解析Activity的启动过程

最新推荐文章于 2024-05-16 01:50:52 发布

lishutong1006

最新推荐文章于 2024-05-16 01:50:52 发布

阅读量2.1w

点赞数 1

分类专栏：根Activity启动过程 Activity启动过程文章标签： android 安卓

本文链接：https://blog.csdn.net/lixiong0713/article/details/106857511

版权

根Activity启动过程同时被 2 个专栏收录

1 篇文章 0 订阅

订阅专栏

Activity启动过程

1 篇文章 0 订阅

订阅专栏

Activity启动过程

Activity 的启动过程分为两种，一种是根 Activity 的启动过程，另一种是普通 Activity（子Activity）的启动过程。

根Activity：以快捷图标的形式显示在Launcher中，它的启动过程代表了一个Android应用程序的启动过程。

子Activity：由根Activity或其他子Activity启动，他们有可能与启动他们的Activity运行在同一个进程中，也可能运行在不同的进程中。

本篇文章基于Android8.1系统来分析Activity的启动过程。

1 根Activity 的启动过程

根 Activity 指的是应用程序启动的第一个Activity，因此根 Activity 的启动过程一般情况下也可以理解为应用程序的启动过程。根Activity的启动过程比较复杂，这里我们分为三个部分来分析，分别是Launcher请求AMS过程、AMS到ApplicationThread的调用过程和ActivityThread启动Activity。

1.1 Launcher 请求 AMS 过程

Launcher启动后会将已安装应用程序的快捷图标显示到桌面上，这些应用程序的快捷图标就是启动跟Activity的入口，当我们点击某个应用程序的快捷图标时，就会动过Launcher请求AMS来启动该应用程序。

当我们点击应用程序的快捷图标时，就会调用 Launcher的 sta rtActivi tySafely方法，代码如下所示：

packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

    public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
       
         ...

        // Prepare intent
        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK); // ... 1
        if (v != null) {
            intent.setSourceBounds(getViewBounds(v));
        }
        try {
            if (Utilities.ATLEAST_MARSHMALLOW
                    && (item instanceof ShortcutInfo)
                    && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT
                     || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT)
                    && !((ShortcutInfo) item).isPromise()) {
                // Shortcuts need some special checks due to legacy reasons.
                startShortcutIntentSafely(intent, optsBundle, item);
            } else if (user == null || user.equals(Process.myUserHandle())) {
                // Could be launching some bookkeeping activity
                startActivity(intent, optsBundle); // ... 2
            } else {
                LauncherAppsCompat.getInstance(this).startActivityForProfile(
                        intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
            }
            return true;
        } catch (ActivityNotFoundException|SecurityException e) {
            Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();
            Log.e(TAG, "Unable to launch. tag=" + item + " intent=" + intent, e);
        }
        return false;
    }

在注释1处将Flag设置为Intent.FLAG_ACTIVITY_NEW_TASK ，这样根 Activity会在新的任务栈中启动。在注释2处调用startActivity方法，这个startActivity方法Activity 中实现，代码如下所示：

frameworks/base/core/java/android/app/Activity.java

    @Override
    public void startActivity(Intent intent, @Nullable Bundle options) {
        if (options != null) {
            startActivityForResult(intent, -1, options);
        } else {
            // Note we want to go through this call for compatibility with
            // applications that may have overridden the method.

            /**
             * 如果options为空时，startActivityForResult(intent, -1)调用最终
             * 还是调用startActivityForResult(intent, -1,null);
             */
            startActivityForResult(intent, -1);
        }
    }

在startActivity方法中会调用startActivityForResult方法，它的第二个参数为-1，表示Launcher不需要知道Activity启动的结果，startActivityForResult方法的代码如下所示：

frameworks/base/core/java/android/app/Activity.java

    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) { // ... 1
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options); // ... 2
            
            ....

        } else {
            
            ....

