5. Android FrameWork之安卓14Activity启动流程 万字长文：从点击图标到Activity.onCreate()的每一行代码

1.Activity的热启动流程

startActivityForResult()
  Instrumentation----> execStartActivity() 检查xml中activity是否注册了?
                    ATMS---->startActivity() 
                        ActivityStarter------startActivityMayWait()
                            ActivityStack------resumeTopActivityUncheckedLocked() 管理堆栈,历史记录
                                ActivityStackSupervisor--->realStartActivityLocked   是否创建了进程
                                  ApplicationThread--------->scheduleTransaction()      切换到了客户端
                                     ActivityThread--------->scheduleTransaction()      切换线程,发送handler消息
                                          ActivityThread---> handleLaunchActivity ---最终结果
                                             ActivityThread---> performLaunchActivity ---反射创建activity
    
    

清单文件的校验过程：

• 最终抛出熟悉的异常：ActivityNotFoundException: Unable to find explicit activity class; have you declared this activity in your AndroidManifest.xml? 客户端校验：

// frameworks/base/core/java/android/app/Instrumentation.java
public static void checkStartActivityResult(int res, Object intent) {
    switch (res) {
        case ActivityManager.START_INTENT_NOT_RESOLVED:
        case ActivityManager.START_CLASS_NOT_FOUND:
            // 这里抛出的异常就是常见的"找不到Activity"错误
            throw new ActivityNotFoundException(
                "Unable to find explicit activity class " + intent +
                "; have you declared this activity in your AndroidManifest.xml?");
        case ActivityManager.START_PERMISSION_DENIED:
            throw new SecurityException("Not allowed to start activity " + intent);
        // ... 其他错误码处理
    }
}

服务端校验： execStartActivity() 的核心代码

// frameworks/base/core/java/android/app/Instrumentation.java
public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token,
        Activity target, Intent intent, int requestCode, Bundle options) {
    // 1. 获取IApplicationThread，代表客户端进程
    IApplicationThread appThread = (IApplicationThread) contextThread;
    
    // 2. 获取ActivityTaskManagerService的Binder代理
    IActivityTaskManager atm = ActivityTaskManager.getService();
    
    try {
        // 3. 关键调用：通过Binder IPC将启动请求发送到系统进程的ATMS
        int result = atm.startActivity(appThread, who.getBasePackageName(), intent,
                intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
                
        // 4. 检查启动结果（这里会进行初步的异常转换）
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

2.Activity的冷启动流程

2.1 启动流程源码分析

// 冷启动完整流程序列
Launcher.startActivity() 
    → Instrumentation.execStartActivity()
        → ActivityTaskManager.getService().startActivity() // IPC到ATMS
            → ActivityTaskManagerService.startActivity()
                → ActivityStarter.execute() 
                    → ActivityStarter.startActivityUnchecked()
                        → RootActivityContainer.resumeFocusedStacksTopActivities()
                            → ActivityStack.resumeTopActivityUncheckedLocked()
                                → ActivityStackSupervisor.startSpecificActivityLocked()
                                    → ActivityManagerService.startProcessAsync() // 如果进程不存在
                                        → ProcessList.startProcessLocked()
                                            → Process.start() // 请求Zygote fork进程
                                                → ZygoteProcess.start() // 通过socket与Zygote通信
                                                    → Zygote.forkAndSpecialize() // fork新进程
                                        ↓
                                        // 新进程入口
                                        → ActivityThread.main() // 新进程主入口
                                            → ActivityThread.attach()
                                                → ActivityManagerService.attachApplication() // IPC回AMS
                                                    → ActiveServices.attachApplicationLocked()
                                                    → ActivityStackSupervisor.attachApplicationLocked()
                                                        → RealStartActivityLocked()
                                                            → ApplicationThread.scheduleLaunchActivity() // IPC到应用进程
                                        ↓
                                        // 回到应用进程
                                        → ApplicationThread.scheduleLaunchActivity()
                                            → ActivityThread.sendMessage(H.LAUNCH_ACTIVITY)
                                        ↓
                                        // Handler处理消息
                                        → ActivityThread.H.handleMessage(LAUNCH_ACTIVITY)
                                            → ActivityThread.handleLaunchActivity()
                                                → Instrumentation.newActivity()
                                                → Instrumentation.callActivityOnCreate()
                                        ↓
                                        → ActivityThread.H.handleMessage(RESUME_ACTIVITY)
                                            → ActivityThread.handleResumeActivity()
                                                → WindowManagerGlobal.addView()
                                                    → WindowManagerService.addWindow() // IPC到WMS

2.1.1 进程创建流程 (AMS → Zygote)

// frameworks/base/services/core/java/com/android/server/am/ProcessList.java
public class ProcessList {
    final ProcessStartResult startResult = Process.start(entryPoint,
        app.processName, uid, uid, gids, runtimeFlags, mountExternal,
        app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
        app.info.dataDir, invokeWith, entryPointArgs);
}

// frameworks/base/core/java/android/os/Process.java
public static final ProcessStartResult start(final String processClass,
                                  final String niceName,
                                  int uid, int gid, int[] gids,
                                  int runtimeFlags, int mountExternal,
                                  int targetSdkVersion, String seInfo,
                                  String abi, String instructionSet,
                                  String appDataDir, String invokeWith,
                                  String[] zygoteArgs) {
    return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

// frameworks/base/core/java/android/os/ZygoteProcess.java
public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              // ... 参数) {
    return startViaZygote(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, false /* startChildZygote */,
            zygoteArgs);
}

private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  // ... 参数) {
    // 通过socket与Zygote进程通信
    return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}

2.1.2. 新进程初始化 (ActivityThread.main())

// frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
    // 初始化主线程Looper - 这是Handler机制的核心
    Looper.prepareMainLooper();
    
    // 创建ActivityThread实例
    ActivityThread thread = new ActivityThread();
    
    // 关联到系统服务
    thread.attach(false);
    
    // 创建主线程Handler
    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }
    
    // 启动消息循环 - 进入无限循环处理消息
    Looper.loop();
    
    throw new RuntimeException("Main thread loop unexpectedly exited");
}

private void attach(boolean system) {
    // 获取AMS的Binder代理
    final IActivityManager mgr = ActivityManager.getService();
    try {
        // 向AMS注册应用进程，传入ApplicationThread Binder对象
        mgr.attachApplication(mAppThread);
    } catch (RemoteException ex) {
        throw ex.rethrowFromSystemServer();
    }
}

2.1.3. Handler机制在启动过程中的作用

// frameworks/base/core/java/android/app/ActivityThread.java
// 内部Handler类 - 负责将Binder线程的请求切换到主线程执行
class H extends Handler {
    public static final int LAUNCH_ACTIVITY = 100;
    public static final int RESUME_ACTIVITY = 107;
    public static final int BIND_APPLICATION = 110;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BIND_APPLICATION:
                // 处理应用绑定
                AppBindData data = (AppBindData)msg.obj;
                handleBindApplication(data);
                break;
                
            case LAUNCH_ACTIVITY:
                // 处理Activity启动
                ActivityClientRecord r = (ActivityClientRecord)msg.obj;
                handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");
                break;
                
            case RESUME_ACTIVITY:
                // 处理Activity恢复
                handleResumeActivity((IBinder)msg.obj, true, msg.arg1 != 0, true);
                break;
        }
    }
}

// ApplicationThread - Binder stub实现，运行在Binder线程池中
private class ApplicationThread extends IApplicationThread.Stub {
    public final void scheduleLaunchActivity(Intent intent, IBinder token, 
            int ident, ActivityInfo info, Configuration curConfig, 
            CompatibilityInfo compatInfo, int procState, Bundle state, 
            PersistableBundle persistentState, List<ResultInfo> pendingResults, 
            List<Intent> pendingNewIntents, boolean notResumed, 
            boolean isForward, ProfilerInfo profilerInfo) {
        // 创建ActivityClientRecord
        ActivityClientRecord r = new ActivityClientRecord();
        // ... 填充数据
        
        // 发送消息到主线程Handler - 这是线程切换的关键！
        sendMessage(H.LAUNCH_ACTIVITY, r);
    }
    
    public final void scheduleBindApplication(String processName,
            ApplicationInfo appInfo, List<ProviderInfo> providers,
            ComponentName testName, ProfilerInfo profilerInfo, Bundle testArgs,
            IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,
            int debugMode, boolean enableOpenGlTrace, boolean isRestrictedBackupMode,
            boolean persistent, Configuration config, CompatibilityInfo compatInfo,
            Map services, Bundle coreSettings) {
        // 创建绑定数据
        AppBindData data = new AppBindData();
        // ... 填充数据
        
        // 发送消息到主线程Handler
        sendMessage(H.BIND_APPLICATION, data);
    }
    
    // 发送消息到主线程的辅助方法
    private void sendMessage(int what, Object obj) {
        sendMessage(what, obj, 0, 0, false);
    }
    
    private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        // 通过Handler发送到主线程消息队列
        mH.sendMessage(msg);
    }
}

2.1.4. 应用进程初始化处理

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 1. 设置进程名
    Process.setArgV0(data.processName);
    
    // 2. 创建Application对象
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    
    // 3. 安装ContentProviders - 先于Application.onCreate()执行！
    if (!data.restrictedBackupMode) {
        List<ProviderInfo> providers = data.providers;
        if (providers != null) {
            installContentProviders(app, providers);
        }
    }
    
    // 4. 调用Application.onCreate()
    mInstrumentation.callApplicationOnCreate(app);
}

