Android 9.0 点击桌面应用图标，启动Activity的过程分析

下面分析从手指点击桌面的应用图标，是如何启动一个应用的Activity的过程：
首先需要明确一个问题，我们的桌面Launcher其实也是一个Activity，它是继承BaseDraggingActivity，而BaseDraggingActivity也是通过层层继承，最终还是继承了Activity。当点击桌面应用图标时，会执行Launcher这个类的startActivitySafely方法，下面看看这个方法的实现：

http://androidxref.com/9.0.0_r3/xref/packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
        boolean success = super.startActivitySafely(v, intent, item);
        // ...
        return success;
}

这个方法内部回调用super.startActivitySafely方法，由于Launcher也是一个Activity,它继承BaseDraggingActivity，所以，super.startActivitySafely方法其实就是调用的下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/packages/apps/Launcher3/src/com/android/launcher3/BaseDraggingActivity.java

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
	// ...
    try {
        boolean isShortcut = Utilities.ATLEAST_MARSHMALLOW
                && (item instanceof ShortcutInfo)
                && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT
                || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT)
                && !((ShortcutInfo) item).isPromise();
        if (isShortcut) {
            startShortcutIntentSafely(intent, optsBundle, item);
        } else if (user == null || user.equals(Process.myUserHandle())) {
            // 关键代码
            startActivity(intent, optsBundle);
        } else {
            LauncherAppsCompat.getInstance(this).startActivityForProfile(
                    intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
        }
        getUserEventDispatcher().logAppLaunch(v, intent);
        return true;
    } 
	//...
    return false;
}

这个方法内部，会调用startActivity方法，由于BaseDraggingActivity是继承Activity的，所以，最终会调用Activity的startActivity方法。在Activity类中，startActivity方法会最终调用startActivityForResult方法。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Activity.java

@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        startActivityForResult(intent, -1);
    }
}

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
        @Nullable Bundle options) {
    if (mParent == null) {
        options = transferSpringboardActivityOptions(options);
        Instrumentation.ActivityResult ar =
            mInstrumentation.execStartActivity(
                this, mMainThread.getApplicationThread(), mToken, this,
                intent, requestCode, options);
        if (ar != null) {
            mMainThread.sendActivityResult(
                mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                ar.getResultData());
        }
        if (requestCode >= 0) {
            mStartedActivity = true;
        }

        cancelInputsAndStartExitTransition(options);
    } else {
        if (options != null) {
            mParent.startActivityFromChild(this, intent, requestCode, options);
        } else {
            mParent.startActivityFromChild(this, intent, requestCode);
        }
    }
}

在startActivityForResult方法中，if (mParent == null)这个判断，mParent是一个ActivityGroup类型的对象，它的具体实现类是TabActivity,这个在api 13中，google已经弃用了，推荐使用Fragment。所以这里的mParent==null是成立的。接着都会调用Instrumentation的execStartActivity方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Instrumentation.java

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    Uri referrer = target != null ? target.onProvideReferrer() : null;
   // ...
    
    try {
	// ...
	//关键代码
        int result = ActivityManager.getService()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, options);
	//关键代码
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

这个方法内部，会调用ActivityManager.getServcie()方法获取的是SystemServer进程的ActivityManagerService(后面简称AMS)在Launcher进程的一个binder代理对象。ActivityManager.getService().startActivity()方法执行后，Luancher进程会挂起，直到SystemServer进程中的AMS执行完startActivity方法后返回一个result，具体AMS中是如何启动Activity的，下面会分析，返回这个result后，会调用checkStartActivityResult方法检查返回的结果。下面看看这个方法的实现：

public static void checkStartActivityResult(int res, Object intent) {
    if (!ActivityManager.isStartResultFatalError(res)) {
        return;
    }

    switch (res) {
        case ActivityManager.START_INTENT_NOT_RESOLVED:
        case ActivityManager.START_CLASS_NOT_FOUND:
            if (intent instanceof Intent && ((Intent)intent).getComponent() != null)
                throw new ActivityNotFoundException(
                        "Unable to find explicit activity class "
                        + ((Intent)intent).getComponent().toShortString()
                        + "; have you declared this activity in your AndroidManifest.xml?");
            throw new ActivityNotFoundException(
                    "No Activity found to handle " + intent);
        // ...

        default:
            throw new AndroidRuntimeException("Unknown error code "
                    + res + " when starting " + intent);
    }
}