        }
    }

注释1 处的 mParent是 Activity 类型的，表示当前 Activity 的父类。因为目前根 Activity 还没有创建出来，因此， mParent == null 成立。接着调用 Instrumentation的 execStartActivity 方法， Instrumentation 主要用来监控应用程序和系统的交互， execStartActivity方法的代码如下所示：

frameworks/base/core/java/android/app/Instrumentation.java

    public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
      
        ...          

        try {
            intent.migrateExtraStreamToClipData();
            intent.prepareToLeaveProcess(who);
            int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options); // ... 1
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

在注释1处调用 Activity Manager的 getService 方法来获取 AMS 的代理对象，接着调用它的 startActivity方法。下面查看 Activity Manager的getService 方法做什么，代码如下所示：

frameworks/base/core/java/android/app/ActivityManager .java

    public static IActivityManager getService() {
        return IActivityManagerSingleton.get();
    }

在getService方法中调用了IActivityManagerSingleton的get方法，IActivityManagerSingleton的定义如下：

frameworks/base/core/java/android/app/ActivityManager.java

    private static final Singleton<IActivityManager> IActivityManagerSingleton =
            new Singleton<IActivityManager>() {
                @Override
                protected IActivityManager create() {
                    // Context.ACTIVITY_SERVICE = "activity"
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE); // ... 1
                    final IActivityManager am = IActivityManager.Stub.asInterface(b); // ... 2
                    return am;
                }
   };

IActivityManagerSingleton是一个 Singleton 类。在注释1处得到名为“ activity ”的 Service 引用，也就是I Binder 类型的 AMS 的引用。接着在注释2 处将它转换成I Activity Manager 类型的对象，这段代码采用的是 AIDL, IActivityManager.java 是由 AIDL 工具在编译时自动成的， IActivityManager.aidl 的文件路径为 frameworks/ base/ core/ java/android/app/IActivityManager.aidl。要实现进程间通信，服务器端也就是 AMS 只需要继承 IActi vityManager.Stub 并实现相应方法也就可以了。注意 Android 8.0 之前并没有采用 AIDL ，而是采用了类似 AIDL 的形式，用 AMS 的代理对象 Activity Manager Proxy 来与 AMS 进行进程间通信， Android 8.0 去除了 Activity ManagerN ative 的内部类 ActivityManagerProxy, 代替它的是IActivity Manager ，它是 AMS 在本地的代理。回到 Instrumentation 类的 execStartActivity 方法中，从上面得知 execStartActi vi ty方法最终调用的是 AMS的startActivity 方法。

1.2 AMS到ApplicationThread的调用过程

Launcher 请求 AMS 代码逻辑已经进入 AMS 中，接着是 AMS到 Application Thread 的调用流程，下面开始分析AMS的startActivity方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    @Override
    public final int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
        return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
                resultWho, requestCode, startFlags, profilerInfo, bOptions,
                UserHandle.getCallingUserId());
    }

在AMS的 startActivity 方法中返回了 s tartActivityAsUser 方法，可以发现 startActivity As User方法比 startActivity 方法多了一个参数 UserHandle.getCallingU serld() ，这个方法会获得调用者的 Userld, AMS 根据这个 User Id 来确定调用者的权限。

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    @Override
    public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {

        // 判断调用者进程是否被隔离
        enforceNotIsolatedCaller("startActivity"); // ... 1
        
        // 检查调用者权限
        userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
                userId, false, ALLOW_FULL_ONLY, "startActivity", null); // ... 2
        // TODO: Switch to user app stacks here.
        return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent,
                resolvedType, null, null, resultTo, resultWho, requestCode, startFlags,
                profilerInfo, null, null, bOptions, false, userId, null, "startActivityAsUser");
    }

在注释1 处判断调用者进程是否被隔离，如果被隔离则抛出 Security Exception 异常，在注释2 处检查调用者是否有权限，如果没有权限也会抛出 Security Exception 异常。最后调用了 ActivityStarter的startActivityMayWait方法， startActivityMayWait方法的参数要比 startActivity As User多几个，需要注意的是倒数第二个参数类型 TaskRecord ，代表启动的 Activ ity 所在的栈。最后一个参数" startAct ivityAsUs er"表示启动的理由。 startActivityMayWait 方法的代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java


    final int startActivityMayWait(IApplicationThread caller, int callingUid,
            String callingPackage, Intent intent, String resolvedType,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, WaitResult outResult,
            Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId,
            TaskRecord inTask, String reason) {
       