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent, String reason) {
    // 1. 创建Activity实例
    Activity activity = performLaunchActivity(r, customIntent);
    
    if (activity != null) {
        // 2. 处理onCreate生命周期
        handleResumeActivity(r.token, false, r.isForward, !r.activity.mFinished);
    }
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // 1. 通过Instrumentation创建Activity实例
    Activity activity = mInstrumentation.newActivity(
        cl, component.getClassName(), r.intent);
    
    // 2. 创建Application对象（如果尚未创建）
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    
    // 3. 关联Context和Activity
    activity.attach(appContext, this, getInstrumentation(), r.token,
        r.ident, app, r.intent, r.activityInfo, title, r.parent,
        r.embeddedID, r.lastNonConfigurationInstances, config,
        r.referrer, r.voiceInteractor, window, r.configCallback);
    
    // 4. 调用Activity.onCreate()
    if (r.isPersistable()) {
        mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
    } else {
        mInstrumentation.callActivityOnCreate(activity, r.state);
    }
    
    return activity;
}

2.1.5. Window管理及界面显示

// frameworks/base/core/java/android/app/ActivityThread.java
final void handleResumeActivity(IBinder token, boolean clearHide, boolean isForward, 
        boolean reallyResume) {
    // 1. 调用Activity.onResume()
    ActivityClientRecord r = performResumeActivity(token, clearHide);
    
    if (r != null) {
        final Activity a = r.activity;
        if (r.window == null && !a.mFinished && willBeVisible) {
            // 2. 获取Window
            r.window = r.activity.getWindow();
            View decor = r.window.getDecorView();
            decor.setVisibility(View.INVISIBLE);
            
            // 3. 获取ViewManager（通常是WindowManager）
            ViewManager wm = a.getWindowManager();
            WindowManager.LayoutParams l = r.window.getAttributes();
            
            // 4. 添加View到WindowManager - 这会触发WMS调用
            wm.addView(decor, l);
            
            // 5. 设置View可见
            decor.setVisibility(View.VISIBLE);
        }
    }
}

2.2 启动流程的核心类

在启动流程中，有几个关键角色2：

• Zygote：进程孵化器，预加载常用类和资源，加速进程创建。
• ActivityManagerService (AMS) ：Android 系统核心服务，全局管理 Activity、任务栈和进程。
• ActivityThread：应用主线程的核心类，管理应用组件（Activity、Service等）的生命周期12。
• ApplicationThread：AMS 用于与应用进程通信的 Binder 桥梁，AMS 通过它控制应用进程28。
• Instrumentation：监控和控制组件生命周期的工具类，负责创建 Activity 和调用生命周期方法

系统服务端核心类

类名	所在进程	主要职责	关键方法
ActivityTaskManagerService (ATMS)	System Server	Activity和任务栈的管理，处理startActivity请求	startActivity(), startActivityAsUser()
ActivityManagerService (AMS)	System Server	进程管理和组件生命周期调度，与ATMS协同工作	attachApplication(), startProcessLocked()
PackageManagerService (PMS)	System Server	包管理，解析APK和AndroidManifest.xml，组件查询	resolveIntent(), getActivityInfo()
WindowManagerService (WMS)	System Server	窗口管理，界面绘制和输入事件分发	addWindow(), relayoutWindow()
ActivityStarter	System Server	Activity启动策略处理，权限和逻辑校验	executeRequest(), startActivityUnchecked()
ActivityStack	System Server	Activity回退栈管理，生命周期状态维护	resumeTopActivityUncheckedLocked()
ActivityStackSupervisor	System Server	多栈协同管理，启动特定Activity	startSpecificActivityLocked(), attachApplicationLocked()
ProcessList	System Server	进程管理，与Zygote通信创建新进程	startProcessLocked()

应用进程端核心类

类名	所在进程	主要职责	关键方法
ActivityThread	App	应用主线程管理器，Android应用的入口点	main(), attach(), handleLaunchActivity()
ApplicationThread	App	AMS与应用进程通信的Binder桥梁	scheduleLaunchActivity(), scheduleBindApplication()
Instrumentation	App	监控应用与系统交互，负责生命周期方法调用	newActivity(), callActivityOnCreate()
H (Handler)	App	主线程消息处理，将Binder线程请求切换到主线程	handleMessage(), sendMessage()
TransactionExecutor	App	执行AMS发送的生命周期事务	execute(), executeCallbacks()
Activity	App	用户交互的组件，生命周期由系统管理	onCreate(), onStart(), onResume()
Application	App	应用全局对象，维护应用级的状态和资源	onCreate(), onConfigurationChanged()

进程间通信相关类

类名	所在进程	主要职责	接口类型
IApplicationThread	System/App	AMS控制应用进程的Binder接口	AIDL Interface
IActivityTaskManager	System/App	应用进程调用ATMS的Binder接口	AIDL Interface
IActivityManager	System/App	应用进程调用AMS的Binder接口	AIDL Interface
IWindowManager	System/App	应用进程调用WMS的Binder接口	AIDL Interface

Zygote相关类

类名	所在进程	主要职责	关键方法
ZygoteProcess	System Server	与Zygote进程通信，请求fork新进程	start(), startViaZygote()
Zygote	Zygote	Android进程孵化器，fork新应用进程	forkAndSpecialize()

各类在启动流程中的分工

1. 决策与调度层 (ATMS/AMS)：负责启动决策、权限校验、进程管理
2. 信息提供层 (PMS)：提供组件信息和Intent解析服务
3. 进程孵化层 (Zygote)：负责创建新应用进程
4. 通信桥梁层 (ApplicationThread)：连接系统服务和应用进程
5. 线程调度层 (Handler)：负责B线程到主线程的切换
6. 生命周期执行层 (Instrumentation)：实际执行生命周期方法调用
7. 界面展示层 (WMS/Activity)：管理窗口显示和用户交互

2.3.启动中的AMS, PMS, WMS的交互是怎么样的

交互流程 ：Launcher -> (ATMS/AMS) -> PMS -> (ATMS/AMS) -> (Zygote) -> App进程 -> (ATMS/AMS) -> WMS

AMS、PMS、WMS在Activity启动过程中的作用对比

阶段	AMS (ActivityManagerService)	PMS (PackageManagerService)	WMS (WindowManagerService)
启动前期准备	接收startActivity请求，初始化启动流程	提供APK路径、资源路径等应用基本信息	-
Intent解析	委托PMS解析Intent，获取目标组件信息	核心作用 ：解析Intent，查询匹配的Activity，返回ActivityInfo（包含launchMode、permission等清单信息）	-
权限校验	核心作用：检查调用者权限、进程权限、跨用户权限等	提供权限定义和权限状态查询支持	-
进程管理	核心作用 ：检查目标进程是否存在，不存在则请求Zygote创建新进程，维护进程记录(ProcessRecord)	-	-
应用初始化	通过Binder调用应用进程的bindApplication()，调度Application创建	提供ApplicationInfo、ProviderInfo等应用组件信息	-
Activity创建	通过Binder调用应用进程的scheduleLaunchActivity()，调度Activity生命周期	-	-
窗口准备	通知WMS准备Activity切换动画和起始窗口	-	核心作用：准备AppTransition动画，创建并显示StartingWindow（启动预览窗口）
窗口创建	-	-	核心作用 ：接收addView()请求，创建WindowState，分配SurfaceControl，管理窗口层级
界面绘制	-	-	核心作用 ：管理Surface，处理布局(performLayout)、测量(measure)、绘制(draw)流程，合成图层
输入准备	-	-	核心作用 ：创建InputChannel，设置输入事件路由，准备接收用户输入
生命周期同步	核心作用：维护Activity状态机，调度生命周期回调，处理状态同步	-	同步窗口可见性与Activity状态（如onPause时隐藏窗口）
错误处理	核心作用：处理权限拒绝、组件未找到、进程启动失败等错误	提供组件存在性验证支持	处理窗口创建失败、Surface分配失败等问题
跨进程协调	核心作用：作为系统服务与应用进程间的协调中心，管理所有Binder通信	提供组件查询接口供AMS调用	提供窗口管理接口供应用进程调用

2.3.1 AMS

1. 启动请求接收与处理

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub {
    @Override
    public int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho,
            int requestCode, int flags, ProfilerInfo profilerInfo, Bundle options) {
        return mActivityTaskManager.startActivity(caller, callingPackage, intent,
                resolvedType, resultTo, resultWho, requestCode, flags, profilerInfo, options);
    }
}

虽然ATMS接管了大部分Activity启动逻辑，但AMS仍然负责进程管理相关的工作。

2. 进程检查与创建

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
class ActivityStackSupervisor {
    void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // 检查进程是否已存在
        final ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);
        
        if (app != null && app.thread != null) {
            // 进程已存在，直接启动Activity
            try {
                realStartActivityLocked(r, app, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                // 处理异常
            }
        }
        
        // 进程不存在，需要创建新进程
        mService.startProcessLocked(r.processName, r.info.applicationInfo,
                true, 0, "activity", r.intent.getComponent(), false, false, true);
    }
}

3. 进程创建核心方法

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
        boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
        boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
        String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
    
    // 获取或创建ProcessRecord
    ProcessRecord app = getProcessRecordLocked(processName, info.uid, true);
    
    if (app == null) {
        // 创建新的ProcessRecord
        app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
        mProcessNames.put(processName, app.uid, app);
        updateLruProcessLocked(app, false, null);
    }
    