这个方法内部，有一个很常见的异常，ActivityNotFoundException,异常的具体描述信息是：
have you declared this activity in your AndroidManifest.xml? ，这个就是当启动的Activity未在Manifest文件中声明时，就会报这个异常。下面继续看看AMS中，是如何启动Activity的(AMS是运行在SystemServer中的)，AMS中，调用startActivity方法，接着调用了startActivityAsUser以及其重载方法，这个方法内部，mActivityStartController.obtainStarter(intent, “startActivityAsUser”)方法获取的是一个ActivityStarter类型的对象，接着通过链式调用给ActivityStarter类型的对象设置各种参数，其中，要注意setMayWait(userId),这个在后续，会用到。这样Activity的启动就跳转到了ActivityStarter类中的execute方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

int execute() {
    try {
        if (mRequest.mayWait) {
            return startActivityMayWait(mRequest.caller, mRequest.callingUid,
                    mRequest.callingPackage, mRequest.intent, mRequest.resolvedType,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.startFlags,
                    mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig,
                    mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId,
                    mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        } else {
            return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,
                    mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,
                    mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,
                    mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,
                    mRequest.ignoreTargetSecurity, mRequest.componentSpecified,
                    mRequest.outActivity, mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        }
    } finally {
        onExecutionComplete();
    }
}

这个方法内部，会if(mRequest.mayWait),由于在给AMS的startActivityAsUser方法中，给ActivityStarter类型的对象设置过setMayWait

ActivityStarter setMayWait(int userId) {
    mRequest.mayWait = true;
    mRequest.userId = userId;

    return this;
}

所以这里的mRequest.mayWait = true，所以if(mRequest.mayWait)判断条件成立，执行startActivityMayWait方法：

private int startActivityMayWait(IApplicationThread caller, int callingUid,
        String callingPackage, Intent intent, String resolvedType,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        IBinder resultTo, String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, WaitResult outResult,
        Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,
        int userId, TaskRecord inTask, String reason,
        boolean allowPendingRemoteAnimationRegistryLookup) {
    
	// ...

    synchronized (mService) {
	// ...
	    //关键代码
        int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,
                voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,
                callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,
                ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,
                allowPendingRemoteAnimationRegistryLookup);

        // ...
        return res;
    }
}

接着调用startActivity的几个重载方法，在这几个startActviity重载方法中，经过权限和参数合法性检查，将Intent中的参数保存等操作后，

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
            ActivityRecord[] outActivity) {
	// ...
    try {
        // ...
        result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, outActivity);
    } 
	// ...

    return result;
}


private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
        ActivityRecord[] outActivity) {

	// ...

    ActivityRecord reusedActivity = getReusableIntentActivity();

   
	// reusedActivity是为null的，所以这个判断不成立
    if (reusedActivity != null) {
       
        //...
    }

    //...


    final ActivityStack topStack = mSupervisor.mFocusedStack;
    final ActivityRecord topFocused = topStack.getTopActivity();
    final ActivityRecord top = topStack.topRunningNonDelayedActivityLocked(mNotTop);
    final boolean dontStart = top != null && mStartActivity.resultTo == null
            && top.realActivity.equals(mStartActivity.realActivity)
            && top.userId == mStartActivity.userId
            && top.app != null && top.app.thread != null
            && ((mLaunchFlags & FLAG_ACTIVITY_SINGLE_TOP) != 0
            || isLaunchModeOneOf(LAUNCH_SINGLE_TOP, LAUNCH_SINGLE_TASK));
	// donStart的值为false，所以不走if()判断不成立
    if (dontStart) {
        
        //...
    }

    boolean newTask = false;
    //...

    
    int result = START_SUCCESS;
	//判断条件成立
    if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask
            && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {
	    // 是一个新的任务栈
        newTask = true;
	    //创建新的任务栈
        result = setTaskFromReuseOrCreateNewTask(taskToAffiliate, topStack);
    }
	// ...
  
	//这个方法内部，主要是将新建的任务栈置于任务栈集合的顶部。
    mTargetStack.startActivityLocked(mStartActivity, topFocused, newTask, mKeepCurTransition,
            mOptions);
	// mDoResume 传入的值就是true 
    if (mDoResume) {
        final ActivityRecord topTaskActivity =
                mStartActivity.getTask().topRunningActivityLocked();
        if (!mTargetStack.isFocusable()
                || (topTaskActivity != null && topTaskActivity.mTaskOverlay
                && mStartActivity != topTaskActivity)) {

            mTargetStack.ensureActivitiesVisibleLocked(null, 0, !PRESERVE_WINDOWS);
          
            mService.mWindowManager.executeAppTransition();
        } else {

            if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {
                mTargetStack.moveToFront("startActivityUnchecked");
            }

		//关键代码
            mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,
                    mOptions);
        }
    }
	// ...