            ... 

            int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType,
                    aInfo, rInfo, voiceSession, voiceInteractor,
                    resultTo, resultWho, requestCode, callingPid,
                    callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
                    options, ignoreTargetSecurity, componentSpecified, outRecord, inTask,
                    reason);

            ...            

            return res;
        }
    }

ActivityStarter的 startActivityMayWait 方法调用了 startActivityLocked 方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java


    int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
            ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
            ActivityRecord[] outActivity, TaskRecord inTask, String reason) {

        // 判断启动的理由是否为空
        if (TextUtils.isEmpty(reason)) { // ... 1
            throw new IllegalArgumentException("Need to specify a reason.");
        }
        mLastStartReason = reason;
        mLastStartActivityTimeMs = System.currentTimeMillis();
        mLastStartActivityRecord[0] = null;

        mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,
                aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,
                callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
                options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,
                inTask); // ... 2

        if (outActivity != null) {
            // mLastStartActivityRecord[0] is set in the call to startActivity above.
            outActivity[0] = mLastStartActivityRecord[0];
        }

        // Aborted results are treated as successes externally, but we must track them internally.
        return mLastStartActivityResult != START_ABORTED ? mLastStartActivityResult : START_SUCCESS;
    }

在注释1处判断启动的理由是否为空，如果为空则抛出 IllegalArgumentException异常，在注释2处调用startActivity方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

    private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
            ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
            ActivityRecord[] outActivity, TaskRecord inTask) {
        int err = ActivityManager.START_SUCCESS;
        // Pull the optional Ephemeral Installer-only bundle out of the options early.
        final Bundle verificationBundle
                = options != null ? options.popAppVerificationBundle() : null;

        ProcessRecord callerApp = null;
        if (caller != null) { // ... 1
            // 得到Launcher进程
            callerApp = mService.getRecordForAppLocked(caller); // ... 2
            if (callerApp != null) {
                // 获取Launcher进程的pid和uid
                callingPid = callerApp.pid;
                callingUid = callerApp.info.uid;
            } else {
                Slog.w(TAG, "Unable to find app for caller " + caller
                        + " (pid=" + callingPid + ") when starting: "
                        + intent.toString());
                err = ActivityManager.START_PERMISSION_DENIED;
            }
        }

        ...

       
        // 创建即将要启动的Activity的描述类ActivityRecord
        ActivityRecord r = new ActivityRecord(mService, callerApp, callingPid, callingUid,
                callingPackage, intent, resolvedType, aInfo, mService.getGlobalConfiguration(),
                resultRecord, resultWho, requestCode, componentSpecified, voiceSession != null,
                mSupervisor, options, sourceRecord);
        if (outActivity != null) {
            outActivity[0] = r; // ... 3
        }

        ...

        doPendingActivityLaunchesLocked(false);

        return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags, true,
                options, inTask, outActivity); // ... 4
    }

在注释1处判断 IApplicationThread 类型的 caller 是否为 null ，这个 caller 是方法调用一路传过来的，指向的是 Launcher 所在的应用程序进程的 Application Thread 对象，在注释2 处调 AMS的getRecordF or AppLocked方法得到的是代表 Launcher 进程的 caller App 对象，它是ProcessRecord 类型的， ProcessRecord 用于描述一个应用程序进程。同样地， Activity R eco rd 用于描述一个Activity ，用来记录 Activity 的所有信息。接下来创建 Activity Record，用于描述将要启动的 Activity ，并在注释3 处将创建的 Activity Record 赋值给 Activity Record[] 类型的 outActivity ，这个 outActivity 会作为注释4 处的 startActivity 方法的参数传递下去。startActivity 方法的代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java


    private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
            ActivityRecord[] outActivity) {
        int result = START_CANCELED;
        try {
            mService.mWindowManager.deferSurfaceLayout();
            result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                    startFlags, doResume, options, inTask, outActivity); // ... 1
        } finally {
            // If we are not able to proceed, disassociate the activity from the task. Leaving an
            // activity in an incomplete state can lead to issues, such as performing operations
            // without a window container.
            if (!ActivityManager.isStartResultSuccessful(result)
                    && mStartActivity.getTask() != null) {
                mStartActivity.getTask().removeActivity(mStartActivity);
            }
            mService.mWindowManager.continueSurfaceLayout();
        }

        postStartActivityProcessing(r, result, mSupervisor.getLastStack().mStackId,  mSourceRecord,
                mTargetStack);

        return result;
    }

在注释1处调用startActivityUnchecked方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java


    // Note: This method should only be called from {@link startActivity}.
    private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
            ActivityRecord[] outActivity) {

        ...

