Activity启动流程分析

Activity启动流程

目录

• 总结与思考
• Activity启动流程源码分析
  

0.总结

activity是我们使用最频繁的组件之一，通过startActivity()可以启动新的Activity。下面我们开始分析整个Activity启动流程，源码基于aosp12，这个流程图如下：

从整个流程上看，ActivityTaskManager --> ApplicationThread 过程逻辑比较复杂，其他相对比较简单。

整个流程涉及的主要角色有：

• Instrumentation: 监控应用与系统相关的交互行为。
• ActivityTaskManagerService：组件管理调度中心，什么都不干，但是什么都管。Android低版本为ActivityManagerService
• ActivityStarter：Activity启动的控制器，处理Intent与Flag对Activity启动的影响，具体说来有：1 寻找符合启动条件的Activity，如果有多个，让用户选择；2 校验启动参数的合法性；3 返回int参数，代表Activity是否启动成功。
• ActivityStackSupervisior：用来管理任务栈。
• RootWindowContainer：用来管理Window层级树。
• Task：用来管理activity任务栈。
• ActivityThread：最终干活的人，Activity、Service、BroadcastReceiver的启动、切换、调度等各种操作都在这个类里完成。

整个流程主要涉及四个进程：

• 调用者进程，如果是在桌面启动应用就是Launcher应用进程。
• ActivityTaskManagerService等所在的System Server进程，该进程主要运行着系统服务组件。
• Zygote进程，该进程主要用来fork新进程。
• 新启动的应用进程，该进程就是用来承载应用运行的进程了，它也是应用的主线程（新创建的进程就是主线程），处理组件生命周期、界面绘制等相关事情。

整个流程可以概括为：

1. 点击桌面应用图标，Launcher进程将启动MainActivity的请求以Binder的方式发送给了ActivityTaskManagerService。
2. ActivityTaskManagerService接收到启动请求后，交付ActivityStarter处理Intent和Flag等信息，然后再交给ActivityStackSupervisior/Task
   处理Activity进栈相关流程。同时以Socket方式请求Zygote进程fork新进程。
3. Zygote接收到新进程创建请求后fork出新进程。
4. 在新进程里创建ActivityThread对象，新创建的进程就是应用的主线程，在主线程里开启Looper消息循环，开始处理创建Activity。
5. ActivityThread利用ClassLoader去加载Activity、创建Activity实例，并回调Activity的onCreate()方法。这样便完成了Activity的启动。

‍

下面开始具体的源码调用流程分析

1.Activity.startActivity

Activity.startActivity()最后调用了Activity.startActivityForResult()，startActivityForResult()做了两件事：Instrumentation.execStartActivity()和ActivityThread.sendActivityResult()，简要流程图如下：

// frameworks/base/core/java/android/app/Activity.java
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
        @Nullable Bundle options) {   
    // 不传options时为null  
    options = transferSpringboardActivityOptions(options);
    // mInstrumentation是attach()赋值的，后面分析
    Instrumentation.ActivityResult ar =
        mInstrumentation.execStartActivity(
            this, mMainThread.getApplicationThread(), mToken, this,
            intent, requestCode, options);
    // 默认为null，下面可以不用看
    if (ar != null) {
        mMainThread.sendActivityResult(
            mToken, mEmbeddedID, requestCode, ar.getResultCode(),
            ar.getResultData());
    }
    // 通过startActivity时requestCode=-1，不会调用onActivityResult()
    if (requestCode >= 0) {
        mStartedActivity = true;
    }
}

2.Instrumentation.execStartActivity()

这是一个IPC调用，通过Binder调用了ActivityTaskManagerService，调用流程流程如下：

// frameworks/base/core/java/android/app/Instrumentation.java
/**@param who The Context from which the activity is being started.

 * @param contextThread The main thread of the Context from which the activity is being started.

 * @param token Internal token identifying to the system who is starting the activity; may be null.

 * @param target Which activity is performing the start (and thus receiving any result); may be null if this call is not being made from an activity.

 * @param intent The actual Intent to start.

 * @param requestCode Identifier for this request's result; less than zero if the caller is not expecting a result.

 * @param options Addition options.
 *
 * @return To force the return of a particular result, return an  ActivityResult object containing the desired data; otherwise return null.The default implementation always returns null.
 */
public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        try {
            intent.migrateExtraStreamToClipData(who);
            intent.prepareToLeaveProcess(who);
	    // 通过AIDL获取到了IActivityTaskManager.Stub
            int result = ActivityTaskManager.getService().startActivity(whoThread,
                    who.getOpPackageName(), who.getAttributionTag(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                    target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
	    // 异常处理，比如常见的ActivityNotFoundException
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
}

// frameworks/base/core/java/android/app/ActivityTaskManager.java
public static IActivityTaskManager getService() {
    return IActivityTaskManagerSingleton.get();
}

private static final Singleton<IActivityTaskManager> IActivityTaskManagerSingleton =
        new Singleton<IActivityTaskManager>() {
            @Override
            protected IActivityTaskManager create() {
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE);
                return IActivityTaskManager.Stub.asInterface(b);
            }
  };

从上面代码可以看到，通过单例模式创建了IActivityTaskManager，再搜索谁实现了IActivityTaskManage.Stub，发现是ActivityTaskManagerService。