    return START_SUCCESS;
}

这个方法内部，会判断需要启动的Activity是不是已经存在了，存在就重用这个Activity,由于是从桌面启动(之前未启动过)，所以，这里的判断就不成立，后面，为这个要启动的Activity创建一个新的任务栈，并将这个新建的任务栈置于任务栈集合的顶部。由于目标Activity，也就是要启动的Activity还未获取到焦点的任务栈，所以，执行mSupervisor.resumeFocusedStackTopActivityLocked方法，下面看看ActivityStackSupervisor类的resumeFocusedStackTopActivityLocked方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

boolean resumeFocusedStackTopActivityLocked(
        ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
	// 传入的三个参数都是 null
	// ...
	//由于targetStack是null,所以判断不成立
    if (targetStack != null && isFocusedStack(targetStack)) {
        return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
    }

    final ActivityRecord r = mFocusedStack.topRunningActivityLocked();
    if (r == null || !r.isState(RESUMED)) {
	    // 关键代码
        mFocusedStack.resumeTopActivityUncheckedLocked(null, null);
    } 
	// ...

    return false;
}

这个方法内部又跳转到ActivityStack类的resumeTopActivityUncheckedLocked方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStack.java

@GuardedBy("mService")
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
	// 传入的两个参数都是 null

    // ...
    try {
       // ...

       //关键代码
        result = resumeTopActivityInnerLocked(prev, options);

	  // ...
    } 
    // ...

    return result;
}


@GuardedBy("mService")
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
// 参入的两个参数都为null 
       // ...

	//返回当前Activity栈中，未finish的，在顶部的Activity，也就是要启动的Activity，显然next不为null
        final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);

	// hasRunningActivity = true
        final boolean hasRunningActivity = next != null;

	// ...
	//判断不成立
        if (!hasRunningActivity) {
            
            return resumeTopActivityInNextFocusableStack(prev, options, "noMoreActivities");
        }

        next.delayedResume = false;

        // ...

        mStackSupervisor.setLaunchSource(next.info.applicationInfo.uid);

       // ...

        // 如果当前有处于Resume状态的Activity时，则先将这个Activity暂停(执行onPause方法)
	// 比如在AcivityA中启动ActivityB(设置了ActivityB的process属性，ActivityB运行在一个新的进程中)，那么
	// 此时ActivityA就要执行onPause方法，在去为ActivityB创建一个app进程(如果ActivityB所属的进程不存在的话)，
	//如果ActivityB所在的进程存在，则直接启动ActivityB，下面的代码的逻辑，就是这样处理的
        if (mResumedActivity != null) {
            if (DEBUG_STATES) Slog.d(TAG_STATES,
                    "resumeTopActivityLocked: Pausing " + mResumedActivity);
                    //关键代码，startPausingLocked方法会执行上个Activity的OnPause方法
            pausing |= startPausingLocked(userLeaving, false, next, false);
        }

       // ...

        ActivityStack lastStack = mStackSupervisor.getLastStack();
	//如果要启动的Activity所属的进程存在
        if (next.app != null && next.app.thread != null) {
            //...

            synchronized(mWindowManager.getWindowManagerLock()) {
                // This activity is now becoming visible.
		// ...

                boolean notUpdated = true;

                if (mStackSupervisor.isFocusedStack(this)) {
                    
                    notUpdated = !mStackSupervisor.ensureVisibilityAndConfig(next, mDisplayId,
                            true /* markFrozenIfConfigChanged */, false /* deferResume */);
                }

                if (notUpdated) {
 
                    ActivityRecord nextNext = topRunningActivityLocked();
		    // ...
                    if (nextNext != next) {
                        // Do over!
			//关键代码
                        mStackSupervisor.scheduleResumeTopActivities();
                    }
                    // ...
                    return true;
                }

		// ...
            }
            
           // ...
        } else {
            // Whoops, need to restart this activity!
	    //要启动的Activity所在的进程未创建
            // ...
	    //关键代码
            mStackSupervisor.startSpecificActivityLocked(next, true, true);
        }

        // ...
        return true;
}

这个方法中，会判断，如果当前有处于Resume状态的Activity时，则先将这个Activity暂停(执行onPause方法，具体的分析过程，可以看Android 9.0 Activity的OnPuse方法执行过程分析),比如在AcivityA中启动ActivityB(设置了ActivityB的process属性，ActivityB运行在一个新的进程中)，那么此时ActivityA就要执行onPause方法，在去为ActivityB创建一个app进程(如果ActivityB所属的进程不存在的话)，如果ActivityB所在的进程存在，则直接启动ActivityB。我们我们的前提是，从桌面启动一个全新的Activity,所以要启动的Activity的进程是不存在的，所以，代码逻辑走mStackSupervisor.startSpecificActivityLocked(next, true, true);
下面接着看ActivityStackSupervisor类的startSpecificActivityLocked方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

    void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?
        ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);

        // ... 

        if (app != null && app.thread != null) {
            try {
                if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                        || !"android".equals(r.info.packageName)) {
                    // Don't add this if it is a platform component that is marked
                    // to run in multiple processes, because this is actually
                    // part of the framework so doesn't make sense to track as a
                    // separate apk in the process.
                    app.addPackage(r.info.packageName, r.info.applicationInfo.longVersionCode,
                            mService.mProcessStats);
                }
                realStartActivityLocked(r, app, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
        }

