Activity启动流程分析(android-29)(1)

======

1. binder机制简介

binder是进程间通信的一种方式。在操作系统中，分为内核空间和用户空间，每个app都运行在自己的用户空间，binder机制底层正是两个app进程通过共享内核内存区域实现的；具体实现不做深入分析；
在binder机制中，进行进程通信的两方，可分别称他们为Cient进程和Server进程；Cient进程和Server进程是由具体场景而定的，一个进程即可以是Cient进程，也可以是Server进程。

2. ServiceManager

ServiceManager负责把Binder Server注册到一个容器中，这样当有Client进程想与Server进程通信时，ServiceManager就可以从查找表中找到Binder Server，并返回Binder Server的代理对象给Client进程。

3. ActivityManagerService

ActivityManagerService是一个系统服务进程，四大组件的启动方式都是通过binder的方式与ActivityManagerService通信完成的；
ActivityManagerService将自己注册到ServiceManager的代码如下(本文分析基于android-29源码)：

public class ActivityManagerService extends IActivityManager.Stub {
public void setSystemProcess() {
ServiceManager.addService(Context.ACTIVITY_SERVICE, this, /* allowIsolated= */ true,DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PROTO);
}
}

注册完成之后，其他进程就可通过如下方式获得ActivityManagerService的代理：

public class ActivityManager {
public static IActivityManager getService() {
return IActivityManagerSingleton.get();
}
private static final Singleton IActivityManagerSingleton =
new Singleton() {
@Override
protected IActivityManager create() {
final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
final IActivityManager am = IActivityManager.Stub.asInterface(b);
return am;
}
};
}

以上代码，可以看出ActivityManager封装了对ActivityManagerService的调用，通过ActivityManager.gerService()即可获得对ActivityManagerService的调用。

4. ActivityThread、ApplicationThread傻傻分不清楚

ActivityThread就是UI线程，是在APP启动时创建的；它包含一个static的main()方法如下所示(后面会详细分析)：

public final class ActivityThread{
// 后面会重点分析
Instrumentation mInstrumentation;

public static void main(String[] args) {
// 省略部分代码…
Looper.prepareMainLooper();
// …
ActivityThread thread = new ActivityThread();
thread.attach(false, startSeq);
// …
Looper.loop();
}

private void attach(boolean system, long startSeq) {
mInstrumentation = new Instrumentation();
// …
mInstrumentation.basicInit(this);
ContextImpl context = ContextImpl.createAppContext(this, getSystemContext().mPackageInfo);
mInitialApplication = context.mPackageInfo.makeApplication(true, null);
}
}

ApplicationThread是ActivityThread的内部类，并不是一个线程，可用来代表当前APP进程(可能这就是它叫Thread的原因吧)，由以下代码可分析出app间进程通信时，获得另一个app进程也是通过binder来获取其代理实现的；

private class ApplicationThread extends IApplicationThread.Stub {
// 省略部分代码…
}

5. Instrumentation

instrumentation
英 [ˌɪnstrəmenˈteɪʃn] 美 [ˌɪnstrəmenˈteɪʃn]
n.(一套)仪器，仪表;器乐谱写

Instrumentation源码解释如下：

/**

• Base class for implementing application instrumentation code. When running
• with instrumentation turned on, this class will be instantiated for you
• before any of the application code, allowing you to monitor all of the
• interaction the system has with the application. An Instrumentation
• implementation is described to the system through an AndroidManifest.xml’s
• <instrumentation> tag.
  */

可以大概理解为所有与application有关的调用都会通过Instrumentation这样一个仪器来方便地观察到；换句话说就是，所有有关application的调用实际上都会通过Instrumentation；看一下其源码就可以看到它里面完成了许多功能：

public class Instrumentation {
private ActivityThread mThread = null;
private MessageQueue mMessageQueue = null;
private List mActivityMonitors;

public Application newApplication(ClassLoader cl, String className, Context context) {}

public Activity newActivity(ClassLoader cl, String className,
Intent intent) {}

public void callActivityOnNewIntent(Activity activity, Intent intent) {}

public ActivityResult execStartActivity(){}

}

二、Activity启动流程分析

例如App1要启动App2的一个Activity；Activity启动流程分析如下：

1. App1中的SampleActivity1启动App2的SampleActivity2

public class SampleActivity1 {
public void onClick() {
Intent intent = getPackageManager().getLaunchIntentForPackage(“com.app2.sample”);
startActivity(intent);
}
}