        // Should this be considered a new task?
        int result = START_SUCCESS;
        if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask
                && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) { // ... 1
            newTask = true;

            // 创建新的TaskRecord
            result = setTaskFromReuseOrCreateNewTask(
                    taskToAffiliate, preferredLaunchStackId, topStack); // ... 2
        } else if (mSourceRecord != null) {
            result = setTaskFromSourceRecord();
        } else if (mInTask != null) {
            result = setTaskFromInTask();
        } else {
            // This not being started from an existing activity, and not part of a new task...
            // just put it in the top task, though these days this case should never happen.
            setTaskToCurrentTopOrCreateNewTask();
        }

        ...


        if (mDoResume) {
            final ActivityRecord topTaskActivity =
                    mStartActivity.getTask().topRunningActivityLocked();
            if (!mTargetStack.isFocusable()
                    || (topTaskActivity != null && topTaskActivity.mTaskOverlay
                    && mStartActivity != topTaskActivity)) {
                // If the activity is not focusable, we can't resume it, but still would like to
                // make sure it becomes visible as it starts (this will also trigger entry
                // animation). An example of this are PIP activities.
                // Also, we don't want to resume activities in a task that currently has an overlay
                // as the starting activity just needs to be in the visible paused state until the
                // over is removed.
                mTargetStack.ensureActivitiesVisibleLocked(null, 0, !PRESERVE_WINDOWS);
                // Go ahead and tell window manager to execute app transition for this activity
                // since the app transition will not be triggered through the resume channel.
                mWindowManager.executeAppTransition();
            } else {
                // If the target stack was not previously focusable (previous top running activity
                // on that stack was not visible) then any prior calls to move the stack to the
                // will not update the focused stack.  If starting the new activity now allows the
                // task stack to be focusable, then ensure that we now update the focused stack
                // accordingly.
                if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {
                    mTargetStack.moveToFront("startActivityUnchecked");
                }
                mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,
                        mOptions); // ... 3
            }
        } else {
            mTargetStack.addRecentActivityLocked(mStartActivity);
        }
        
        ...

        return START_SUCCESS;
    }

startActi vi ty Unchecked 方法主要处理与栈管理相关的逻辑。启动根 Activity 时会将 Intent 的 Flag 设置为 FLAG_ ACTIVITY_ NEW_ TASK ，这样注释1处的条件判断就会满足，接着执行注释2 处的 setTaskFromReuseOrCreateNewTask 方法，其内部会创建一个新的 TaskRecord ，用来描述 Activity 任务栈，也就是说 setTaskFromReuseOrCreateNewTask 方法内部会创建一个新的 Activity 任务栈。在注释3处会调用 ActivityStackSupervisor的 resumeFocusedStackTopActivityLocked 方法，如下所示：

frameworks/base/services/core/java/com/android/service/am/ActivityStackSupervisor.java


    boolean resumeFocusedStackTopActivityLocked(
            ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {

        if (!readyToResume()) {
            return false;
        }

        if (targetStack != null && isFocusedStack(targetStack)) {
            return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
        }

        // 获取要启动的Activity所在栈的栈顶是不是处于停止状态的ActivityRecord
        final ActivityRecord r = mFocusedStack.topRunningActivityLocked(); // ... 1
        if (r == null || r.state != RESUMED) { // ... 2
            mFocusedStack.resumeTopActivityUncheckedLocked(null, null); // ... 3
        } else if (r.state == RESUMED) {
            // Kick off any lingering app transitions form the MoveTaskToFront operation.
            mFocusedStack.executeAppTransition(targetOptions);
        }