        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
}

这个方法中，ProcessRecord类型的对象记录了进程相关的信息，app.thread 其实就是IApplicationThread类型的对象，这两个对象在进程为创建时，都是为null的，所在执行mService.startProcessLocked方法，这里的mService就是AMS，下面看AMS类中的startProcessLocked方法实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@GuardedBy("this")
final ProcessRecord startProcessLocked(String processName,
        ApplicationInfo info, boolean knownToBeDead, int intentFlags,
        String hostingType, ComponentName hostingName, boolean allowWhileBooting,
        boolean isolated, boolean keepIfLarge) {
    return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType,
            hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
            null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
            null /* crashHandler */);
}

调用几个startProcessLocked的重载方法后，在下面这个重载方法中，调用了
private final boolean startProcessLocked(ProcessRecord app, String hostingType, 
        String hostingNameStr, boolean disableHiddenApiChecks, String abiOverride) {
    ...
    final String entryPoint = "android.app.ActivityThread";
    return startProcessLocked(hostingType, hostingNameStr, entryPoint, app, uid, gids, runtimeFlags, 
            mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startTime); // 调用#43
    ...
}

@GuardedBy("this")
private boolean startProcessLocked(String hostingType, String hostingNameStr, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    // ...
    if (mConstants.FLAG_PROCESS_START_ASYNC) {
        if (DEBUG_PROCESSES) Slog.i(TAG_PROCESSES,
                "Posting procStart msg for " + app.toShortString());
        mProcStartHandler.post(() -> {
            try {
               // ...
                final ProcessStartResult startResult = startProcess(app.hostingType, entryPoint,
                        app, app.startUid, gids, runtimeFlags, mountExternal, app.seInfo,
                        requiredAbi, instructionSet, invokeWith, app.startTime);
                synchronized (ActivityManagerService.this) {
                    handleProcessStartedLocked(app, startResult, startSeq);
                }
            } 
		// ...
        });
        return true;
    } else {
        try {
            final ProcessStartResult startResult = startProcess(hostingType, entryPoint, app,
                    uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet,
                    invokeWith, startTime);
            handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                    startSeq, false);
        } 
	    // ...
        return app.pid > 0;
    }
}

这个方法内部，给entryPoint不管是异步还是同步，都调用了startProcess方法，下面看看startProcess方法

private ProcessStartResult startProcess(String hostingType, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    try {
        // ... 
        final ProcessStartResult startResult;
        if (hostingType.equals("webview_service")) {
            startResult = startWebView(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        } else {
	    // 关键代码
            startResult = Process.start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, invokeWith,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        }
        checkTime(startTime, "startProcess: returned from zygote!");
        return startResult;
    }
	// ...
}

这个方法内部，会调用Process.start方法，下面看看Process类的start方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/os/Process.java

public static final ProcessStartResult start(final String processClass,
                                final String niceName,
                                int uid, int gid, int[] gids,
                                int runtimeFlags, int mountExternal,
                                int targetSdkVersion,
                                String seInfo,
                                String abi,
                                String instructionSet,
                                String appDataDir,
                                String invokeWith,
                                String[] zygoteArgs) {
      return zygoteProcess.start(processClass, niceName, uid, gid, gids,
                  runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                  abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

这个方法内部又调用了ZygoteProcess类的start方法。这个过程是SystemServer进程和ZygoteProcess进程进行通信的过程，它们之间通信是通过Socket进行通信的。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/os/ZygoteProcess.java


public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              int uid, int gid, int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion,
                                              String seInfo,
                                              String abi,
                                              String instructionSet,
                                              String appDataDir,
                                              String invokeWith,
                                              String[] zygoteArgs) {
    try {
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, false /* startChildZygote */,
                zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        Log.e(LOG_TAG,
                "Starting VM process through Zygote failed");
        throw new RuntimeException(
                "Starting VM process through Zygote failed", ex);
    }
}


private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  final String niceName,
                                                  final int uid, final int gid,
                                                  final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion,
                                                  String seInfo,
                                                  String abi,
                                                  String instructionSet,
                                                  String appDataDir,
                                                  String invokeWith,
                                                  boolean startChildZygote,
                                                  String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
    ArrayList<String> argsForZygote = new ArrayList<String>();

    // ...

    synchronized(mLock) {
    //关键代码
        return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
    }
}

zygoteSendArgsAndGetResult方法创建一个App进程。至此，app进程总算创建完成。接着会执行app进程的ActivityThread的main方法。这个main方法是app进程的入口。下面看看ActivityThread类的main方法。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
    // ...

    Process.setArgV0("<pre-initialized>");

    Looper.prepareMainLooper();

    // ...