2. Activity源码分析

public class Activity {
public void startActivity(Intent intent) {
this.startActivity(intent, null);
}

public void startActivity(Intent intent, @Nullable Bundle options) {
// …
startActivityForResult(intent, -1);
}

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode, @Nullable Bundle options) {
// 省略部分代码…
options = transferSpringboardActivityOptions(options);
Instrumentation.ActivityResult ar = mInstrumentation.execStartActivity(this, mMainThread.getApplicationThread(), mToken, this,intent, requestCode, options);
if (ar != null) {
mMainThread.sendActivityResult(mToken, mEmbeddedID, requestCode, ar.getResultCode(), ar.getResultData());
}
}
}

可以看到，Activity的startActivity最终都调用到了Instrumentation里面；

3. Instrumentation源码分析

继续分析Instrumentation的execStartActivity()方法:

public class Instrumentation {
/**

• 可以看到传递的参数中比较重要的几个：
• 1. context who:就是前面的SampleActivity1
• 2. IBinder contextThread:传的value是mMainThread.getApplicationThread(),即当前APP进程,这样AMS进程才可以通过IBinder与App1进程通信(比如将结果返回,就需要binder通信)
• 3. IBinder token:又见IBinder,那一定也是别的进程需要通过这个IBinder进行通信
• 4. Intent intent:启动参数
     **/
     public ActivityResult execStartActivity(
     Context who, IBinder contextThread, IBinder token, Activity target,
     Intent intent, int requestCode, Bundle options) {
     IApplicationThread whoThread = (IApplicationThread) contextThread;
     // 省略部分代码…
     try {
     int result = ActivityTaskManager.getService()
     .startActivity(whoThread, who.getBasePackageName(), intent,
     intent.resolveTypeIfNeeded(who.getContentResolver()),
     token, target != null ? target.mEmbeddedID : null,
     requestCode, 0, null, options);
     checkStartActivityResult(result, intent);
     } catch (RemoteException e) {
     throw new RuntimeException(“Failure from system”, e);
     }
     return null;
     }
     }

可以看到，又继续调用到了ActivityTaskManager.getService().startActivity()里面。
ps. 在android-28源码中是调用到了ActivityManager.getService().startActivity()里面，更老版本android源码中是调用了ActivityManagerNative.getDefault()，原理都类似，都是调用返回一个代理，最终到了系统进程去执行后续调起逻辑。

4. ActivityTaskManager源码分析

@SystemService(Context.ACTIVITY_TASK_SERVICE)
public class ActivityTaskManager {
public static IActivityTaskManager getService() {
return IActivityTaskManagerSingleton.get();
}

private static final Singleton IActivityTaskManagerSingleton =
new Singleton() {
@Override
protected IActivityTaskManager create() {
final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE);
return IActivityTaskManager.Stub.asInterface(b);
}
};
}

可以看出，ActivityTaskManager.getService()调用得到IBinder的proxy继续执行后续代码，这样就就调用到了系统进程里面继续执行；ActivityTaskManager是系统启动期间就注册的一个binder service，其注册代码如下：

@SystemApi
public final class SystemServiceRegistry {
static {
registerService(Context.ACTIVITY_TASK_SERVICE, ActivityTaskManager.class,
new CachedServiceFetcher() {
@Override
public ActivityTaskManager createService(ContextImpl ctx) {
return new ActivityTaskManager(
ctx.getOuterContext(), ctx.mMainThread.getHandler());
}});
}

接下来继续分析系统进程中startActivity()的执行步骤；

5. ActivityTaskManagerService源码分析

public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
public final int startActivity(IApplicationThread caller, String callingPackage,
Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
resultWho, requestCode, startFlags, profilerInfo, bOptions,
UserHandle.getCallingUserId());
}

int startActivityAsUser(IApplicationThread caller, String callingPackage,
Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,
boolean validateIncomingUser) {
// 省略部分代码…
// getActivityStartController().obtainStarter返回一个ActivityStarter对象，下面继续分析ActivityStarter
return getActivityStartController().obtainStarter(intent, “startActivityAsUser”)
.setCaller(caller)
.setCallingPackage(callingPackage)
.setResolvedType(resolvedType)
.setResultTo(resultTo)
.setResultWho(resultWho)
.setRequestCode(requestCode)
.setStartFlags(startFlags)
.setProfilerInfo(profilerInfo)
.setActivityOptions(bOptions)
.setMayWait(userId)
.execute();