        return false;
    }

在注释1处调用 ActivityStack的 topR unning Activ ityLocked 方法获取要启动的 A ctivity 所在栈的栈顶是不是处于停止状态的 Activity Record 。在注释2 处，如果 Ac ti vi ty Record不为 null ，或者要启动A ctivity 的状态不是 RESUMED 状态，就调用注释3 处的 Ac tivi tyStack的 resumeTopA ctivityUnch eckedLocked 方法，对于即将启动的 Act ivity ，注释2 处的条件判断是肯定满足的，我们来查看 A ctivityStack的 resumeTopActivity UncheckedLocked 方法，如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStack.java

    boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
        if (mStackSupervisor.inResumeTopActivity) {
            // Don't even start recursing.
            return false;
        }

        boolean result = false;
        try {
            // Protect against recursion.
            mStackSupervisor.inResumeTopActivity = true;
            result = resumeTopActivityInnerLocked(prev, options); // ... 1
        } finally {
            mStackSupervisor.inResumeTopActivity = false;
        }

        // When resuming the top activity, it may be necessary to pause the top activity (for
        // example, returning to the lock screen. We suppress the normal pause logic in
        // {@link #resumeTopActivityUncheckedLocked}, since the top activity is resumed at the end.
        // We call the {@link ActivityStackSupervisor#checkReadyForSleepLocked} again here to ensure
        // any necessary pause logic occurs. In the case where the Activity will be shown regardless
        // of the lock screen, the call to {@link ActivityStackSupervisor#checkReadyForSleepLocked}
        // is skipped.
        final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);
        if (next == null || !next.canTurnScreenOn()) {
            checkReadyForSleep();
        }

        return result;
    }

在注释1处调用了resumeTopActivityInnerLocked方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStack.java


    private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
  
           ...

            mStackSupervisor.startSpecificActivityLocked(next, true, true);
        }

        if (DEBUG_STACK) mStackSupervisor.validateTopActivitiesLocked();
        return true;
    }

resumeTopActivityInnerLocked 方法代码非常多，我们只需要关注调用了 ActivityStackSupervisor的startSpecificActivityLocked 方法即可，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

    void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?

        // 获取即将启动的Activity的所在的应用程序进程
        ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true); // ... 1

        r.getStack().setLaunchTime(r);

        if (app != null && app.thread != null) { // ... 2
            try {
                if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                        || !"android".equals(r.info.packageName)) {
                    // Don't add this if it is a platform component that is marked
                    // to run in multiple processes, because this is actually
                    // part of the framework so doesn't make sense to track as a
                    // separate apk in the process.
                    app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode,
                            mService.mProcessStats);
                }
                realStartActivityLocked(r, app, andResume, checkConfig); // ... 3
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
        }

        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
    }

在注释1 获取即将启动的 A ctivity 应用程序进程，在注释2处判断要启动 Activity 所在的应用程序进程如果已经运行的话，就会调用注释3 处的 realStartActi v i ty Locked 方法，这个方法的第二参数是代表要启动的 Activity 应用程序进程 ProcessRecord。 realStartActi v i ty Locked代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java


    final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
            boolean andResume, boolean checkConfig) throws RemoteException {

            ...              

                app.thread.scheduleLaunchActivity(new Intent(r.intent), r.appToken,
                        System.identityHashCode(r), r.info,
                        // TODO: Have this take the merged configuration instead of separate global
                        // and override configs.
                        mergedConfiguration.getGlobalConfiguration(),
                        mergedConfiguration.getOverrideConfiguration(), r.compat,
                        r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
                        r.persistentState, results, newIntents, !andResume,
                        mService.isNextTransitionForward(), profilerInfo);

        ...

        return true;
    }

这里的 app.thread 指的是I Application Thread ，它的实现是 ActivityThread 的内部类 Application Thread ，其中 Application Thread 继承了I Application Thread. Stub。 app 指的是传入的要启动的 Activity 所在的应用程序进程，因此，这段代码指的就是要在目标应用程序进程启动 Activ ity 。当前代码逻辑运行在 AMS 所在的进程（ SystemServer 进程）中，通过 ApplicationThread 来与应用程序进程进行 Binder 通信，换句话说， App lication Thread AMS 所在进程（ SystemServer 进程）和应用程序进程的通信桥梁，如图所示：