‍

3.ActivityTaskManagerService.startActivity()

startActivity()最后调用了startActivityAsUser()，这些方法参数都比较多。我们可以先看aidl文件中对应接口定义，后者多了一个userId标识用户的参数

// frameworks/base/core/java/android/app/IActivityTaskManager.aidl
interface IActivityTaskManager {
    int startActivity(in IApplicationThread caller, in String callingPackage,
            in String callingFeatureId, in Intent intent, in String resolvedType,
            in IBinder resultTo, in String resultWho, int requestCode,
            int flags, in ProfilerInfo profilerInfo, in Bundle options)
int startActivityAsUser(in IApplicationThread caller, in String callingPackage,
            in String callingFeatureId, in Intent intent, in String resolvedType,
            in IBinder resultTo, in String resultWho, int requestCode, int flags,
            in ProfilerInfo profilerInfo, in Bundle options, int userId);
}

先进行一些异常检查，再转到ActivityStarter处理

// frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
private int startActivityAsUser(IApplicationThread caller, String callingPackage,
@Nullable String callingFeatureId, Intent intent, String resolvedType,
IBinder resultTo, String resultWho, int requestCode, int startFlags,
ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
// 对caller进行一些检查
...
userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser,
    Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");
// 转到ActivityStarter处理
return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
    .setCaller(caller)
    .setCallingPackage(callingPackage)
    .setCallingFeatureId(callingFeatureId)
    .setResolvedType(resolvedType)
    .setResultTo(resultTo)
    .setResultWho(resultWho)
    .setRequestCode(requestCode)
    .setStartFlags(startFlags)
    .setProfilerInfo(profilerInfo)
    .setActivityOptions(bOptions)
    .setUserId(userId)
    .execute();
}

4.ActivityStarter.execute()

ActivityStartController通过工厂模式创建了ActivityStarter，默认是用DefaultFactory

// frameworks/base/services/core/java/com/android/server/wm/ActivityStartController.java
ActivityStarter obtainStarter(Intent intent, String reason) {
   return mFactory.obtain().setIntent(intent).setReason(reason);
}

ActivityStarter.execute()整个逻辑概况为：开始启动–>启动中–>启动完成

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
static class DefaultFactory implements Factory {}

int execute() {
   // 上面给ActivityStarter#setXX()实际上都设置给了mRequest
    try {
	// 通知正在启动
        final LaunchingState launchingState;
        synchronized (mService.mGlobalLock) {
            final ActivityRecord caller = ActivityRecord.forTokenLocked(mRequest.resultTo);
            final int callingUid = mRequest.realCallingUid == Request.DEFAULT_REAL_CALLING_UID
                    ?  Binder.getCallingUid() : mRequest.realCallingUid;
            launchingState = mSupervisor.getActivityMetricsLogger().notifyActivityLaunching(
                    mRequest.intent, caller, callingUid);
        }
        int res;
        synchronized (mService.mGlobalLock) {
	    // 到这里，前期工作完成，正式开始启动
            res = executeRequest(mRequest);
            Binder.restoreCallingIdentity(origId);
            // 通知启动完成
            final boolean newActivityCreated = mStartActivity == mLastStartActivityRecord;
            mSupervisor.getActivityMetricsLogger().notifyActivityLaunched(launchingState, res,
                    newActivityCreated, mLastStartActivityRecord, originalOptions);
            return getExternalResult(res);
        }
    } finally {
        onExecutionComplete();
    }
}

5.ActivityStarter.executeRequest()

executeRequest()先做了一些error分支处理、终止流程的处理，最后创建了ActivityRecord，调用了startActivityUnchecked()。从方法注释来看，正常启动一个activity需要经历startActivityUnchecked() --> startActivityInner()

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
/**
 * Executing activity start request and starts the journey of starting an activity. Here
 * begins with performing several preliminary checks. The normally activity launch flow will
 * go through {@link #startActivityUnchecked} to {@link #startActivityInner}.
 */
private int executeRequest(Request request) {
    // 这里做了一些ERROR分支处理、终止流程的处理
    final ActivityRecord r = new ActivityRecord.Builder(mService)
            .setCaller(callerApp)
            .setLaunchedFromPid(callingPid)
            .setLaunchedFromUid(callingUid)
            .setLaunchedFromPackage(callingPackage)
            .setLaunchedFromFeature(callingFeatureId)
            .setIntent(intent)
            .setResolvedType(resolvedType)
            .setActivityInfo(aInfo)
            .setConfiguration(mService.getGlobalConfiguration())
            .setResultTo(resultRecord)
            .setResultWho(resultWho)
            .setRequestCode(requestCode)
            .setComponentSpecified(request.componentSpecified)
            .setRootVoiceInteraction(voiceSession != null)
            .setActivityOptions(checkedOptions)
            .setSourceRecord(sourceRecord)
            .build();
    mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
            request.voiceInteractor, startFlags, true /* doResume */, checkedOptions,
            inTask, inTaskFragment, restrictedBgActivity, intentGrants);
    if (request.outActivity != null) {
        request.outActivity[0] = mLastStartActivityRecord;
    }
    return mLastStartActivityResult;
}