    // 启动进程
    startProcessLocked(app, hostingType, hostingName, abiOverride, entryPoint, entryPointArgs);
    
    return app;
}

private void startProcessLocked(ProcessRecord app, String hostingType,
        ComponentName hostingName, String abiOverride, String entryPoint, String[] entryPointArgs) {
    
    // 准备启动参数
    final String entryPointStr = (entryPoint != null) ? entryPoint : "android.app.ActivityThread";
    
    // 请求Zygote创建进程
    Process.ProcessStartResult startResult = Process.start(entryPointStr,
            app.processName, uid, uid, gids, runtimeFlags, mountExternal,
            app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
            app.info.dataDir, invokeWith, entryPointArgs);
    
    // 更新进程记录
    synchronized (mPidsSelfLocked) {
        this.mPidsSelfLocked.put(startResult.pid, app);
        app.setPid(startResult.pid);
        app.usingWrapper = startResult.usingWrapper;
        app.removed = false;
    }
    
    // 设置进程启动超时监控
    Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
    msg.obj = app;
    mHandler.sendMessageDelayed(msg, startResult.usingWrapper
            ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
}

4. 应用进程注册处理

当新进程创建完成后，会调用AMS的attachApplication方法进行注册：

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
@Override
public final void attachApplication(IApplicationThread thread) {
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        final long origId = Binder.clearCallingIdentity();
        try {
            // 处理应用进程注册
            attachApplicationLocked(thread, callingPid);
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
    }
}

private boolean attachApplicationLocked(IApplicationThread thread, int pid) {
    // 根据pid查找ProcessRecord
    ProcessRecord app = findProcessLocked(pid);
    if (app == null) {
        return false;
    }
    
    // 绑定ApplicationThread到进程记录
    app.makeActive(thread, mProcessStats);
    app.isolatedEntryPoint = null;
    app.isolatedEntryPointArgs = null;
    
    // 检查应用是否处于待启动状态
    if (mPendingStartActivityUids.get(app.uid) > 0 || 
        normalMode && mProcessesOnHold.contains(app)) {
        // 应用需要等待
        return true;
    }
    
    // 发送绑定应用请求
    try {
        // 准备绑定数据
        List<ProviderInfo> providers = null;
        if (app.isolatedEntryPoint == null) {
            providers = generateApplicationProvidersLocked(app);
        }
        
        // 检查应用调试状态
        if (app.isDebugging() && mDebugApp != null && !app.processName.equals(mDebugApp)) {
            // 调试处理
        }
        
        // 调用应用进程的bindApplication方法
        thread.bindApplication(processName, appInfo, providers,
                app.instrumentationClass, profilerInfo, app.instrumentationArguments,
                app.instrumentationWatcher, app.instrumentationUiAutomationConnection,
                testMode, enableOpenGlTrace, isRestrictedBackupMode || !normalMode,
                app.isPersistent(), new Configuration(mConfiguration),
                app.compat, getCommonServicesLocked(app.isolated),
                mCoreSettingsObserver.getCoreSettingsLocked());
                
    } catch (Exception e) {
        // 异常处理
        app.resetPackageList(mProcessStats);
        startProcessLocked(app, "bind fail", processName);
        return false;
    }
    
    // 更新进程状态
    updateProcessForegroundLocked(app, false, 0);
    app.setPendingStart(false);
    app.setDebugging(false);
    
    // 检查是否有待启动的Activity
    if (normalMode) {
        try {
            // 调度待启动的Activity
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            // 异常处理
            badApp = true;
        }
    }
    
    return true;
}

5. Activity调度与启动

// frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
boolean attachApplicationLocked(ProcessRecord app) {
    boolean didSomething = false;
    for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; displayNdx--) {
        final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
        for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; stackNdx--) {
            final ActivityStack stack = display.getChildAt(stackNdx);
            // 尝试恢复栈顶Activity
            if (stack.getVisibility(null) == STACK_VISIBILITY_VISIBLE) {
                didSomething |= stack.attachApplicationLocked(app);
            }
        }
    }
    return didSomething;
}

// frameworks/base/services/core/java/com/android/server/am/ActivityStack.java
boolean attachApplicationLocked(ProcessRecord app) {
    final ActivityRecord top = topRunningActivityLocked();
    if (top != null && top.app == null && app.uid == top.appInfo.uid
            && top.processName.equals(app.processName)) {
        try {
            // 真正启动Activity
            realStartActivityLocked(top, app, true, true);
            return true;
        } catch (RemoteException e) {
            // 异常处理
        }
    }
    return false;
}

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
    
    // 设置启动时间
    r.setLaunchTime(System.currentTimeMillis());
    
    // 更新进程状态
    app.setWaitingToKill(null);
    app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_TOP);
    
    // 创建Activity启动事务
    final ClientTransaction clientTransaction = ClientTransaction.obtain(
            app.thread, r.appToken);
    
    // 添加LaunchActivityItem到事务
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
            System.identityHashCode(r), r.info,
            mergedConfiguration.getGlobalConfiguration(),
            mergedConfiguration.getOverrideConfiguration(), r.compat,
            r.launchedFromPackage, task.voiceInteractor, app.repProcState,
            r.icicle, r.persistentState, results, newIntents,
            app.isNextTransitionForward(), profilerInfo));
    
    // 设置最终的生命周期状态
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) {
        lifecycleItem = ResumeActivityItem.obtain(false /* isForward */);
    } else {
        lifecycleItem = PauseActivityItem.obtain();
    }
    clientTransaction.setLifecycleStateRequest(lifecycleItem);
    
    // 调度事务执行
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    
    // 更新统计信息
    if (andResume) {
        app.getCurAdjTime();
        app.setRecentActivityTime(r.lastLaunchTime);
        mService.updateOomAdjLocked(app, true);
    }
    
    return true;
}

2.3.2 WMS

WMS在冷启动中的核心职责

WindowManagerService（WMS）在冷启动过程中主要负责窗口管理、界面绘制和输入事件处理，确保Activity能够正确显示并与用户交互。

源码分析调用链

2.3.2.1. 启动窗口（Starting Window）创建

// frameworks/base/services/core/java/com/android/server/wm/ActivityRecord.java
void showStartingWindow(ActivityRecord prev, boolean newTask, boolean taskSwitch) {
    if (mStartingWindowState != STARTING_WINDOW_STATE_NOT_SHOWN) {
        return;
    }
    
    // 请求WMS添加启动窗口
    mTaskSupervisor.mService.mWindowManager.setAppStartingWindow(
        this, packageName, theme, compatInfo, nonLocalizedLabel, 
        labelRes, icon, logo, windowFlags, overrideConfig, 
        !newTask, taskSwitch, displayId);
}

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
public void setAppStartingWindow(IBinder appToken, String packageName, int theme,
        CompatibilityInfo compatInfo, CharSequence nonLocalizedLabel, int labelRes, 
        int icon, int logo, int windowFlags, Configuration overrideConfig, 
        boolean processRunning, boolean allowTaskSnapshot, int displayId) {
    
    synchronized (mWindowMap) {
        // 查找对应的AppWindowToken
        AppWindowToken atoken = mRoot.getAppWindowToken(appToken);
        if (atoken == null) {
            return;
        }
        
        // 创建启动窗口数据
        StartingData startingData = new StartingData(packageName, theme, compatInfo,
                nonLocalizedLabel, labelRes, icon, logo, windowFlags, overrideConfig);
        
        // 发送消息到Handler处理
        mH.sendMessage(mH.obtainMessage(H.ADD_STARTING, atoken, startingData));
    }
}

2.3.2.2. 启动窗口处理Handler

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
private final class H extends Handler {
    public static final int ADD_STARTING = 10;
    public static final int REMOVE_STARTING = 11;
    
    @Override
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case ADD_STARTING:
                addStartingWindow((AppWindowToken)msg.obj, (StartingData)msg.obj);
                break;
            case REMOVE_STARTING:
                removeStartingWindow((AppWindowToken)msg.obj, (WindowState)msg.obj);
                break;
        }
    }
}

private void addStartingWindow(AppWindowToken atoken, StartingData sd) {
    try {
        // 创建启动窗口的View
        View view = sd.createStartingWindow(atoken.token, mContext);
        
        if (view != null) {
            // 创建窗口布局参数
            WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
                LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT,
                WindowManager.LayoutParams.TYPE_APPLICATION_STARTING,
                WindowManager.LayoutParams.FLAG_HARDWARE_ACCELERATED,
                PixelFormat.OPAQUE);
            
            lp.setTitle("Starting " + sd.pkg);
            lp.privateFlags |= WindowManager.LayoutParams.PRIVATE_FLAG_FAKE_HARDWARE_ACCELERATED;
            lp.layoutInDisplayCutoutMode = LAYOUT_IN_DISPLAY_CUTOUT_MODE_ALWAYS;
            
            // 添加窗口到WMS
            addWindow(view, lp, atoken);
            
            // 记录启动窗口
            atoken.startingData = sd;
            atoken.startingWindow = view;
            atoken.startingSurface = view.getWindowToken();
        }
    } catch (Exception e) {
        // 异常处理
    }
}

2.3.2.3. 应用主窗口创建

当Activity调用setContentView()时，会通过WindowManager添加主窗口：

// frameworks/base/core/java/android/view/WindowManagerGlobal.java
public void addView(View view, ViewGroup.LayoutParams params,
        Display display, Window parentWindow) {
    
    // 创建ViewRootImpl
    ViewRootImpl root = new ViewRootImpl(view.getContext(), display);
    
    view.setLayoutParams(wparams);
    
    mViews.add(view);
    mRoots.add(root);
    mParams.add(wparams);
    
