProfiler.profileFile = data.initProfilerInfo.profileFile;
        mProfiler.profileFd = data.initProfilerInfo.profileFd;
        //保存采样间隔
        mProfiler.samplingInterval = data.initProfilerInfo.samplingInterval;
        mProfiler.autoStopProfiler = data.initProfilerInfo.autoStopProfiler;
        mProfiler.streamingOutput = data.initProfilerInfo.streamingOutput;
        if (data.initProfilerInfo.attachAgentDuringBind) {
            //如果需要在绑定时附加 agent，保存 agent 名称
            agent = data.initProfilerInfo.agent;
        }
    }

    //设置进程名称
    Process.setArgV0(data.processName);
    //设置 DDMS 调试器显示名称
    android.ddm.DdmHandleAppName.setAppName(data.processName,
                                            data.appInfo.packageName,
                                            UserHandle.myUserId());
                                            
    //告诉 ART 运行时当前包名
    VMRuntime.setProcessPackageName(data.appInfo.packageName);

    //设置应用数据目录
    VMRuntime.setProcessDataDirectory(data.appInfo.dataDir);

    if (mProfiler.profileFd != null) {
        mProfiler.startProfiling();
    }

    ...

   //使用系统默认时区（可能已变化）
    TimeZone.setDefault(null);

    //设置语言列表
    LocaleList.setDefault(data.config.getLocales());

    if (Typeface.ENABLE_LAZY_TYPEFACE_INITIALIZATION) {
        try {
           //设置系统字体映射（Android 12+ 支持懒加载）
            Typeface.setSystemFontMap(data.mSerializedSystemFontMap);
        } catch (IOException | ErrnoException e) {
            Slog.e(TAG, "Failed to parse serialized system font map");
            Typeface.loadPreinstalledSystemFontMap();
        }
    }

    synchronized (mResourcesManager) {
        //更新资源配置（DPI、语言等）
        mResourcesManager.applyConfigurationToResources(data.config, data.compatInfo);
        //保存默认显示 DPI
        mCurDefaultDisplayDpi = data.config.densityDpi;

       
        mConfigurationController.applyCompatConfiguration();
    }
    //创建LoadedAPK
    data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);

    if (agent != null) {
        handleAttachAgent(agent, data.info);
    }

    //密度兼容模式
    if ((data.appInfo.flags&ApplicationInfo.FLAG_SUPPORTS_SCREEN_DENSITIES)
            == 0) {
        mDensityCompatMode = true;
        Bitmap.setDefaultDensity(DisplayMetrics.DENSITY_DEFAULT);
    }
    mConfigurationController.updateDefaultDensity(data.config.densityDpi);

    //24小时制设置
    //从系统设置读取 12/24 小时制
    final String use24HourSetting = mCoreSettings.getString(Settings.System.TIME_12_24);
    Boolean is24Hr = null;
    if (use24HourSetting != null) {
        is24Hr = "24".equals(use24HourSetting) ? Boolean.TRUE : Boolean.FALSE;
    }
    // `null`：使用区域默认
    DateFormat.set24HourTimePref(is24Hr);

    updateDebugViewAttributeState();
    //**初始化 StrictMode**
    StrictMode.initThreadDefaults(data.appInfo);
    StrictMode.initVmDefaults(data.appInfo);
    //调试器等待
    if (data.debugMode != ApplicationThreadConstants.DEBUG_OFF) {
            ...
            Debug.waitForDebugger();

            try {
                mgr.showWaitingForDebugger(mAppThread, false);
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }

        } else {
           
        }
    }


    ...
    final InstrumentationInfo ii;
    if (data.instrumentationName != null) {
        //解析 Instrumentation 组件
        ii = prepareInstrumentation(data);
    } else {
        ii = null;
    }
    // 创建 Application Context
    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
    //更新语言列表（可能从资源中获取）
    mConfigurationController.updateLocaleListFromAppContext(appContext);
   
    ...

    //初始化 Instrumentation   
    if (ii != null) {
        initInstrumentation(ii, data, appContext);
    } else {
        mInstrumentation = new Instrumentation();
        mInstrumentation.basicInit(this);
    }

   //堆大小设置
    if ((data.appInfo.flags&ApplicationInfo.FLAG_LARGE_HEAP) != 0) {
        //清除堆增长限制（允许更大堆）
        dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();
    } else {
        //限制堆大小
        dalvik.system.VMRuntime.getRuntime().clampGrowthLimit();
    }

    Application app;
    ...
    try {
        //创建Application 对象,调用 `Application.attachBaseContext()`
        app = data.info.makeApplication(data.restrictedBackupMode, null);

        //设置自动填充
        app.setAutofillOptions(data.autofillOptions);

          //**设置内容捕获**
        app.setContentCaptureOptions(data.contentCaptureOptions);
        sendMessage(H.SET_CONTENT_CAPTURE_OPTIONS_CALLBACK, data.appInfo.packageName);

        mInitialApplication = app;
        ...
        if (!data.restrictedBackupMode) {
            if (!ArrayUtils.isEmpty(data.providers)) {
                //**安装 ContentProvider**
                //先安装 Provider，再调用 `Application.onCreate()`
                //确保 Provider 在应用启动时可用
                installContentProviders(app, data.providers);
            }
        }

     
        try {
            mInstrumentation.onCreate(data.instrumentationArgs);
        }
        catch (Exception e) {
            throw new RuntimeException(
                "Exception thrown in onCreate() of "
                + data.instrumentationName + ": " + e.toString(), e);
        }
        try {
            //调用 Application.onCreate()
            mInstrumentation.callApplicationOnCreate(app);
        } catch (Exception e) {
            if (!mInstrumentation.onException(app, e)) {
                throw new RuntimeException(
                  "Unable to create application " + app.getClass().getName()
                  + ": " + e.toString(), e);
            }
        }
    } finally {
        
        if (data.appInfo.targetSdkVersion < Build.VERSION_CODES.O_MR1
                || StrictMode.getThreadPolicy().equals(writesAllowedPolicy)) {
            StrictMode.setThreadPolicy(savedPolicy);
        }
    }

    // Preload fonts resources
    FontsContract.setApplicationContextForResources(appContext);
    if (!Process.isIsolated()) {
        try {
            //检查 `AndroidManifest.xml` 中的 `metadata` 配置
            final ApplicationInfo info =
                    getPackageManager().getApplicationInfo(
                            data.appInfo.packageName,
                            PackageManager.GET_META_DATA /*flags*/,
                            UserHandle.myUserId());
            if (info.metaData != null) {
                final int preloadedFontsResource = info.metaData.getInt(
                        ApplicationInfo.METADATA_PRELOADED_FONTS, 0);
                if (preloadedFontsResource != 0) {
                //字体预加载
                data.info.getResources().preloadFonts(preloadedFontsResource);
                }
            }
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }
}

//执行onCreate()
//frameworks/base/core/java/android/app/servertransaction/LaunchActivityItem.java
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    ActivityClientRecord r = client.getLaunchingActivity(token);
    //ActivityThread.handleLaunchActivity()
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
   
}


//执行onResume()
//frameworks/base/core/java/android/app/servertransaction/ResumeActivityItem.java
public void execute(ClientTransactionHandler client, ActivityClientRecord r,
        PendingTransactionActions pendingActions) {
    //ActivityThread.handleResumeActivity()
    client.handleResumeActivity(r, true /* finalStateRequest */, mIsForward,
            "RESUME_ACTIVITY");
    
}