6.ActivityStarter.startActivityUnchecked()

startActivityUnchecked()又调用startActivityInner()进行进一步处理，对返回结果进行一些判断，先不用看

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
/**
 * Start an activity while most of preliminary checks has been done and caller has been
 * confirmed that holds necessary permissions to do so.
 * Here also ensures that the starting activity is removed if the start wasn't successful.
 */
private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, Task inTask,
        TaskFragment inTaskFragment, boolean restrictedBgActivity,
        NeededUriGrants intentGrants) {
    int result = START_CANCELED;
    final Task startedActivityRootTask;
    // Create a transition now to record the original intent of actions taken within
    // startActivityInner. Otherwise, logic in startActivityInner could start a different
    // transition based on a sub-action.
    // Only do the create here (and defer requestStart) since startActivityInner might abort.
    final TransitionController transitionController = r.mTransitionController;
    Transition newTransition = (!transitionController.isCollecting()
            && transitionController.getTransitionPlayer() != null)
            ? transitionController.createTransition(TRANSIT_OPEN) : null;
    RemoteTransition remoteTransition = r.takeRemoteTransition();
    if (newTransition != null && remoteTransition != null) {
        newTransition.setRemoteTransition(remoteTransition);
    }
    transitionController.collect(r);
    try {
        mService.deferWindowLayout();
        Trace.traceBegin(Trace.TRACE_TAG_WINDOW_MANAGER, "startActivityInner");
        result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, inTaskFragment, restrictedBgActivity,
                intentGrants);
    } finally {
        Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);
        startedActivityRootTask = handleStartResult(r, options, result, newTransition,
                remoteTransition);
        mService.continueWindowLayout();
    }
    postStartActivityProcessing(r, result, startedActivityRootTask);
    return result;
}

7.ActivityStarter.startActivityInner()

startActivityInner()逻辑比较多，前面部分有对activity的启动模式处理、相应任务栈的处理、一些错误分支的处理，随后并真正启动activity（增加到window、执行转场动画、可见性显示、更新最近任务列表）

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
/**
 * Start an activity and determine if the activity should be adding to the top of an existing
 * task or delivered new intent to an existing activity. Also manipulating the activity task
 * onto requested or valid root-task/display.
 *
 * Note: This method should only be called from {@link #startActivityUnchecked}.
 */
int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, Task inTask,
        TaskFragment inTaskFragment, boolean restrictedBgActivity,
        NeededUriGrants intentGrants) {
    // 保存一些状态值，比如activity的启动模式就是在这里检查
    // activity任务栈处理
    // 一些错误分支处理

    if (mTargetRootTask == null) {
        mTargetRootTask = getLaunchRootTask(mStartActivity, mLaunchFlags, targetTask, mOptions);
    }
    // mStartActivity就是之前创建的ActivityRecord
    final Task startedTask = mStartActivity.getTask();
    mStartActivity.getTaskFragment().clearLastPausedActivity();
    mRootWindowContainer.startPowerModeLaunchIfNeeded(
            false /* forceSend */, mStartActivity);
    final boolean isTaskSwitch = startedTask != prevTopTask && !startedTask.isEmbedded();
    // 这里有对activity启动时的动画处理
    mTargetRootTask.startActivityLocked(mStartActivity,
            topRootTask != null ? topRootTask.getTopNonFinishingActivity() : null, newTask,
            isTaskSwitch, mOptions, sourceRecord);
    // 上面的executeRequest()传递mDoResume=true
    if (mDoResume) {
        final ActivityRecord topTaskActivity = startedTask.topRunningActivityLocked();
        if (!mTargetRootTask.isTopActivityFocusable()
                || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                && mStartActivity != topTaskActivity)) {
           // activity不是有焦点的，只让它可见但不会执行resume，会触发转场动画
            mTargetRootTask.ensureActivitiesVisible(null /* starting */,
                    0 /* configChanges */, !PRESERVE_WINDOWS);
  
            mTargetRootTask.mDisplayContent.executeAppTransition();
        } else {
           // 将activity移动到前面，并且resume
            if (mTargetRootTask.isTopActivityFocusable()
                    && !mRootWindowContainer.isTopDisplayFocusedRootTask(mTargetRootTask)) {
                mTargetRootTask.moveToFront("startActivityInner");
            }
            mRootWindowContainer.resumeFocusedTasksTopActivities(
                    mTargetRootTask, mStartActivity, mOptions, mTransientLaunch);
        }
    }
    mRootWindowContainer.updateUserRootTask(mStartActivity.mUserId, mTargetRootTask);
    // 更新最近任务列表
    mSupervisor.mRecentTasks.add(startedTask);
    mSupervisor.handleNonResizableTaskIfNeeded(startedTask,
            mPreferredWindowingMode, mPreferredTaskDisplayArea, mTargetRootTask);
    return START_SUCCESS;
}

8.RootWindowContainer.resumeFocusedTasksTopActivities()

startActivityLocked()主要处理添加到Window等逻辑，逻辑比较多，先跳过不影响分析整个Activity启动流程。接着看resumeFocusedTasksTopActivities()

// frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java

boolean resumeFocusedTasksTopActivities(
        Task targetRootTask, ActivityRecord target, ActivityOptions targetOptions,
        boolean deferPause) {
  
    boolean result = false;
    if (targetRootTask != null && (targetRootTask.isTopRootTaskInDisplayArea()
            || getTopDisplayFocusedRootTask() == targetRootTask)) {
        result = targetRootTask.resumeTopActivityUncheckedLocked(target, targetOptions,
                deferPause);
    }
    ...
    return result;
}

‍

9.Task.resumeTopActivityUncheckedLocked()

这个方法调用过程为：resumeTopActivityUncheckedLocked() --> resumeTopActivityInnerLocked() --> TaskFragment.resumeTopActivity()

    // frameworks/base/services/core/java/com/android/server/wm/Task.java
    /**
     * Ensure that the top activity in the root task is resumed.
     *
     * @param prev The previously resumed activity, for when in the process
     * of pausing; can be null to call from elsewhere.
     * @param options Activity options.
     * @param deferPause When {@code true}, this will not pause back tasks.
     *
     * @return Returns true if something is being resumed, or false if
     * nothing happened.
     *
     * NOTE: It is not safe to call this method directly as it can cause an activity in a
     *       non-focused root task to be resumed.
     *       Use {@link RootWindowContainer#resumeFocusedTasksTopActivities} to resume the
     *       right activity for the current system state.
     */
 @GuardedBy("mService")
 boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options,
         boolean deferPause) {
     ...
     if (isLeafTask()) {
         if (isFocusableAndVisible()) {
             someActivityResumed = resumeTopActivityInnerLocked(prev, options, deferPause);
         }
     }
     ...
 }

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options,
    boolean deferPause) {

final ActivityRecord topActivity = topRunningActivity(true /* focusableOnly */);
if (topActivity == null) {
    // There are no activities left in this task, let's look somewhere else.
    return resumeNextFocusableActivityWhenRootTaskIsEmpty(prev, options);
}

final boolean[] resumed = new boolean[1];
final TaskFragment topFragment = topActivity.getTaskFragment();
resumed[0] = topFragment.resumeTopActivity(prev, options, deferPause);
forAllLeafTaskFragments(f -> {
    if (topFragment == f) {
        return;
    }
    if (!f.canBeResumed(null /* starting */)) {
        return;
    }
    resumed[0] |= f.resumeTopActivity(prev, options, deferPause);
}, true);
return resumed[0];
}

10.TaskFragment.resumeTopActivity()

resumeTopActivity()代码比较多，前面做了一些检查，最后调用了mTaskSupervisor.startSpecificActivity

    // frameworks/base/services/core/java/com/android/server/wm/TaskFragment.java 
    final boolean resumeTopActivity(ActivityRecord prev, ActivityOptions options,
            boolean deferPause) {
        // 做一些检查逻辑：   
        // 如果activity已经启动过了，直接返回
        // 如果有activity正常pausing，直接返回
        // 如果activity所属的user状态没有启动，直接返回

        // deferPause是ActivityOptions.mTransientLaunch，默认为false
        // pauseBackTasks()代表启动新的activity时，pausing该activity栈所有activity
        boolean pausing = !deferPause && taskDisplayArea.pauseBackTasks(next);
        // 这里有个pausing判断，一开始可能不太好理解，要结合pauseBackTasks()进行看
  
        // 判断activity进程是否已经启动了，可以看到最后都调用了mTaskSupervisor.startSpecificActivity
        if (next.attachedToProcess()) {
  
        } else {
            // Whoops, need to restart this activity!
            if (!next.hasBeenLaunched) {
                next.hasBeenLaunched = true;
            } else {
                if (SHOW_APP_STARTING_PREVIEW) {
                    next.showStartingWindow(false /* taskSwich */);
                }
            }
            mTaskSupervisor.startSpecificActivity(next, true, true);
        }

        return true;
    }

11.ActivityTaskSupervisor.startSpecificActivity()

如果activity所在的app进程已经启动，则startActivity即可，否则要启动app进程。这里我们分析app进程已经启动的情形

 // frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java
void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
    // Is this activity's application already running?
    final WindowProcessController wpc =
            mService.getProcessController(r.processName, r.info.applicationInfo.uid);

    boolean knownToBeDead = false;
    if (wpc != null && wpc.hasThread()) {
        try {
            realStartActivityLocked(r, wpc, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            Slog.w(TAG, "Exception when starting activity "
                    + r.intent.getComponent().flattenToShortString(), e);
        }

        // If a dead object exception was thrown -- fall through to
        // restart the application.
        knownToBeDead = true;
    }

    r.notifyUnknownVisibilityLaunchedForKeyguardTransition();

    final boolean isTop = andResume && r.isTopRunningActivity();
    mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
}

‍

12.ActivityTaskSupervisor.realStartActivityLocked()

通过ActivityTaskManagerService执行了一个IPC调用，mService.getLifecycleManager().scheduleTransaction(clientTransaction);

// frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java
final ActivityTaskManagerService mService;
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
   boolean andResume, boolean checkConfig) throws RemoteException {
  