    ActivityThread thread = new ActivityThread();
    thread.attach(false, startSeq);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

   // ...
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

这个方法内部， 主要是准备一个Looper对象，并准备一个消息列表，用于存在主线程的handler发送的消息。并创建一个ActivityThread对象。并调用attach方法，并且，如果sMainThreadHandler为null，给sMainThreadHandler赋值，并且调用Looper.loop方法循环
到从消息队列中抽取消息。下面来看看attach方法的具体实现：

private void attach(boolean system, long startSeq) {
    sCurrentActivityThread = this;
    mSystemThread = system;
    if (!system) {
        // ...
        final IActivityManager mgr = ActivityManager.getService();
        try {
            mgr.attachApplication(mAppThread, startSeq);
        } 
        // ...
    } else {
        // ...
    }

    // ...
}

这个方法中，获取了ActivityManagerServcie在app客户端的代理对象，调用代理对象的attachApplication方法，这时，app进程挂起，SystemServer进程的AMS类的attachApplication方法执行。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    synchronized (this) {
        // ...
	    //关键代码
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}


@GuardedBy("this")
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
	// ...

    try {
	 // ...
        if (app.isolatedEntryPoint != null) {

            thread.runIsolatedEntryPoint(app.isolatedEntryPoint, app.isolatedEntryPointArgs);
        } else if (app.instr != null) {
            thread.bindApplication(processName, appInfo, providers,
                    app.instr.mClass,
                    profilerInfo, app.instr.mArguments,
                    app.instr.mWatcher,
                    app.instr.mUiAutomationConnection, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        } else {
            thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        }
        // ...
    }
// ...
// See if the top visible activity is waiting to run in this process...
if (normalMode) {
    try {
	//关键代码
        if (mStackSupervisor.attachApplicationLocked(app)) {
            didSomething = true;
        }
    } catch (Exception e) {
        Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
        badApp = true;
    }
}
    // ...

    return true;
}

这个方法内部又调用了thread.bindApplication方法。这个thread其实是IApplicationThread类型的。它是在attachApplication方法被调用是，从app进程传过来的参数，同IApplicationThread也是继承Binder的，所以这里thread.bindApplication()也是个进程间通信，这时，SystemServer进程是作为客户端，app进程作为服务端。由于ApplicationThread是ActivityThread类的内部类，所以，看看ApplicationThread的bindApplication方法时，
下面贴出的是ActivityThread类的路径

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

public final void bindApplication(String processName, ApplicationInfo appInfo,
        List<ProviderInfo> providers, ComponentName instrumentationName,
        ProfilerInfo profilerInfo, Bundle instrumentationArgs,
        IInstrumentationWatcher instrumentationWatcher,
        IUiAutomationConnection instrumentationUiConnection, int debugMode,
        boolean enableBinderTracking, boolean trackAllocation,
        boolean isRestrictedBackupMode, boolean persistent, Configuration config,
        CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
        String buildSerial, boolean autofillCompatibilityEnabled) {

    if (services != null) {
      // ....

        // Setup the service cache in the ServiceManager
        ServiceManager.initServiceCache(services);
    }

    setCoreSettings(coreSettings);

    AppBindData data = new AppBindData();
    // ...
    sendMessage(H.BIND_APPLICATION, data);
}

sendMessage方法执行后，在ActivityThread的H类的handleMessage方法中，会执行BIND_APPLICATION这个case,

 public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                case BIND_APPLICATION:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                    AppBindData data = (AppBindData)msg.obj;
		    //关键代码
                    handleBindApplication(data);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
		// ...

}


private void handleBindApplication(AppBindData data) {
       // ...

        if (ii != null) {
            // ...
            final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);

            try {
                final ClassLoader cl = instrContext.getClassLoader();
                mInstrumentation = (Instrumentation)
                    cl.loadClass(data.instrumentationName.getClassName()).newInstance();
            } 
	    // ...

            final ComponentName component = new ComponentName(ii.packageName, ii.name);
            mInstrumentation.init(this, instrContext, appContext, component,
                    data.instrumentationWatcher, data.instrumentationUiAutomationConnection);

            //...
        } else {
            mInstrumentation = new Instrumentation();
            mInstrumentation.basicInit(this);
        }

       // ...
        try {            

           //...
	 //关键代码
	app = data.info.makeApplication(data.restrictedBackupMode, null);
	//...
            try {
                mInstrumentation.callApplicationOnCreate(app);
            } catch (Exception e) {
                if (!mInstrumentation.onException(app, e)) {
                    throw new RuntimeException(
                      "Unable to create application " + app.getClass().getName()
                      + ": " + e.toString(), e);
                }
            }
        } 
	// ...  
}

这个方法内部，创建了LoadedApk对象，创建了Instrumentation对象，并调用了LoadedApk类中的makeApplication方法创建Application对象，并调用Instrumentation类的callApplicationOnCreate方法，是Application的onCreate方法执行。下面看看LoadedApk类中的makeApplication方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/LoadedApk.java

public Application makeApplication(boolean forceDefaultAppClass,
        Instrumentation instrumentation) {
    if (mApplication != null) {
        return mApplication;
    }

   //...