    // 通过ViewRootImpl添加窗口到WMS
    try {
        root.setView(view, wparams, panelParentView);
    } catch (RuntimeException e) {
        // 异常处理
    }
}

// frameworks/base/core/java/android/view/ViewRootImpl.java
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
    synchronized (this) {
        if (mView == null) {
            mView = view;
            
            // 请求布局
            requestLayout();
            
            // 通过WindowSession添加窗口到WMS
            try {
                mOrigWindowType = attrs.type;
                mAttachInfo.mRecomputeGlobalAttributes = true;
                collectViewAttributes();
                res = mWindowSession.addToDisplay(mWindow, mSeq, attrs,
                        View.VISIBLE, getContext().getDisplayId(), mTmpFrame,
                        mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
                        mAttachInfo.mOutsets, mAttachInfo.mDisplayCutout, mInputChannel);
            } catch (RemoteException e) {
                // 异常处理
            }
        }
    }
}

2.3.2.4. WMS处理窗口添加请求

// frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
public int addWindow(Session session, IWindow client, int seq,
        WindowManager.LayoutParams attrs, int viewVisibility, int displayId,
        Rect outFrame, Rect outContentInsets, Rect outStableInsets, Rect outOutsets,
        DisplayCutout.ParcelableWrapper outDisplayCutout, InputChannel outInputChannel) {
    
    synchronized (mWindowMap) {
        // 1. 权限检查
        int res = mPolicy.checkAddPermission(attrs, appOp, callingPid, callingUid);
        if (res != WindowManagerGlobal.ADD_OKAY) {
            return res;
        }
        
        // 2. 查找或创建WindowToken
        WindowToken token = getWindowToken(attrs.token);
        if (token == null) {
            if (attrs.type >= FIRST_APPLICATION_WINDOW && attrs.type <= LAST_APPLICATION_WINDOW) {
                // 应用窗口必须有有效的WindowToken
                return WindowManagerGlobal.ADD_BAD_APP_TOKEN;
            }
            // 创建新的WindowToken
            token = new WindowToken(this, attrs.token, -1, false);
            mTokenMap.put(attrs.token, token);
        }
        
        // 3. 创建WindowState
        WindowState win = new WindowState(this, session, client, token,
                attachedWindow, appOp[0], seq, attrs, viewVisibility, session.mUid,
                session.mCanAddInternalSystemWindow);
        
        // 4. 为窗口分配SurfaceControl
        win.createSurfaceControl();
        
        // 5. 添加到窗口列表
        mWindowMap.put(client.asBinder(), win);
        
        // 6. 创建InputChannel用于输入事件
        if (outInputChannel != null && (attrs.inputFeatures
                & WindowManager.LayoutParams.INPUT_FEATURE_NO_INPUT_CHANNEL) == 0) {
            String inputChannelName = win.makeInputChannelName();
            InputChannel[] inputChannels = InputChannel.openInputChannelPair(inputChannelName);
            win.setInputChannel(inputChannels[0]);
            inputChannels[1].copyTo(outInputChannel);
            inputChannels[1].dispose();
            
            // 注册输入通道
            mInputManager.registerInputChannel(win.mInputChannel, win.getInputDisplayId());
        }
        
        // 7. 更新窗口层级
        win.getParent().assignChildLayers();
        
        return WindowManagerGlobal.ADD_OKAY;
    }
}

2.3.2.5. Surface创建与管理

// frameworks/base/services/core/java/com/android/server/wm/WindowState.java
void createSurfaceControl() {
    if (mSurfaceControl != null) {
        return;
    }
    
    // 创建SurfaceSession
    if (mSession.mSurfaceSession == null) {
        mSession.mSurfaceSession = new SurfaceSession();
        mService.mSessions.add(mSession);
    }
    
    // 创建SurfaceControl
    mSurfaceControl = new SurfaceControl.Builder(mSession.mSurfaceSession)
            .setName(getSurfaceControlName())
            .setBufferSize(mRequestedWidth, mRequestedHeight)
            .setFormat(mAttrs.format)
            .setFlags(getSurfaceFlags())
            .setParent(mToken.getSurfaceControl())
            .build();
    
    // 设置Surface位置和层级
    mSurfaceControl.setLayer(mLayer);
    mSurfaceControl.setPosition(mXOffset, mYOffset);
    mSurfaceControl.setAlpha(mAlpha);
}

2.3.3 PMS

PackageManagerService（PMS）在冷启动过程中扮演着信息提供者的角色，负责解析Intent、查询组件信息、验证权限，为AMS提供启动Activity所需的所有元数据信息。

源码分析调用链

2.3.3.1. Intent解析与组件查询

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
public class PackageManagerService extends IPackageManager.Stub {
    @Override
    public ResolveInfo resolveIntent(Intent intent, String resolvedType, 
            int flags, int userId) {
        // 验证用户权限
        enforceCrossUserPermission(Binder.getCallingUid(), userId, 
            false, false, "resolve intent");
        
        // 生成缓存键
        String key = intent.toShortString(false, true, false, false) + "|" 
            + resolvedType + "|" + flags + "|" + userId;
        
        // 检查缓存
        ResolveInfo cached = mResolveCache.get(key);
        if (cached != null) {
            return cached;
        }
        
        // 查询所有匹配的组件
        List<ResolveInfo> query = mActivities.queryIntent(intent, resolvedType, flags, userId);
        
        // 选择最佳匹配
        ResolveInfo bestChoice = chooseBestActivity(intent, resolvedType, flags, query, userId);
        
        // 缓存结果
        if (bestChoice != null) {
            mResolveCache.put(key, bestChoice);
        }
        
        return bestChoice;
    }
}

2.3.3.2. Intent查询核心实现

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
class ActivityIntentResolver extends IntentResolver<PackageParser.ActivityIntentInfo, ResolveInfo> {
    public List<ResolveInfo> queryIntent(Intent intent, String resolvedType, 
            int flags, int userId) {
        
        // 构建查询条件
        String scheme = intent.getScheme();
        Set<String> categories = intent.getCategories();
        
        // 查询匹配的组件
        ArrayList<ResolveInfo> list = new ArrayList<>();
        for (PackageParser.ActivityIntentInfo info : mActivities) {
            // 检查Intent是否匹配
            int match = info.match(intent, resolvedType, scheme, categories);
            if (match >= 0) {
                // 检查用户权限和组件可用性
                if (checkComponentPermission(info.activity.info, userId, flags)) {
                    ResolveInfo res = new ResolveInfo();
                    res.activityInfo = info.activity.info;
                    res.priority = info.getPriority();
                    res.preferredOrder = info.activity.owner.mPreferredOrder;
                    res.match = match;
                    res.isDefault = info.isDefault();
                    res.labelRes = info.labelRes;
                    res.nonLocalizedLabel = info.nonLocalizedLabel;
                    res.icon = info.icon;
                    list.add(res);
                }
            }
        }
        
        // 按优先级排序
        Collections.sort(list, new Comparator<ResolveInfo>() {
            @Override
-            public int compare(ResolveInfo o1, ResolveInfo o2) {
-                return o2.priority - o1.priority;
-            }
-        });
-        
-        return list;
-    }
-}

2.3.3.3. 组件权限检查

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
private boolean checkComponentPermission(ComponentInfo component, int userId, int flags) {
    // 1. 检查组件是否对当前用户可用
    if (!isComponentAvailableToUser(component, userId)) {
        return false;
    }
    
    // 2. 检查导出属性
    if (!component.exported) {
        // 未导出的组件只能被同一应用或相同user ID的应用调用
        if (Binder.getCallingUid() != component.applicationInfo.uid) {
            return false;
        }
    }
    
    // 3. 检查权限要求
    if (component.permission != null) {
        // 验证调用者是否有权限
        if (checkPermission(component.permission, Binder.getCallingPid(), 
                Binder.getCallingUid(), userId) != PackageManager.PERMISSION_GRANTED) {
            return false;
        }
    }
    
    // 4. 检查其他限制
    if ((flags & PackageManager.MATCH_DIRECT_BOOT_AWARE) == 0 &&
            !isDirectBootAware(component.applicationInfo)) {
        // 直接启动aware检查
        return false;
    }
    
    return true;
}

2.3.3.4. 权限验证实现

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
@Override
public int checkPermission(String permName, String pkgName, int userId) {
    // 1. 系统进程有所有权限
    if (Binder.getCallingUid() == Process.SYSTEM_UID) {
        return PackageManager.PERMISSION_GRANTED;
    }
    
    // 2. 查找包信息
    PackageParser.Package pkg = mPackages.get(pkgName);
    if (pkg == null) {
        return PackageManager.PERMISSION_DENIED;
    }
    
    // 3. 检查权限是否被声明
    if (!pkg.requestedPermissions.contains(permName)) {
        return PackageManager.PERMISSION_DENIED;
    }
    
    // 4. 检查权限是否被授予
-    PackageSetting ps = mSettings.mPackages.get(pkgName);
-    if (ps == null) {
-        return PackageManager.PERMISSION_DENIED;
-    }
-    
-    if (ps.getPermissionsState().hasPermission(permName, userId)) {
-        return PackageManager.PERMISSION_GRANTED;
-    }
-    
-    return PackageManager.PERMISSION_DENIED;
-}

2.3.3.5. ActivityInfo查询

// frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
@Override
public ActivityInfo getActivityInfo(ComponentName component, int flags, int userId) {
    // 验证用户权限
    enforceCrossUserPermission(Binder.getCallingUid(), userId, 
        false, false, "get activity info");
    