    // 一些检查工作：
    // 任务栈的activity没有paused，直接返回
    // ---开始启动---
    try {
        // Create activity launch transaction.
        final ClientTransaction clientTransaction = ClientTransaction.obtain(
                proc.getThread(), r.appToken);
        final boolean isTransitionForward = r.isTransitionForward();
        clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                System.identityHashCode(r), r.info,
                mergedConfiguration.getGlobalConfiguration(),
                mergedConfiguration.getOverrideConfiguration(), r.compat,
                r.getFilteredReferrer(r.launchedFromPackage), task.voiceInteractor,
                proc.getReportedProcState(), r.getSavedState(), r.getPersistentSavedState(),
                results, newIntents, r.takeOptions(), isTransitionForward,
                proc.createProfilerInfoIfNeeded(), r.assistToken, activityClientController,
                r.createFixedRotationAdjustmentsIfNeeded(), r.shareableActivityToken,
                r.getLaunchedFromBubble()));
        // Set desired final state.
        final ActivityLifecycleItem lifecycleItem;
        if (andResume) {
            lifecycleItem = ResumeActivityItem.obtain(isTransitionForward);
        } else {
            lifecycleItem = PauseActivityItem.obtain();
        }
        clientTransaction.setLifecycleStateRequest(lifecycleItem);
        // Schedule transaction.
        mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    } 
    // ---完成启动---

}

13.ClientLifecycleManager.scheduleTransaction()

代码比较简单，直接调用了transaction.schedule()

// frameworks/base/services/core/java/com/android/server/wm/ClientLifecycleManager.java
 /**
     * Schedule a transaction, which may consist of multiple callbacks and a lifecycle request.
     * @param transaction A sequence of client transaction items.
     * @throws RemoteException
     *
     * @see ClientTransaction
     */
    void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        final IApplicationThread client = transaction.getClient();
        transaction.schedule();
        if (!(client instanceof Binder)) {
            // If client is not an instance of Binder - it's a remote call and at this point it is
            // safe to recycle the object. All objects used for local calls will be recycled after
            // the transaction is executed on client in ActivityThread.
            transaction.recycle();
        }
    }

14.ClientTransaction.schedule()

可以看到ClientTransaction内部保存了一个IApplicationThread 成员变量，也是直接调用了IApplicationThread.scheduleTransaction()。

IApplicationThread是一个aidl，搜索谁继承了IApplicationThread.Stub，发现是ApplicationThread（frameworks\base\core\java\android\app\ActivityThread.java），并且是ActivityThread的内部类

// frameworks\base\core\java\android\app\servertransaction\ClientTransaction.java 
 /** Target client. */
    private IApplicationThread mClient;

  /** Obtain an instance initialized with provided params. */
    public static ClientTransaction obtain(IApplicationThread client, IBinder activityToken) {
        ClientTransaction instance = ObjectPool.obtain(ClientTransaction.class);
        if (instance == null) {
            instance = new ClientTransaction();
        }
        instance.mClient = client;
        instance.mActivityToken = activityToken;

        return instance;
    }

 /**
     * Schedule the transaction after it was initialized. It will be send to client and all its
     * individual parts will be applied in the following sequence:
     * 1. The client calls {@link #preExecute(ClientTransactionHandler)}, which triggers all work
     *    that needs to be done before actually scheduling the transaction for callbacks and
     *    lifecycle state request.
     * 2. The transaction message is scheduled.
     * 3. The client calls {@link TransactionExecutor#execute(ClientTransaction)}, which executes
     *    all callbacks and necessary lifecycle transitions.
     */
    public void schedule() throws RemoteException {
        mClient.scheduleTransaction(this);
    }

15.ApplicationThread.scheduleTransaction()

// frameworks\base\core\java\android\app\ActivityThread.java

private class ApplicationThread extends IApplicationThread.Stub {
    @Override
    public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        ActivityThread.this.scheduleTransaction(transaction);
    }
}

16.ClientTransactionHandler.scheduleTransaction()

ActivityThread继承于ClientTransactionHandler，有个静态内部类Handler H，用于消息处理。ActivityThread.java类图如下：

// frameworks\base\core\java\android\app\ClientTransactionHandler.java
public abstract class ClientTransactionHandler {
    /** Prepare and schedule transaction for execution. */
    void scheduleTransaction(ClientTransaction transaction) {
        transaction.preExecute(this);
        sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
    }
}
// class ActivityThread
private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);
// class H
public void handleMessage(Message msg) {
    if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
    switch (msg.what) {
        case EXECUTE_TRANSACTION:
            final ClientTransaction transaction = (ClientTransaction) msg.obj;
            mTransactionExecutor.execute(transaction);
            if (isSystem()) {
                // Client transactions inside system process are recycled on the client side
                // instead of ClientLifecycleManager to avoid being cleared before this
                // message is handled.
                transaction.recycle();
            }
            // TODO(lifecycler): Recycle locally scheduled transactions.
            break;
    }
    Object obj = msg.obj;
    if (obj instanceof SomeArgs) {
        ((SomeArgs) obj).recycle();
    }
    if (DEBUG_MESSAGES) Slog.v(TAG, "<<< done: " + codeToString(msg.what));
}

‍
​

17.TransactionExecutor.execute()