    Application app = null;

    // ...

    try {
        java.lang.ClassLoader cl = getClassLoader();
        // ...
        ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
        app = mActivityThread.mInstrumentation.newApplication(
                cl, appClass, appContext);
        appContext.setOuterContext(app);
    } 
	// ...
    mActivityThread.mAllApplications.add(app);
    mApplication = app;

    if (instrumentation != null) {
        try {
            instrumentation.callApplicationOnCreate(app);
        } 
	    // ...
    }

    // ...

    return app;
}

这个方法内部，会直接通过类加载器，创建application的字节码文件，并通过反射创建Application对象。并将application对象和ContextImpl对象进行关联。虽然instrument对象已经创建，但是这个方法传入的instrumentation确是null,所以Instrumentation的callApplicationOnCreate方法就不会执行。接着回到ActivityThread类的handleBindApplication方法内部。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

private void handleBindApplication(AppBindData data) {
       // ...

        if (ii != null) {
            // ...
            final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);

            try {
                final ClassLoader cl = instrContext.getClassLoader();
                mInstrumentation = (Instrumentation)
                    cl.loadClass(data.instrumentationName.getClassName()).newInstance();
            } 
	    // ...

            final ComponentName component = new ComponentName(ii.packageName, ii.name);
            mInstrumentation.init(this, instrContext, appContext, component,
                    data.instrumentationWatcher, data.instrumentationUiAutomationConnection);

            //...
        } else {
            mInstrumentation = new Instrumentation();
            mInstrumentation.basicInit(this);
        }

       // ...
        try {            

           //...
	 //关键代码
	app = data.info.makeApplication(data.restrictedBackupMode, null);
	//...
            try {
                mInstrumentation.callApplicationOnCreate(app);
            } catch (Exception e) {
                if (!mInstrumentation.onException(app, e)) {
                    throw new RuntimeException(
                      "Unable to create application " + app.getClass().getName()
                      + ": " + e.toString(), e);
                }
            }
        } 
	// ...  
}

下面继续执行Instrumentation类的callApplicationOnCreate方法，这个方法内部，最终会调用Application的onCreate方法，至此，Application就创建了，并且它的onCreate方法也执行了。
下面继续回到SystemServer进程的AMS的attachApplicationLocked方法中：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@GuardedBy("this")
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
	// ...

    try {
	 // ...
        if (app.isolatedEntryPoint != null) {

            thread.runIsolatedEntryPoint(app.isolatedEntryPoint, app.isolatedEntryPointArgs);
        } else if (app.instr != null) {
            thread.bindApplication(processName, appInfo, providers,
                    app.instr.mClass,
                    profilerInfo, app.instr.mArguments,
                    app.instr.mWatcher,
                    app.instr.mUiAutomationConnection, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        } else {
            thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        }
        // ...
    }

    // ...
    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
	//关键代码
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
        }
    }
    // ...

    return true;
}

执行完thread.bindApplication方法后，这个方法内部，会继续执行ActivityStackSupervisor的attachApplicationLocked方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

boolean attachApplicationLocked(ProcessRecord app) throws RemoteException {
	// ...
    for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
        final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
        for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {

            for (int i = 0; i < size; i++) {
                final ActivityRecord activity = mTmpActivityList.get(i);
                if (activity.app == null && app.uid == activity.info.applicationInfo.uid
                        && processName.equals(activity.processName)) {
                    try {
			//关键代码
                        if (realStartActivityLocked(activity, app,
                                top == activity /* andResume */, true /* checkConfig */)) {
                            didSomething = true;
                        }
                    } 
			// ...
                }
            }
        }
    }
   // ...
    return didSomething;
}

这个方法内部会调用realStartActivityLocked方法

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
	// ...
    try {
	   // ...
        try {
		// ...
            // Create activity launch transaction.
            final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,
                    r.appToken);
            clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                    System.identityHashCode(r), r.info,

                    mergedConfiguration.getGlobalConfiguration(),
                    mergedConfiguration.getOverrideConfiguration(), r.compat,
                    r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
                    r.persistentState, results, newIntents, mService.isNextTransitionForward(),
                    profilerInfo));

            // Set desired final state.
            final ActivityLifecycleItem lifecycleItem;
            if (andResume) {
                lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());
            } else {
                lifecycleItem = PauseActivityItem.obtain();
            }
            clientTransaction.setLifecycleStateRequest(lifecycleItem);

            // Schedule transaction.
            mService.getLifecycleManager().scheduleTransaction(clientTransaction);