}
}

6. ActivityStarter源码分析

ActivityStarter负责处理intent中flag、启动模式等参数；

class ActivityStarter {
int execute() {
try {
// …
return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,
mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,
mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,
mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,
mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,
mRequest.ignoreTargetSecurity, mRequest.componentSpecified,
mRequest.outActivity, mRequest.inTask, mRequest.reason,
mRequest.allowPendingRemoteAnimationRegistryLookup,
mRequest.originatingPendingIntent, mRequest.allowBackgroundActivityStart);
} finally {
onExecutionComplete();
}
}

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
ActivityRecord[] outActivity, boolean restrictedBgActivity) {
int result = START_CANCELED;
final ActivityStack startedActivityStack;
try {
mService.mWindowManager.deferSurfaceLayout();
result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
startFlags, doResume, options, inTask, outActivity, restrictedBgActivity);
}
// …
}

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
ActivityRecord[] outActivity, boolean restrictedBgActivity) {
// …
mRootActivityContainer.resumeFocusedStacksTopActivities();
}
}

接下里继续到RootActivityContainer；

/**

• Root node for activity containers.
• TODO: This class is mostly temporary to separate things out of ActivityStackSupervisor.java. The
• intention is to have this merged with RootWindowContainer.java as part of unifying the hierarchy.
• 看样子这个类后面可能会被合入到RootWindowContainer里，不重点分析；
  */
  class RootActivityContainer {
  boolean resumeFocusedStacksTopActivities(
  ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
  if (targetStack != null && (targetStack.isTopStackOnDisplay() || getTopDisplayFocusedStack() == targetStack)) {
  result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
  }
  }
  }

7. ActivityStack源码分析

ActivityStack负责管理activity栈和activity的状态，包括根据activity栈的状态决定如何管理activity等，当然activity的启动也是由它来继续完成；

/**

• State and management of a single stack of activities.
  */
  class ActivityStack extends ConfigurationContainer {
  boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
  if (mInResumeTopActivity) {
  // Don’t even start recursing.
  return false;
  }

boolean result = false;
try {
// Protect against recursion.
mInResumeTopActivity = true;
result = resumeTopActivityInnerLocked(prev, options);
}
}

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
// …
if (next.attachedToProcess()) {
if (nextNext != next) {
// Do over!
mStackSupervisor.scheduleResumeTopActivities();
}
} else {
// Whoops, need to restart this activity!
mStackSupervisor.startSpecificActivityLocked(next, true, true);
}
}
}

8. StackSupervisor源码分析

// TODO: This class has become a dumping ground. Let’s
// - Move things relating to the hierarchy to RootWindowContainer
// - Move things relating to activity life cycles to maybe a new class called ActivityLifeCycler
// - Move interface things to ActivityTaskManagerService.
// - All other little things to other files.
// 看样子这部分代码后面也会被RootWindowContainer里面，后面Android源码分析可能要重点分析这个类了 😢
public class ActivityStackSupervisor implements RecentTasks.Callbacks {

void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
// Is this activity’s application already running?
final WindowProcessController wpc =
mService.getProcessController(r.processName, r.info.applicationInfo.uid);

boolean knownToBeDead = false;
if (wpc != null && wpc.hasThread()) {
try {
// 重点分析
realStartActivityLocked(r, wpc, andResume, checkConfig);
return;
} catch (RemoteException e) {
Slog.w(TAG, "Exception when starting activity "

• r.intent.getComponent().flattenToShortString(), e);
  }

// If a dead object exception was thrown – fall through to
// restart the application.
knownToBeDead = true;
}
}

boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc, boolean andResume, boolean checkConfig) {
// …
// Create activity launch transaction
final ClientTransaction clientTransaction = ClientTransaction.obtain( proc.getThread(), r.appToken);
// 重点，这里先记住它的callback是LaunchActivityItem
clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
System.identityHashCode®, r.info,
// TODO: Have this take the merged configuration instead of separate global
// and override configs.
mergedConfiguration.getGlobalConfiguration(),
mergedConfiguration.getOverrideConfiguration(), r.compat,
r.launchedFromPackage, task.voiceInteractor, proc.getReportedProcState(),
r.icicle, r.persistentState, results, newIntents,
dc.isNextTransitionForward(), proc.createProfilerInfoIfNeeded(),
r.assistToken));
// Schedule transaction. mService就是ActivityTaskManagerService
mService.getLifecycleManager().scheduleTransaction(clientTransaction);
}
}