    // 查找组件信息
    PackageParser.Package pkg = mPackages.get(component.getPackageName());
    if (pkg == null) {
        return null;
    }
    
    // 查找Activity信息
    PackageParser.Activity a = pkg.activities.get(component.getClassName());
    if (a == null) {
        return null;
    }
    
    // 检查组件是否对用户可用
    if (!isComponentAvailableToUser(a.info, userId)) {
        return null;
    }
    
    // 返回ActivityInfo
    return PackageParser.generateActivityInfo(a, flags, userId);
}

2.4.启动中的AMS Activity生命周期是谁控制的? (问题)

• 决策权 ：AMS（决定什么时候应该调用什么生命周期方法）

• 执行权 ：应用进程的主线程（实际执行生命周期方法）

• 执行工具 ：Instrumentation（负责具体的方法调用和监控）

• AMS是大脑 ：AMS掌握着所有组件的状态信息（通过ActivityRecord, Task等）。它根据系统状态（如内存、电源、当前焦点）、Activity的启动模式、Intent的Flag等做出决策，决定下一个应该进入哪个生命周期的状态（onCreate, onStart, onResume, onPause等）。

• 应用进程是四肢 ：AMS将决策结果（一个ClientTransaction，其中包含LaunchActivityItem, ResumeActivityItem等生命周期项）通过Binder IPC发送给应用进程的ApplicationThread。

• 应用进程的主线程执行 ：ApplicationThread将AMS的请求抛到主线程的消息队列，由ActivityThread的HHandler处理，最终通过TransactionExecutor执行事务，调用Instrumentation去真正执行生命周期回调（如callActivityOnCreate）。

所以，生命周期方法是在应用主线程中由Instrumentation调用的，但调用的时机和顺序是由AMS远程控制的。

2.4.1. AMS的角色：决策者（大脑）

// frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java
class ActivityStack {
    boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
        // 获取栈顶Activity
        final ActivityRecord next = topRunningActivityLocked(true);
        
        if (next.app != null && next.app.thread != null) {
            // 决策：这个Activity应该进入RESUMED状态
            next.app.getThread().scheduleTransaction(
                ClientTransaction.obtain(next.app.getThread(), 
                    next.token, ActivityLifecycleItem.obtain(ON_RESUME)));
        }
        return true;
    }
}

AMS通过维护全局的Activity状态机来做出决策：

// frameworks/base/services/core/java/com/android/server/wm/ActivityRecord.java
class ActivityRecord {
    // AMS维护的Activity状态
    private int mState = INITIALIZING;
    
    // 状态常量定义
    static final int INITIALIZING = 0;
    static final int RESUMED = 1;
    static final int PAUSED = 2;
    static final int STOPPED = 3;
    static final int DESTROYED = 4;
    
    void setState(int state, String reason) {
        mState = state;
        // 根据状态决策下一步操作
        scheduleActivityLifecycleState();
    }
}

2.4. 2. 应用进程的角色：执行者ActivityThread

// frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
    private class ApplicationThread extends IApplicationThread.Stub {
        @Override
        public void scheduleTransaction(ClientTransaction transaction) {
            // 接收AMS的指令，抛到主线程执行
            sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
        }
    }
    
    class H extends Handler {
        public void handleMessage(Message msg) {
            switch (msg.what) {
                case EXECUTE_TRANSACTION:
                    // 在主线程执行事务
                    handleExecuteTransaction((ClientTransaction) msg.obj);
                    break;
            }
        }
    }
    
    private void handleExecuteTransaction(ClientTransaction transaction) {
        // 使用TransactionExecutor执行生命周期操作
        mTransactionExecutor.execute(transaction);
    }
}

2.4.3. 生命周期执行的具体过程

// frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java
public class TransactionExecutor {
    public void execute(ClientTransaction transaction) {
        // 1. 执行回调（如LaunchActivityItem）
        executeCallbacks(transaction);
        
        // 2. 执行生命周期状态变更（如ResumeActivityItem）
        executeLifecycleState(transaction);
    }
    
    private void executeLifecycleState(ClientTransaction transaction) {
        final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
        if (lifecycleItem == null) {
            return;
        }
        
        // 执行具体的生命周期项
        lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
    }
}

// frameworks/base/core/java/android/app/servertransaction/ResumeActivityItem.java
public class ResumeActivityItem extends ActivityLifecycleItem {
    @Override
    public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
        // 最终调用到ActivityThread的handleResumeActivity方法
        client.handleResumeActivity(token, true /* finalStateRequest */,
                mIsForward, "RESUME_ACTIVITY");
    }
}

// frameworks/base/core/java/android/app/ActivityThread.java
public class ActivityThread implements ClientTransactionHandler {
    @Override
    public void handleResumeActivity(IBinder token, boolean finalStateRequest,
            boolean isForward, String reason) {
        // 1. 执行onResume前的工作
        final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);
        
        if (r != null) {
            // 2. 设置窗口可见性等
            if (r.window == null && !a.mFinished && willBeVisible) {
                r.window = r.activity.getWindow();
                View decor = r.window.getDecorView();
                decor.setVisibility(View.INVISIBLE);
                ViewManager wm = a.getWindowManager();
                wm.addView(decor, l);
            }
        }
    }
    
    public ActivityClientRecord performResumeActivity(IBinder token, 
            boolean finalStateRequest, String reason) {
        // 最终通过Instrumentation调用Activity的onResume方法
        final ActivityClientRecord r = mActivities.get(token);
        if (r.activity.mFinished) {
            return null;
        }
        
        try {
            r.activity.onStateNotSaved();
            r.activity.mCalled = false;
            // 这里调用Instrumentation执行生命周期方法
            mInstrumentation.callActivityOnResume(r.activity);
            if (!r.activity.mCalled) {
                throw new SuperNotCalledException("Activity " + r.intent.getComponent().toShortString()
                        + " did not call through to super.onResume()");
            }
        } catch (Exception e) {
            // 异常处理
        }
        
        return r;
    }
}

2.4.4. Instrumentation：实际的执行工具

// frameworks/base/core/java/android/app/Instrumentation.java
public class Instrumentation {
    public void callActivityOnResume(Activity activity) {
        activity.mResumed = true;
        // 真正调用Activity的onResume方法
        activity.onResume();
        
        // 监控回调（用于测试等目的）
        if (mActivityMonitors != null) {
            synchronized (mSync) {
                for (ActivityMonitor am : mActivityMonitors) {
                    am.onActivityResumed(activity);
                }
            }
        }
    }
    
    public void callActivityOnCreate(Activity activity, Bundle icicle) {
        // 预处理
        activity.performCreate(icicle);
        // 后处理
    }
}

2.5 会有几次跨进程的动作？

重点介绍下，服务端和和客户端，怎么使用Binder进行跨进程的！

1. Launcher → ATMS：启动请求 (第一次IPC)

// frameworks/base/core/java/android/app/Instrumentation.java
public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token,
        Activity target, Intent intent, int requestCode, Bundle options) {
    // 获取ATMS的Binder代理
    IActivityTaskManager atm = ActivityTaskManager.getService();
    
    // 第一次Binder IPC：Launcher进程 -> ATMS系统进程
    int result = atm.startActivity(appThread, who.getBasePackageName(), intent,
            intent.resolveTypeIfNeeded(who.getContentResolver()), token,
            target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
}

2. ATMS → PMS：Intent解析 (第二次IPC)

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private ActivityInfo resolveActivity(Request request) {
    try {
        // 第二次Binder IPC：ATMS -> PMS
        ResolveInfo rInfo = AppGlobals.getPackageManager()
            .resolveIntent(request.intent, request.resolvedType, 
                PackageManager.MATCH_DEFAULT_ONLY, request.userId);
    }
}

3. AMS → Zygote：进程创建 (Socket通信，非Binder)

// frameworks/base/services/core/java/com/android/server/am/ProcessList.java
final ProcessStartResult startResult = Process.start(entryPoint,
    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
    app.info.dataDir, invokeWith, entryPointArgs);

注意 ：这是通过 Socket 而不是 Binder 进行的 IPC。

4. 应用进程 → AMS：进程注册 (第三次IPC)

// frameworks/base/core/java/android/app/ActivityThread.java
private void attach(boolean system) {
    final IActivityManager mgr = ActivityManager.getService();
    // 第三次Binder IPC：新应用进程 -> AMS
    mgr.attachApplication(mAppThread);
}

5. AMS → 应用进程：应用绑定 (第四次IPC)

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
private boolean attachApplicationLocked(IApplicationThread thread, int pid) {
    // 第四次Binder IPC：AMS -> 应用进程
    thread.bindApplication(processName, appInfo, providers,
            app.instrumentationClass, profilerInfo, app.instrumentationArguments,
            app.instrumentationWatcher, app.instrumentationUiAutomationConnection,
            testMode, enableOpenGlTrace, isRestrictedBackupMode || !normalMode,
            app.isPersistent(), new Configuration(mConfiguration),
            app.compat, getCommonServicesLocked(app.isolated),
            mCoreSettingsObserver.getCoreSettingsLocked());
}

6. AMS → 应用进程：Activity启动 (第五次IPC)

// frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
void realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
    
    // 第五次Binder IPC：AMS -> 应用进程
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
}

7. 应用进程 → WMS：窗口创建 (第六次IPC)