 // frameworks\base\core\java\android\app\servertransaction\TransactionExecutor.java 
  /**
     * Resolve transaction.
     * First all callbacks will be executed in the order they appear in the list. If a callback
     * requires a certain pre- or post-execution state, the client will be transitioned accordingly.
     * Then the client will cycle to the final lifecycle state if provided. Otherwise, it will
     * either remain in the initial state, or last state needed by a callback.
     */
    public void execute(ClientTransaction transaction) {
   
        final IBinder token = transaction.getActivityToken();
        if (token != null) {
            final Map<IBinder, ClientTransactionItem> activitiesToBeDestroyed =
                    mTransactionHandler.getActivitiesToBeDestroyed();
            final ClientTransactionItem destroyItem = activitiesToBeDestroyed.get(token);
            if (destroyItem != null) {
                if (transaction.getLifecycleStateRequest() == destroyItem) {
                    // It is going to execute the transaction that will destroy activity with the
                    // token, so the corresponding to-be-destroyed record can be removed.
                    activitiesToBeDestroyed.remove(token);
                }
                if (mTransactionHandler.getActivityClient(token) == null) {
                    // The activity has not been created but has been requested to destroy, so all
                    // transactions for the token are just like being cancelled.
                    return;
                }
            }
        }

        executeCallbacks(transaction);
        executeLifecycleState(transaction);
        mPendingActions.clear();
    }

‍

18.TransactionExecutor.executeCallbacks()

从第12步中，可以得知addCallback为LaunchActivityItem，这个方法是目的创建Activity对象

 // frameworks\base\core\java\android\app\servertransaction\TransactionExecutor.java  
   /** Cycle through all states requested by callbacks and execute them at proper times. */
    @VisibleForTesting
    public void executeCallbacks(ClientTransaction transaction) {
        final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    
        final IBinder token = transaction.getActivityToken();
        ActivityClientRecord r = mTransactionHandler.getActivityClient(token);

        // In case when post-execution state of the last callback matches the final state requested
        // for the activity in this transaction, we won't do the last transition here and do it when
        // moving to final state instead (because it may contain additional parameters from server).
        final ActivityLifecycleItem finalStateRequest = transaction.getLifecycleStateRequest();
        final int finalState = finalStateRequest != null ? finalStateRequest.getTargetState()
                : UNDEFINED;
        // Index of the last callback that requests some post-execution state.
        final int lastCallbackRequestingState = lastCallbackRequestingState(transaction);

        final int size = callbacks.size();
        for (int i = 0; i < size; ++i) {
            final ClientTransactionItem item = callbacks.get(i);
            final int postExecutionState = item.getPostExecutionState();
            final int closestPreExecutionState = mHelper.getClosestPreExecutionState(r,
                    item.getPostExecutionState());
            if (closestPreExecutionState != UNDEFINED) {
                cycleToPath(r, closestPreExecutionState, transaction);
            }

            item.execute(mTransactionHandler, token, mPendingActions);
            item.postExecute(mTransactionHandler, token, mPendingActions);
            if (r == null) {
                // Launch activity request will create an activity record.
                r = mTransactionHandler.getActivityClient(token);
            }

            if (postExecutionState != UNDEFINED && r != null) {
                // Skip the very last transition and perform it by explicit state request instead.
                final boolean shouldExcludeLastTransition =
                        i == lastCallbackRequestingState && finalState == postExecutionState;
                cycleToPath(r, postExecutionState, shouldExcludeLastTransition, transaction);
            }
        }
    }

19.LaunchActivityItem.execute()

调用了ActivityThread的handleLaunchActivity()

// frameworks\base\core\java\android\app\servertransaction\LaunchActivityItem.java
@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
            mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
            mPendingResults, mPendingNewIntents, mActivityOptions, mIsForward, mProfilerInfo,
            client, mAssistToken, mFixedRotationAdjustments, mShareableActivityToken,
            mLaunchedFromBubble);
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
}

@Override
public void postExecute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    client.countLaunchingActivities(-1);
}

20.ActivityThread.handleLaunchActivity

// frameworks\base\core\java\android\app\ActivityThread.java
/**
 * Extended implementation of activity launch. Used when server requests a launch or relaunch.
 */
/**
 * Extended implementation of activity launch. Used when server requests a launch or relaunch.
 */
@Override
public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
    // If we are getting ready to gc after going to the background, well
    // we are back active so skip it.
    unscheduleGcIdler();
    mSomeActivitiesChanged = true;
    if (r.profilerInfo != null) {
        mProfiler.setProfiler(r.profilerInfo);
        mProfiler.startProfiling();
    }
    // Make sure we are running with the most recent config.
    mConfigurationController.handleConfigurationChanged(null, null);
   
    // Initialize before creating the activity
    if (ThreadedRenderer.sRendererEnabled
            && (r.activityInfo.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0) {
        HardwareRenderer.preload();
    }
    WindowManagerGlobal.initialize();
    // Hint the GraphicsEnvironment that an activity is launching on the process.
    GraphicsEnvironment.hintActivityLaunch();
    final Activity a = performLaunchActivity(r, customIntent);
    if (a != null) {
        r.createdConfig = new Configuration(mConfigurationController.getConfiguration());
        reportSizeConfigurations(r);
        if (!r.activity.mFinished && pendingActions != null) {
            pendingActions.setOldState(r.state);
            pendingActions.setRestoreInstanceState(true);
            pendingActions.setCallOnPostCreate(true);
        }
    } else {
        // If there was an error, for any reason, tell the activity manager to stop us.
        ActivityClient.getInstance().finishActivity(r.token, Activity.RESULT_CANCELED,
                null /* resultData */, Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
    }
    return a;
}