		// ...
        } 
	    // ...
    return true;
}

这个方法内部会先创建一个ClientTransaction类型的对象clientTransaction，在给clientTransaction添加callback,注意，这里的添加的callback是LaunchActivityItem类型的，由于传入的doResume是true，所有lifecycleItem的赋值类型是ResumeActivityItem类型的对象，接着调用clientTransaction对象的setLifecycleStateRequest方法，将这个对象设置进去，后clientTransaction.getLifecycleStateRequest()方法返回的就是这个ResumeActivityItem类型的对象。接着执行mService.getLifecycleManager().scheduleTransaction(clientTransaction)，由于mService.getLifecycleManager()获取的是ClientLifecycleManager对象，所以，调用代码跳转到了ClientLifecycleManager类中的scheduleTransaction方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ClientLifecycleManager.java

void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        final IApplicationThread client = transaction.getClient();
        // 关键代码
        transaction.schedule();
        if (!(client instanceof Binder)) {
            // If client is not an instance of Binder - it's a remote call and at this point it is
            // safe to recycle the object. All objects used for local calls will be recycled after
            // the transaction is executed on client in ActivityThread.
            transaction.recycle();
        }
 }

这个方法内部又调用了ClientTransaction类的schedule方法，下面看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/ClientTransaction.java

public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this);
}

这里的mClient是一个IApplicationThread类型的对象，ApplicationThread实现了IApplicationThread接口，所以mClient.scheduleTransaction(this)实际上是执行了ApplicationThread的scheduleTransaction方法。这又是进程间通信，现在SystemServer作为客户端，app进程作为服务端。这样又跳转到了ApplicationThread类中的scheduleTransaction方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

 @Override
 public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
     ActivityThread.this.scheduleTransaction(transaction);
 }

这个方法内部，又调用了ActivityThread的scheduleTransaction方法，由于ActivityThread没有这个方法，这个方法是其父类ClientTransactionHandler的方法，下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ClientTransactionHandler.java

void scheduleTransaction(ClientTransaction transaction) {
     transaction.preExecute(this);
     sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

这个方法内部，又调用了ActivityThread的sendMessage方法， 接着会执行到Activity类内部的H类的handleMessage方法的中的

// ...
case EXECUTE_TRANSACTION:
     final ClientTransaction transaction = (ClientTransaction) msg.obj;
     mTransactionExecutor.execute(transaction);
     //...
     break;
// ....

接着执行到TransactionExecutor类的execute方法

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

/** Cycle through all states requested by callbacks and execute them at proper times. */
@VisibleForTesting
public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
     // ...

    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        // ...
         item.execute(mTransactionHandler, token, mPendingActions);
         item.postExecute(mTransactionHandler, token, mPendingActions);
         if (r == null) {
             // Launch activity request will create an activity record.
             r = mTransactionHandler.getActivityClient(token);
         }

         if (postExecutionState != UNDEFINED && r != null) {
             // Skip the very last transition and perform it by explicit state request instead.
             final boolean shouldExcludeLastTransition =
                     i == lastCallbackRequestingState && finalState == postExecutionState;
             cycleToPath(r, postExecutionState, shouldExcludeLastTransition);
         }
     }
 }

在executeCallbacks内部，会通过transaction对象获取callbacks，由于之前，给Transaction添加过一个LaunchActivityItem，所以这里callback.size = 1,执行for循环，item.execute时，其实就是执行的LaunchActivityItem的execute方法。下面接着看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/LaunchActivityItem.java

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
            mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
            mPendingResults, mPendingNewIntents, mIsForward,
            mProfilerInfo, client);
     //关键代码
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

这个方法内部，调用了ClientTransactionHandler的handleLaunchActivity方法，由于ClientTransactionHandler是个抽象类，所以具体执行其子类的ActivityTrhead类的handleLauncheActivity方法，下面继续看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

@Override
public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
   // ...
//关键代码
    final Activity a = performLaunchActivity(r, customIntent);
   // ...
    return a;
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
   // ...
   // 关键代码
    ContextImpl appContext = createBaseContextForActivity(r);
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
        // ...
    }
	// ...

    try {
		//关键代码
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);

       // ...

        if (activity != null) {
            // ...
            appContext.setOuterContext(activity);
		//关键代码
            activity.attach(appContext, this, getInstrumentation(), r.token,
                    r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor, window, r.configCallback);
            // ...
            int theme = r.activityInfo.getThemeResource();
            if (theme != 0) {
		// 关键代码
                activity.setTheme(theme);
            }

            activity.mCalled = false;
            if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }
            // ...
            r.activity = activity;
        }
        r.setState(ON_CREATE);

        mActivities.put(r.token, r);

    } 
	// ...

    return activity;
}

这个方法内部主要做了如下事情：
1.通过createBaseContextForActivity方法创建一个ContextImpl类型的对象
2.通过类加载的方式，创建Activity的字节码对象，然后通过反射创建Activity的实例。
3.调用LoadedApk类的makeApplication方法，由于在前面的步骤中Application对象已经创建了，所以这个方法直接返回之前创建的Application对象。
4.将前面创建的appContext对象和activity关联。
5.调用Activity类的attach方法，这个方法的主要作用是创建PhoneWindow对象，并设置WindowManager.
6.给Activity设置主题。
7.r.isPersistable()是一个boolean型的变量，它的值相对于Manifest中Application标签的android:persistent属性，这个属性设置为true,表示应用对应的Application具有持久性，它会自系统启动后"持久的"运行，直到关机为止，并且在运行出现异常是自动的重新启动。
这里假设启动的Activity不是持久应用。所以执行Intrumentation的callActivityOnCreate方法，这个方法最终会调用Activity的onCreate方法。
下面看看Activity的attach方法具体做了什么？