以上代码分析出，启动activity被封装成transaction由ActivityTaskManagerService中的ClientLifecycleManager进程处理；

9. ClientLifecycleManager源码分析

class ClientLifecycleManager {
void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
final IApplicationThread client = transaction.getClient();
transaction.schedule();
if (!(client instanceof Binder)) {
// the transaction is executed on client in ActivityThread.
transaction.recycle();
}
}

代码比较明确，就是执行ClientTransaction的内容；接着分析ClientTransaction的代码：

public class ClientTransaction implements Parcelable, ObjectPoolItem {
/** Target client. */
private IApplicationThread mClient;

public void schedule() throws RemoteException {
// 重点
mClient.scheduleTransaction(this);
}
}

以上代码可以看出，最终执行到了mCient的scheduleTransaction()方法；而mClient就是传过来的IApplicationThread，这样就完成了从ActivityTaskManagerService进程到App2进程的调用；

自我介绍一下，小编13年上海交大毕业，曾经在小公司待过，也去过华为、OPPO等大厂，18年进入阿里一直到现在。

深知大多数初中级Android工程师，想要提升技能，往往是自己摸索成长或者是报班学习，但对于培训机构动则近万的学费，着实压力不小。自己不成体系的自学效果低效又漫长，而且极易碰到天花板技术停滞不前！

因此收集整理了一份《2024年Android移动开发全套学习资料》，初衷也很简单，就是希望能够帮助到想自学提升又不知道该从何学起的朋友，同时减轻大家的负担。

既有适合小白学习的零基础资料，也有适合3年以上经验的小伙伴深入学习提升的进阶课程，基本涵盖了95%以上Android开发知识点，真正体系化！

由于文件比较大，这里只是将部分目录截图出来，每个节点里面都包含大厂面经、学习笔记、源码讲义、实战项目、讲解视频，并且会持续更新！

如果你觉得这些内容对你有帮助，可以扫码获取！！（备注：Android）

总结

这次面试问的还是还是有难度的，要求当场写代码并且运行，也是很考察面试者写代码
因为Android知识体系比较庞大和复杂的，涉及到计算机知识领域的方方面面。在这里我和身边一些朋友特意整理了一份快速进阶为Android高级工程师的系统且全面的学习资料。涵盖了Android初级——Android高级架构师进阶必备的一些学习技能。

附上：我们之前因为秋招收集的二十套一二线互联网公司Android面试真题（含BAT、小米、华为、美团、滴滴）和我自己整理Android复习笔记（包含Android基础知识点、Android扩展知识点、Android源码解析、设计模式汇总、Gradle知识点、常见算法题汇总。）

里面包含不同方向的自学编程路线、面试题集合/面经、及系列技术文章等，资源持续更新中…

《互联网大厂面试真题解析、进阶开发核心学习笔记、全套讲解视频、实战项目源码讲义》点击传送门即可获取！

是还是有难度的，要求当场写代码并且运行，也是很考察面试者写代码
因为Android知识体系比较庞大和复杂的，涉及到计算机知识领域的方方面面。在这里我和身边一些朋友特意整理了一份快速进阶为Android高级工程师的系统且全面的学习资料。涵盖了Android初级——Android高级架构师进阶必备的一些学习技能。

附上：我们之前因为秋招收集的二十套一二线互联网公司Android面试真题（含BAT、小米、华为、美团、滴滴）和我自己整理Android复习笔记（包含Android基础知识点、Android扩展知识点、Android源码解析、设计模式汇总、Gradle知识点、常见算法题汇总。）
[外链图片转存中…(img-uRPKZoiU-1712498433996)]
里面包含不同方向的自学编程路线、面试题集合/面经、及系列技术文章等，资源持续更新中…

《互联网大厂面试真题解析、进阶开发核心学习笔记、全套讲解视频、实战项目源码讲义》点击传送门即可获取！