21.ActivityThread.performLaunchActivity

这个方法是launchActivity的核心逻辑，可以看到通过mInstrumentation.newActivity()​、mInstrumentation.callActivityOnCreate()​等方法创建了Activity实例和执行了相应的生命周期回调

// frameworks\base\core\java\android\app\ActivityThread.java
/**  Core implementation of activity launch. */
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }
    ComponentName component = r.intent.getComponent();
    if (component == null) {
        component = r.intent.resolveActivity(
            mInitialApplication.getPackageManager());
        r.intent.setComponent(component);
    }
    if (r.activityInfo.targetActivity != null) {
        component = new ComponentName(r.activityInfo.packageName,
                r.activityInfo.targetActivity);
    }
    ContextImpl appContext = createBaseContextForActivity(r);
    Activity activity = null;
    try {
        // 反射创建Activity对象
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
        StrictMode.incrementExpectedActivityCount(activity.getClass());
        r.intent.setExtrasClassLoader(cl);
        r.intent.prepareToEnterProcess(isProtectedComponent(r.activityInfo),
                appContext.getAttributionSource());
        if (r.state != null) {
            r.state.setClassLoader(cl);
        }
    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to instantiate activity " + component
                + ": " + e.toString(), e);
        }
    }
    try {
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);
        // updatePendingActivityConfiguration() reads from mActivities to update
        // ActivityClientRecord which runs in a different thread. Protect modifications to
        // mActivities to avoid race.
        synchronized (mResourcesManager) {
            mActivities.put(r.token, r);
        }
        if (activity != null) {
            CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
            Configuration config =
                    new Configuration(mConfigurationController.getCompatConfiguration());
            if (r.overrideConfig != null) {
                config.updateFrom(r.overrideConfig);
            }
            Window window = null;
            if (r.mPendingRemoveWindow != null && r.mPreserveWindow) {
                window = r.mPendingRemoveWindow;
                r.mPendingRemoveWindow = null;
                r.mPendingRemoveWindowManager = null;
            }
	    // 创建Res资源加载器
            // Activity resources must be initialized with the same loaders as the
            // application context.
            appContext.getResources().addLoaders(
                    app.getResources().getLoaders().toArray(new ResourcesLoader[0]));
            appContext.setOuterContext(activity);
            activity.attach(appContext, this, getInstrumentation(), r.token,
                    r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor, window, r.configCallback,
                    r.assistToken, r.shareableActivityToken);
            if (customIntent != null) {
                activity.mIntent = customIntent;
            }
            r.lastNonConfigurationInstances = null;
            checkAndBlockForNetworkAccess();
            activity.mStartedActivity = false;
            int theme = r.activityInfo.getThemeResource();
            if (theme != 0) {
                activity.setTheme(theme);
            }
            if (r.mActivityOptions != null) {
                activity.mPendingOptions = r.mActivityOptions;
                r.mActivityOptions = null;
            }
            activity.mLaunchedFromBubble = r.mLaunchedFromBubble;
            activity.mCalled = false;
            // 回调onCreate方法
            // Assigning the activity to the record before calling onCreate() allows
            // ActivityThread#getActivity() lookup for the callbacks triggered from
            // ActivityLifecycleCallbacks#onActivityCreated() or
            // ActivityLifecycleCallback#onActivityPostCreated().
            r.activity = activity;
            if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }
            if (!activity.mCalled) {
                throw new SuperNotCalledException(
                    "Activity " + r.intent.getComponent().toShortString() +
                    " did not call through to super.onCreate()");
            }
            mLastReportedWindowingMode.put(activity.getActivityToken(),
                    config.windowConfiguration.getWindowingMode());
        }
        r.setState(ON_CREATE);
    } catch (SuperNotCalledException e) {
        throw e;
    } catch (Exception e) {
        if (!mInstrumentation.onException(activity, e)) {
            throw new RuntimeException(
                "Unable to start activity " + component
                + ": " + e.toString(), e);
        }
    }
    return activity;
}

22.Instrumentation.newActivity

// frameworks\base\core\java\android\app\Instrumentation.java
/**
 * Perform instantiation of the process's {@link Activity} object.  The
 * default implementation provides the normal system behavior.
 * 
 * @param cl The ClassLoader with which to instantiate the object.
 * @param className The name of the class implementing the Activity
 *                  object.
 * @param intent The Intent object that specified the activity class being
 *               instantiated.
 * 
 * @return The newly instantiated Activity object.
 */
public Activity newActivity(ClassLoader cl, String className,
        Intent intent)
        throws InstantiationException, IllegalAccessException,
        ClassNotFoundException {
    String pkg = intent != null && intent.getComponent() != null
            ? intent.getComponent().getPackageName() : null;
    return getFactory(pkg).instantiateActivity(cl, className, intent);
}

// Instrumentation在ActivityThread中创建，可以发现mThread!=null
private AppComponentFactory getFactory(String pkg) {
    if (pkg == null) {
        Log.e(TAG, "No pkg specified, disabling AppComponentFactory");
        return AppComponentFactory.DEFAULT;
    }
    if (mThread == null) {
        Log.e(TAG, "Uninitialized ActivityThread, likely app-created Instrumentation,"
                + " disabling AppComponentFactory", new Throwable());
        return AppComponentFactory.DEFAULT;
    }
    LoadedApk apk = mThread.peekPackageInfo(pkg, true);
    // This is in the case of starting up "android".
    if (apk == null) apk = mThread.getSystemContext().mPackageInfo;
    return apk.getAppFactory();
}