// frameworks/base/core/java/android/view/ViewRootImpl.java
public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
    try {
        // 第六次Binder IPC：应用进程 -> WMS
        res = mWindowSession.addToDisplay(mWindow, mSeq, attrs,
                View.VISIBLE, getContext().getDisplayId(), mTmpFrame,
                mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
                mAttachInfo.mOutsets, mAttachInfo.mDisplayCutout, mInputChannel);
    }
}

8. 应用进程 → AMS：生命周期回调 (第七次及更多IPC)

// 各种生命周期状态通知
@Override
public final void activityIdle(IBinder token, Configuration config, boolean stopProfiling) {
    // 第七次Binder IPC：应用进程 -> AMS
    mServices.activityIdle(token, config, stopProfiling);
}

@Override
public final void activityResumed(IBinder token) {
    // 可能还有更多的状态通知IPC
}

Binder IPC 机制详解

服务端和客户端如何使用Binder：

以AMS（服务端）和ApplicationThread（客户端）为例：

• 服务端（AMS） ：持有IApplicationThread接口的代理对象（ApplicationThreadProxy）。它想通知客户端时，就调用这个代理对象的方法（如scheduleTransaction），调用会通过Binder驱动传递到客户端。
• 客户端（App进程） ：ApplicationThread实现了IApplicationThread.Stub，它是一个Binder本地对象（Bn端）。它接收来自Binder驱动的请求，并在onTransact方法中处理这些请求，最终将任务抛到主线程执行。

服务端和客户端如何使用Binder

服务端（System Server）实现：

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub {
    // 实现Binder接口
    @Override
    public int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho,
            int requestCode, int flags, ProfilerInfo profilerInfo, Bundle options) {
        // 服务端实现具体逻辑
        return startActivityAsUser(caller, callingPackage, intent, resolvedType,
                resultTo, resultWho, requestCode, flags, profilerInfo, options,
                UserHandle.getCallingUserId());
    }
}

客户端（Launcher/App）调用：

// 获取AMS的Binder代理
IActivityManager am = ActivityManager.getService();

// 发起Binder调用
int result = am.startActivity(...);

Binder代理对象生成：

// frameworks/base/core/java/android/app/ActivityManager.java
public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                // 获取ServiceManager中的AMS引用
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                // 创建Binder代理对象
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

Binder数据传输机制

// 数据序列化示例
@Override
public boolean onTransact(int code, Parcel data, Parcel reply, int flags) {
    switch (code) {
        case START_ACTIVITY_TRANSACTION:
            // 从Parcel中读取数据
            data.enforceInterface(IActivityManager.descriptor);
            IBinder b = data.readStrongBinder();
            Intent intent = Intent.CREATOR.createFromParcel(data);
            
            // 执行实际操作
            int result = startActivity(...);
            
            // 将结果写入回复Parcel
            reply.writeNoException();
            reply.writeInt(result);
            return true;
    }
}

2.6 启动模式与任务栈的核心管理机制

在Android系统中，启动模式(Launch Mode)和任务栈(Task)的管理主要由ActivityTaskManagerService (ATMS) 和 ActivityStarter 负责。

1. 启动模式处理入口

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
class ActivityStarter {
    private int executeRequest(Request request) {
        // 解析ActivityInfo，其中包含launchMode
        ActivityInfo aInfo = resolveActivity(request);
        
        // 处理启动模式
        return startActivityUnchecked(request, aInfo);
    }
    
    private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord) {
        // 计算启动标志和任务栈
        computeLaunchingTaskFlags();
        
        // 处理启动模式
        handleLaunchMode();
        
        // 设置目标栈
        setTargetStack();
    }
}

2. 启动模式处理核心逻辑

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private void handleLaunchMode() {
    final int launchMode = mStartActivity.info.launchMode;
    
    switch (launchMode) {
        case ActivityInfo.LAUNCH_MULTIPLE: // standard
            // 默认模式，总是创建新实例
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_TOP: // singleTop
            if (isTopActivity(mTargetStack, mStartActivity)) {
                // 栈顶已是该Activity，复用并调用onNewIntent
                deliverNewIntent();
                return START_DELIVERED_TO_TOP;
            }
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_TASK: // singleTask
            // 查找或创建任务栈
            final Task reusedTask = findTaskLocked();
            if (reusedTask != null) {
                // 找到现有任务栈
                reuseTask(reusedTask);
                return START_DELIVERED_TO_TOP;
            }
            break;
            
        case ActivityInfo.LAUNCH_SINGLE_INSTANCE: // singleInstance
            // 创建新栈并设置为单实例模式
            createNewTaskAndStack();
            break;
    }
    
    // 没有复用现有Activity，需要创建新实例
    return startActivityUnchecked();
}

3. 任务栈查找算法

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private Task findTaskLocked() {
    // 获取所有可能匹配的任务栈
    final ArrayList<Task> tasks = mRootWindowContainer.getTasks();
    
    for (int i = tasks.size() - 1; i >= 0; i--) {
        final Task task = tasks.get(i);
        
        // 检查任务栈是否匹配
        if (matchTask(task)) {
            return task;
        }
    }
    
    return null;
}

private boolean matchTask(Task task) {
    // 1. 检查affinity匹配
    if (task.affinity != null && task.affinity.equals(mStartActivity.taskAffinity)) {
        return true;
    }
    
    // 2. 检查Intent匹配
    if (task.intent != null && task.intent.filterEquals(mIntent)) {
        return true;
    }
    
    // 3. 检查组件匹配
    if (task.realActivity != null && 
        task.realActivity.equals(mStartActivity.realActivity)) {
        return true;
    }
    
    return false;
}

4. singleTask模式的具体实现

// frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
private void reuseTask(Task task) {
    // 将任务栈移到前台
    moveTaskToFront(task);
    
    // 清除该任务栈中目标Activity之上的所有Activity
    final ActivityRecord top = task.getTopActivity();
    if (top != null && !top.realActivity.equals(mStartActivity.realActivity)) {
        task.performClearTaskForReuse();
    }
    
    // 找到或创建目标Activity
    ActivityRecord activity = findActivityInTask(task);
    if (activity != null) {
        // 复用现有Activity
        mStartActivity = activity;
        deliverNewIntent();
    } else {
        // 在现有任务栈中创建新实例
        task.addActivityToTop(mStartActivity);
    }
}

5. 任务栈创建与管理

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
class ActivityStackSupervisor {
    Task createTask(int taskId, ActivityInfo info, Intent intent, 
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor) {
        
        // 创建新任务栈
        final Task task = new Task(taskId, info, intent, voiceSession, voiceInteractor);
        
        // 设置任务栈属性
        task.setIntent(intent);
        task.setRootActivity(mStartActivity);
        
        // 添加到任务栈列表
        mRootWindowContainer.addTask(task, null);
        
        return task;
    }
    
    void setTaskToFront(Task task) {
        // 将任务栈移到前台
        mRootWindowContainer.moveTaskToFront(task);
        
        // 更新栈焦点
        updateStackFocus();
    }
}

6. 栈管理核心类

ActivityStack

// frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java
class ActivityStack extends ConfigurationContainer {
    // 栈中的Activity记录
    final ArrayList<ActivityRecord> mActivities = new ArrayList<>();
    
    // 栈管理方法
    void addActivityToTop(ActivityRecord r) {
        mActivities.add(r);
        r.setStack(this);
        updateLRUListLocked(r);
    }
    
    void removeActivity(ActivityRecord r) {
        mActivities.remove(r);
        r.setStack(null);
    }
    
    ActivityRecord topRunningActivityLocked() {
        for (int i = mActivities.size() - 1; i >= 0; i--) {
            ActivityRecord r = mActivities.get(i);
            if (r.isState(RESUMED, PAUSED, STOPPED)) {
                return r;
            }
        }
        return null;
    }
}

Task

// frameworks/base/services/core/java/com/android/server/wm/Task.java
class Task extends ConfigurationContainer {
    // 任务栈属性
    int taskId;
    String affinity;
    Intent intent;
    ComponentName realActivity;
    
    // 栈中的Activity列表
    final ArrayList<ActivityRecord> mActivities = new ArrayList<>();
    
    void performClearTaskForReuse() {
        // 清除栈顶的Activity直到找到匹配的
        for (int i = mActivities.size() - 1; i >= 0; i--) {
            ActivityRecord r = mActivities.get(i);
            if (r.realActivity.equals(mStartActivity.realActivity)) {
                break;
            }
            removeActivity(r);
        }
    }
}

2.7 启动过程中，Handler, 干嘛的? 之前是在什么线程的? 源码分析下

线程切换：将Binder线程的请求切换到主线程执行

• 之前所在线程 ：Binder线程池（Binder:domain_ 开头的线程）
• 目标线程 ：主线程（main 线程）

// frameworks/base/core/java/android/app/ActivityThread.java
private class ApplicationThread extends IApplicationThread.Stub {
    @Override
    public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        // 这是Binder线程池中的线程
        // 核心操作：将事务发送到主线程的Handler处理
        ActivityThread.this.scheduleTransaction(transaction);
    }
}

// ActivityThread中的实现
public class ActivityThread extends ClientTransactionHandler {
    void scheduleTransaction(ClientTransaction transaction) {
        // 通过Handler发送到主线程消息队列
        transaction.schedule();
    }
}

// Binder线程处理耗时操作，不阻塞主线程
public void scheduleTransaction(ClientTransaction transaction) {
    // 快速处理Binder调用
    sendMessage(EXECUTE_TRANSACTION, transaction);
    // Binder线程立即返回，不阻塞
}