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Activity.java

final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor,
        Window window, ActivityConfigCallback activityConfigCallback) {
    // ...

    mWindow = new PhoneWindow(this, window, activityConfigCallback);
    mWindow.setWindowControllerCallback(this);
    mWindow.setCallback(this);
    mWindow.setOnWindowDismissedCallback(this);
    // ...

    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
   // ...
}

这个方法内部，主要是创建了一个PhoneWindow对象，并给PhoneWindow对象设置callBack，并给PhoneWindow设置windowManager对象。并将PhoneWindow对象和windowManager对象赋值给Activity类的两个mWindow和mWindowManager对象，平时开发过程中，在Activity类通过getWindow()方法和getWindowManager()方法获取到值就是在这里赋值的。

分析到这里，Application创建了，Application的onCreate方法也执行了，Activity实例也创建了，onCreate方法执行了，关于Activityy的onCreate方法具体做什么事情，可以看这篇文章，但是，我们平时启动一个Activity时，还执行了onStart方法和onResume方法，这两个方法什么时候执行呢？我们接着回到TransactionExecutor类的execute方法：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();
    log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

上面已经分析完了executeCallbacks方法，接着分析executeLifecycleState方法，

 /** Transition to the final state if requested by the transaction. */
 private void executeLifecycleState(ClientTransaction transaction) {
     final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
     if (lifecycleItem == null) {
         // No lifecycle request, return early.
         return;
     }
     log("Resolving lifecycle state: " + lifecycleItem);

     final IBinder token = transaction.getActivityToken();
     final ActivityClientRecord r = mTransactionHandler.getActivityClient(token);

     if (r == null) {
         // Ignore requests for non-existent client records for now.
         return;
     }

     // Cycle to the state right before the final requested state.
     cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */);

     // Execute the final transition with proper parameters.
     lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
     lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
 }

这个方法主要做了如下两件事：
1.调用cycleToPath方法，这个方法的作用是调用mTransactionHandler.handleStartActivity(r, mPendingActions);其实就是调用了ActivityThread的handleStartActivity方法，最终调用Activity的onStart方法，这样Activity的onStart方法就执行了。
2.接着执行lifecycleItem.execute方法，这个lifecycleItem是通过transaction.getLifecycleStateRequest()获取的，我们在前面分析ActivityStackSupervisor类的realStartActivityLocked方法时，提到了transaction.setLifecycleStateRequest方法传入的就是一个ResumeActivityItem类型的对象，所以这里lifecycleitem.execute其实就是执行的ResumeActivityItem类的execute方法。下面看看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/ResumeActivityItem.java

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
    client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
            "RESUME_ACTIVITY");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

这个方法内部调用了ClientTransactionHandler类的handleResumeActivity方法，其实就是执行了ActivityThread类的hadnleResumeActivity方法，下面看这个方法的具体实现：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

@Override
public void handleResumeActivity(IBinder token, boolean finalStateRequest, boolean isForward,
        String reason) {
    // ...
    final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);

    // ...

    if (!r.activity.mFinished && willBeVisible && r.activity.mDecor != null && !r.hideForNow) {
        //...
        if (r.activity.mVisibleFromClient) {
            r.activity.makeVisible();
        }
    }

    r.nextIdle = mNewActivities;
    mNewActivities = r;
    if (localLOGV) Slog.v(TAG, "Scheduling idle handler for " + r);
    Looper.myQueue().addIdleHandler(new Idler());
}

@VisibleForTesting
public ActivityClientRecord performResumeActivity(IBinder token, boolean finalStateRequest,
        String reason) {
    final ActivityClientRecord r = mActivities.get(token);
// ...
    try {
       // ...
       //关键代码
        r.activity.performResume(r.startsNotResumed, reason);

        // ...
    } 
    // ...
    return r;
}

handleResumeActivity这个方法主要做了两个事情：
1.执行performResumeActivity方法，最后执行Activity的performResume方法，在接着通过Instrumentation的callActivityOnResume方法，在
接着执行Activity的onResume方法，至此，Activity的onResume方法执行
2.调用Activity的makeVisible()方法，是mDecorview变成可见。

以上便是冷启动一个Activity流程分析。

转载自hujin2017的博客，已征得博主同意。原文链接：https://blog.csdn.net/hujin2017/article/details/101389261
————————————————
版权声明：本文为CSDN博主「hujin2017」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/hujin2017/article/details/101389261