23.AppComponentFactory.instantiateActivity

直接反射创建了Activity对象

// frameworks\base\core\java\android\app\AppComponentFactory.java
public @NonNull Activity instantiateActivity(@NonNull ClassLoader cl, @NonNull String className,
            @Nullable Intent intent)
            throws InstantiationException, IllegalAccessException, ClassNotFoundException {
   return (Activity) cl.loadClass(className).newInstance();
}

24.Activity.attach

// frameworks\base\core\java\android\app\Activity.java
final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor,
        Window window, ActivityConfigCallback activityConfigCallback, IBinder assistToken,
        IBinder shareableActivityToken) {
    attachBaseContext(context);
    mFragments.attachHost(null /*parent*/);
    mWindow = new PhoneWindow(this, window, activityConfigCallback);
    mWindow.setWindowControllerCallback(mWindowControllerCallback);
    mWindow.setCallback(this);
    mWindow.setOnWindowDismissedCallback(this);
    mWindow.getLayoutInflater().setPrivateFactory(this);
    if (info.softInputMode != WindowManager.LayoutParams.SOFT_INPUT_STATE_UNSPECIFIED) {
        mWindow.setSoftInputMode(info.softInputMode);
    }
    if (info.uiOptions != 0) {
        mWindow.setUiOptions(info.uiOptions);
    }
    mUiThread = Thread.currentThread();
    mMainThread = aThread;
    mInstrumentation = instr;
    mToken = token;
    mAssistToken = assistToken;
    mShareableActivityToken = shareableActivityToken;
    mIdent = ident;
    mApplication = application;
    mIntent = intent;
    mReferrer = referrer;
    mComponent = intent.getComponent();
    mActivityInfo = info;
    mTitle = title;
    mParent = parent;
    mEmbeddedID = id;
    mLastNonConfigurationInstances = lastNonConfigurationInstances;
    if (voiceInteractor != null) {
        if (lastNonConfigurationInstances != null) {
            mVoiceInteractor = lastNonConfigurationInstances.voiceInteractor;
        } else {
            mVoiceInteractor = new VoiceInteractor(voiceInteractor, this, this,
                    Looper.myLooper());
        }
    }
    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
    if (mParent != null) {
        mWindow.setContainer(mParent.getWindow());
    }
    mWindowManager = mWindow.getWindowManager();
    mCurrentConfig = config;
    mWindow.setColorMode(info.colorMode);
    mWindow.setPreferMinimalPostProcessing(
            (info.flags & ActivityInfo.FLAG_PREFER_MINIMAL_POST_PROCESSING) != 0);
    getAutofillClientController().onActivityAttached(application);
    setContentCaptureOptions(application.getContentCaptureOptions());
}

25.Instrumentation.callActivityOnCreate

这里就回调了Activity.OnCreate

// frameworks\base\core\java\android\app\Instrumentation.java
/**
 * Perform calling of an activity's {@link Activity#onCreate}
 * method.  The default implementation simply calls through to that method.
 *
 * @param activity The activity being created.
 * @param icicle The previously frozen state (or null) to pass through to onCreate().
 */
public void callActivityOnCreate(Activity activity, Bundle icicle) {
    prePerformCreate(activity);
    activity.performCreate(icicle);
    postPerformCreate(activity);
}
// frameworks\base\core\java\android\app\Activity.java
final void performCreate(Bundle icicle, PersistableBundle persistentState) {
    if (Trace.isTagEnabled(Trace.TRACE_TAG_WINDOW_MANAGER)) {
        Trace.traceBegin(Trace.TRACE_TAG_WINDOW_MANAGER, "performCreate:"
                + mComponent.getClassName());
    }
    dispatchActivityPreCreated(icicle);
    mCanEnterPictureInPicture = true;
    // initialize mIsInMultiWindowMode and mIsInPictureInPictureMode before onCreate
    final int windowingMode = getResources().getConfiguration().windowConfiguration
            .getWindowingMode();
    mIsInMultiWindowMode = inMultiWindowMode(windowingMode);
    mIsInPictureInPictureMode = windowingMode == WINDOWING_MODE_PINNED;
    mShouldDockBigOverlays = getResources().getBoolean(R.bool.config_dockBigOverlayWindows);
    restoreHasCurrentPermissionRequest(icicle);
    if (persistentState != null) {
        onCreate(icicle, persistentState);
    } else {
        onCreate(icicle);
    }
    EventLogTags.writeWmOnCreateCalled(mIdent, getComponentName().getClassName(),
            "performCreate");
    mActivityTransitionState.readState(icicle);

    mVisibleFromClient = !mWindow.getWindowStyle().getBoolean(
            com.android.internal.R.styleable.Window_windowNoDisplay, false);
    mFragments.dispatchActivityCreated();
    mActivityTransitionState.setEnterActivityOptions(this, getActivityOptions());
    dispatchActivityPostCreated(icicle);
    Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);
}

‍