// frameworks/base/core/java/android/app/ActivityThread.java
class H extends Handler {
    public static final int EXECUTE_TRANSACTION = 159;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case EXECUTE_TRANSACTION:
                // 获取事务并执行
                final ClientTransaction transaction = (ClientTransaction) msg.obj;
                mTransactionExecutor.execute(transaction);
                break;
        }
    }
}

2.8. 第一次启动应用白屏是什么原因

冷启动时，系统需要创建进程和初始化应用（执行Application.onCreate()和Activity.onCreate()），这需要时间。在这段时间内，如果Window背景是空的，用户会看到黑屏或白屏。 当你点击应用图标时，系统需要时间创建进程、初始化应用组件（如Application、主Activity），并完成首帧绘制。为了告知用户应用已响应，系统在应用完成初始化并渲染出它的主界面之前，会先显示一个临时窗口 ，即 Starting Window（预览窗口） 5810。

这个 Starting Window 的外观由你在 AndroidManifest.xml 中为启动 Activity（通常设置了 <intent-filter action:MAIN category:LAUNCHER> 的那个）所设置的主题的 android:windowBackground 属性决定：

• 若主题为 Light 系列或 windowBackground 为浅色，则通常显示白屏5810。
• 若主题为 Black/Dark 系列或 windowBackground 为深色/黑色，则通常显示黑屏5810。

Starting Window 的出现意味着系统已经接收到了启动应用的指令并在处理5810。白屏或黑屏显示多久，取决于冷启动的耗时5。

🔍 冷启动流程（从点击图标到首帧绘制）

解决方案. 定制预览窗口背景（常用且有效）

这是提升感知体验最直接的方法。为你的启动Activity设置一个自定义主题，并指定 android:windowBackground458：

1. 创建自定义启动主题 (在 res/values/styles.xml 中)：

   <style name="SplashTheme" parent="Theme.AppCompat.Light.NoActionBar">
       <!-- 设置一张与启动图一致的背景图 -->
       <item name="android:windowBackground">@drawable/splash_background</item>
       <item name="android:windowFullscreen">true</item> <!-- 可选：全屏 -->
       <item name="windowNoTitle">true</item> <!-- 可选：无标题栏 -->
       <!-- 或者设置一个纯色背景 -->
       <!-- <item name="android:windowBackground">@color/splashBackgroundColor</item> -->
   </style>

2. 在 AndroidManifest.xml 中应用给启动Activity：

   <activity
       android:name=".SplashActivity" <!-- 或你的主Activity -->
       android:theme="@style/SplashTheme">
       <intent-filter>
           <action android:name="android.intent.action.MAIN" />
           <category android:name="android.intent.category.LAUNCHER" />
       </intent-filter>
   </activity>

3. 在Activity的onCreate中切换回正常主题 （在调用super.onCreate()之前）：

   public class SplashActivity extends AppCompatActivity {
       @Override
       protected void onCreate(Bundle savedInstanceState) {
           setTheme(R.style.AppTheme); // 切换回应用正常主题
           super.onCreate(savedInstanceState);
           setContentView(R.layout.activity_splash);
           // ... 后续初始化工作
       }
   }

这样做的效果是 ：系统会立即显示 splash_background 定义的画面，取代默认的白屏/黑屏。当应用初始化完成后，再切换到真正的应用界面，实现无缝过渡，给人"秒开"的感觉45。

2.9 关键的一些问题

2.9.1 . 为什么activity不能直接new出来

ActivityThread中的创建过程

// frameworks/base/core/java/android/app/ActivityThread.java
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // 1. 获取ActivityInfo
    ActivityInfo aInfo = r.activityInfo;
    
    // 2. 获取Context
    ContextImpl appContext = createBaseContextForActivity(r);
    
    // 3. 通过Instrumentation创建Activity实例
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
    } catch (Exception e) {
        // 异常处理
    }
    
    try {
        // 4. 获取Application
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);
        
        // 5. 调用attach方法完成关键初始化
        activity.attach(appContext, this, getInstrumentation(), r.token,
            r.ident, app, r.intent, r.activityInfo, title, r.parent,
            r.embeddedID, r.lastNonConfigurationInstances, config,
            r.referrer, r.voiceInteractor, window, r.configCallback);
        
        // 6. 调用onCreate生命周期
        if (r.isPersistable()) {
            mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
        } else {
            mInstrumentation.callActivityOnCreate(activity, r.state);
        }
    } catch (Exception e) {
        // 异常处理
    }
    
    return activity;
}

1. 反射创建实例 ：通过Instrumentation.newActivity()使用反射创建Activity对象
2. 生命周期触发 ：通过Instrumentation调用onCreate()等生命周期方法
3. 为什么打开一个页面用startActivity，而不是new一个？

因为Activity的打开需要受AMS管理，Activity打开有四种启动模式，根据不同的启动模式有不同的处理。如果是new的话每次打开一个activity都创建一个实例，只相当于只有一种启动模式了（starder模式）

2.9.2. 进程是在哪个类创建的?

为什么要用zygin进程产生app进程？

如果程序员管理太乱了，会有太多进程。但是我们自己xml中也可以产生进程 。如果在init（）不行。那个时候太多进程初始化，systemServer()也不行。里面有很多进程！

2.9.2.1. 进程创建决策点

// frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java
void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
    // 检查进程是否已存在
    final ProcessRecord app = mService.getProcessRecordLocked(r.processName,
            r.info.applicationInfo.uid, true);
    
    if (app != null && app.thread != null) {
        // 进程已存在，直接启动Activity
        try {
            realStartActivityLocked(r, app, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            // 处理异常
        }
    }
    
    // 进程不存在，需要创建新进程
    mService.startProcessLocked(r.processName, r.info.applicationInfo,
            true, 0, "activity", r.intent.getComponent(), false, false, true);
}

2.9.2.2. AMS中的进程创建入口

// frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
        boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
        boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
        String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
    
    // 获取或创建ProcessRecord
    ProcessRecord app = getProcessRecordLocked(processName, info.uid, true);
    
    if (app == null) {
        // 创建新的ProcessRecord
        app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
        mProcessNames.put(processName, app.uid, app);
        updateLruProcessLocked(app, false, null);
    }
    
    // 启动进程
    startProcessLocked(app, hostingType, hostingName, abiOverride, entryPoint, entryPointArgs);
    
    return app;
}

private void startProcessLocked(ProcessRecord app, String hostingType,
        ComponentName hostingName, String abiOverride, String entryPoint, String[] entryPointArgs) {
    
    // 准备启动参数
    final String entryPointStr = (entryPoint != null) ? entryPoint : "android.app.ActivityThread";
    
    // 请求Zygote创建进程
    Process.ProcessStartResult startResult = Process.start(entryPointStr,
            app.processName, uid, uid, gids, runtimeFlags, mountExternal,
            app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
            app.info.dataDir, invokeWith, entryPointArgs);
    
    // 更新进程记录
    synchronized (mPidsSelfLocked) {
        this.mPidsSelfLocked.put(startResult.pid, app);
        app.setPid(startResult.pid);
        app.usingWrapper = startResult.usingWrapper;
        app.removed = false;
    }
    
    // 设置进程启动超时监控
    Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
    msg.obj = app;
    mHandler.sendMessageDelayed(msg, startResult.usingWrapper
            ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
}

2.9.2.3. Process.start() - 进程创建的核心

// frameworks/base/core/java/android/os/Process.java
public static final ProcessStartResult start(final String processClass,
                                  final String niceName,
                                  int uid, int gid, int[] gids,
                                  int runtimeFlags, int mountExternal,
                                  int targetSdkVersion, String seInfo,
                                  String abi, String instructionSet,
                                  String appDataDir, String invokeWith,
                                  String[] zygoteArgs) {
    return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
            runtimeFlags, mountExternal, targetSdkVersion, seInfo,
            abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

2.9.2.4. ZygoteProcess与Zygote通信

// frameworks/base/core/java/android/os/ZygoteProcess.java
public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              int uid, int gid, int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion, String seInfo,
                                              String abi, String instructionSet,
                                              String appDataDir, String invokeWith,
                                              String[] zygoteArgs) {
    try {
        // 通过socket与Zygote通信
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, false, zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        // 异常处理
        throw new RuntimeException("Starting VM process through Zygote failed", ex);
    }
}

private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  final String niceName,
                                                  final int uid, final int gid,
                                                  final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion, String seInfo,
                                                  String abi, String instructionSet,
                                                  String appDataDir, String invokeWith,
                                                  boolean startChildZygote,
                                                  String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
    
    // 构建发送给Zygote的参数
    ArrayList<String> argsForZygote = new ArrayList<>();
    argsForZygote.add("--runtime-args");
    argsForZygote.add("--setuid=" + uid);
    argsForZygote.add("--setgid=" + gid);
    argsForZygote.add("--runtime-flags=" + runtimeFlags);
    if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {
        argsForZygote.add("--mount-external-default");
    }
    // ... 添加更多参数
    
    argsForZygote.add(processClass);
    
    if (extraArgs != null) {
        for (String arg : extraArgs) {
            argsForZygote.add(arg);
        }
    }
    
    // 与Zygote通信并启动进程
    return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}

2.9.2.5. 与Zygote的Socket通信

// frameworks/base/core/java/android/os/ZygoteProcess.java
private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
        ZygoteState zygoteState, ArrayList<String> args)
        throws ZygoteStartFailedEx {
    try {
        // 获取Zygote的socket输出流
        final BufferedWriter writer = zygoteState.writer;
        final DataInputStream inputStream = zygoteState.inputStream;
        
        // 写入参数
        writer.write(Integer.toString(args.size()));
        writer.newLine();
        
        for (int i = 0; i < args.size(); i++) {
            String arg = args.get(i);
            writer.write(arg);
            writer.newLine();
        }
        
        writer.flush();
        
        // 读取Zygote返回的结果
        Process.ProcessStartResult result = new Process.ProcessStartResult();
        result.pid = inputStream.readInt();
        result.usingWrapper = inputStream.readBoolean();
        
        return result;
    } catch (IOException ex) {
        zygoteState.close();
        throw new ZygoteStartFailedEx(ex);
    }
}

2.9.2.6. Zygote端的进程创建

// frameworks/base/core/java/com/android/internal/os/Zygote.java
public static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
        int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
        int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir) {
    
    // 通过native方法fork新进程
    int pid = nativeForkAndSpecialize(
            uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName,
            fdsToClose, fdsToIgnore, startChildZygote, instructionSet, appDataDir);
    
    return pid;
}

// Native层的fork实现
native private static int nativeForkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
        int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
        int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir);

Android进程创建的核心类包括：

1. ActivityManagerService：决策者，决定何时创建进程
2. ProcessList：执行者，协调进程创建过程
3. ZygoteProcess：通信桥梁，与Zygote进程交互
4. Zygote：进程孵化器，实际fork新进程

进程创建过程经历了从AMS决策 → ProcessList协调 → ZygoteProcess通信 → Zygote fork → 新进程初始化的完整链条

2.9.3. App的程序入口到底是哪里？

一个应用程序的开始可以说就是从ActivityThread.java中的main()方法开始的。

2.9.3.1. 用户点击与 Launcher 处理

当你在 Launcher（桌面）点击应用图标时，Launcher 会收集目标 Activity 的信息（包名、类名），封装成一个带有 FLAG_ACTIVITY_NEW_TASK 标志的 Intent，然后调用 startActivity()。这个过程本质上是 Launcher 应用跨进程通知系统服务要启动另一个应用。

关键代码在 Instrumentation.execStartActivity() 中，它通过 Binder IPC 调用 ActivityManagerService (AMS) 的 startActivity 方法。

2.9.3.2. AMS 与进程创建

AMS 是 Android 系统的核心服务，负责管理 Activity 生命周期、任务栈和进程。它收到启动请求后：

• 检查目标进程：判断应用进程是否已存在。
• 请求创建进程 ：若进程不存在，AMS 会通过 Process.start() 方法，经由 ZygoteProcess 与 Zygote 进程 通过 Socket 通信 ，请求 fork 出新应用进程 。新进程的入口参数是 "android.app.ActivityThread"。

2.9.3.3. 程序入口：ActivityThread.main()

新进程创建后，执行的首要方法就是 ActivityThread.main(String[] args) 。这是真正的程序入口。

// frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
    ...
    Looper.prepareMainLooper(); // 1. 初始化主线程Looper
    ActivityThread thread = new ActivityThread(); 
    thread.attach(false); // 2. 关联到系统服务（AMS）
    Looper.loop(); // 3. 启动主线程消息循环
}

main 方法主要完成：

1. 初始化主线程 Looper：为应用主线程(UI线程)创建消息循环。
2. 创建 ActivityThread 实例：它是应用进程的核心类，管理应用组件和主线程。
3. 调用 attach() ：通过 Binder IPC 向 AMS 注册 当前应用进程（传递 ApplicationThread 对象）。
4. 启动消息循环：开始处理消息。

2.9.3.4. 应用进程初始化与 Application 创建

AMS 在收到应用进程的注册请求后，会通过 Binder IPC 回调应用进程的 ApplicationThread 接口，发送 BIND_APPLICATION 命令。该命令通过 Handler 切换到主线程后，由 ActivityThread.handleBindApplication() 处理。

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    ...
    // 1. 创建LoadedApk、ContextImpl对象
    LoadedApk loadedApk = getLoadedApk(data.appInfo);
    ContextImpl appContext = ContextImpl.createAppContext(this, loadedApk);
    // 2. 创建Instrumentation
    Instrumentation instr = new Instrumentation();
    // 3. 创建Application实例
    Application app = loadedApk.makeApplication(false, instr);
    // 4. 调用Application.onCreate()
    instr.callApplicationOnCreate(app);
}

此方法关键步骤2：

1. 创建 Application 实例 ：通过 LoadedApk.makeApplication() 利用反射创建。
2. 调用 Application.onCreate() ：通过 Instrumentation.callApplicationOnCreate() 调用。这是我们常说的"应用入口"，适合进行全局初始化（但应避免耗时操作）。

5. Activity 的启动与生命周期

AMS 在确认应用进程和 Application 初始化完成后，会通过 Binder IPC 回调应用进程的 ApplicationThread 接口，发送 LAUNCH_ACTIVITY 命令。该命令通过 Handler 切换到主线程后，由 ActivityThread.handleLaunchActivity() 处理28。

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleLaunchActivity(ActivityClientRecord r) {
    ...
    // 1. 创建Activity实例 (通过Instrumentation.newActivity())
    Activity activity = mInstrumentation.newActivity(cl, component, r.intent);
    // 2. 创建Application和ContextImpl
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    ContextImpl appContext = createBaseContextForActivity(r);
    // 3. 关联Activity和Context
    activity.attach(appContext, this, ...);
    // 4. 调用Activity.onCreate()
    mInstrumentation.callActivityOnCreate(activity, r.state);
    // 5. 执行onStart()和onResume()
    handleStartActivity() -> handleResumeActivity();
}

此过程主要包括2：

1. 创建 Activity 实例 ：通过 Instrumentation.newActivity() 利用反射创建。
2. 调用 attach() 方法：为 Activity 关联上下文、绑定 Window 等。
3. 触发生命周期 ：依次调用 onCreate(), onStart(), onResume()。
4. UI 绘制 ：在 onResume() 之后，会进行 View 的测量 (measure)、布局 (layout)、绘制 (draw)，最终将界面显示出来。

2.9.4. ContentProvider的oncreate方法和Application的oncrete()方法，谁先执行

核心结论

ContentProvider的onCreate()方法先于Application的onCreate()方法执行。

Application->attachBaseContext()

ContentProvider->onCreate()

Application->onCreate()

Activity->onCreate()

关键代码位置：ActivityThread.handleBindApplication()

// frameworks/base/core/java/android/app/ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 1. 创建Application对象（但尚未调用onCreate）
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    
    // 2. 安装并初始化ContentProviders - 这里会先调用ContentProvider的onCreate()
    if (!data.restrictedBackupMode) {
        List<ProviderInfo> providers = data.providers;
        if (providers != null) {
            installContentProviders(app, providers);
        }
    }
    
    // 3. 最后才调用Application的onCreate()
    mInstrumentation.callApplicationOnCreate(app);
}

ContentProvider初始化过程

// frameworks/base/core/java/android/app/ActivityThread.java
private void installContentProviders(Context context, List<ProviderInfo> providers) {
    for (ProviderInfo cpi : providers) {
        // 创建ContentProvider实例
        ContentProvider cp = installProvider(context, null, cpi, false, true, false);
        
        if (cp != null) {
            // 调用ContentProvider的onCreate()方法
            cp.onCreate();
        }
    }
}

Application创建过程

// frameworks/base/core/java/android/app/LoadedApk.java
public Application makeApplication(boolean forceDefaultAppClass, Instrumentation instrumentation) {
    // 创建Application实例
    Application app = mActivityThread.mInstrumentation.newApplication(cl, appClass, appContext);
    
    return app; // 注意：这里还没有调用onCreate()
}

2.9.5. 切线程是哪个类处理的?

Android线程切换机制：Handler与ApplicationThread的协同

在Android冷启动过程中，线程切换主要由两个类协同处理：

1. ApplicationThread - 在Binder线程接收请求
2. H (Handler) - 切换到主线程执行

核心线程切换机制

ApplicationThread：Binder线程端的接收器

// frameworks/base/core/java/android/app/ActivityThread.java
private class ApplicationThread extends IApplicationThread.Stub {
    // 这些方法都在Binder线程池中执行！
    public final void scheduleLaunchActivity(Intent intent, IBinder token, 
            int ident, ActivityInfo info, Configuration curConfig, 
            CompatibilityInfo compatInfo, int procState, Bundle state, 
            PersistableBundle persistentState, List<ResultInfo> pendingResults, 
            List<Intent> pendingNewIntents, boolean notResumed, 
            boolean isForward, ProfilerInfo profilerInfo) {
        
        // 这是在Binder线程中执行的
        ActivityClientRecord r = new ActivityClientRecord();
        // 填充数据...
        
        // 关键：发送消息到主线程的Handler
        sendMessage(H.LAUNCH_ACTIVITY, r);
    }
    
    public final void scheduleBindApplication(String processName,
            ApplicationInfo appInfo, List<ProviderInfo> providers,
            ComponentName testName, ProfilerInfo profilerInfo, Bundle testArgs,
            IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,
            int debugMode, boolean enableOpenGlTrace, boolean isRestrictedBackupMode,
            boolean persistent, Configuration config, CompatibilityInfo compatInfo,
            Map services, Bundle coreSettings) {
        
        // 同样执行在Binder线程
        AppBindData data = new AppBindData();
        // 填充数据...
        
        // 发送到主线程Handler
        sendMessage(H.BIND_APPLICATION, data);
    }
    
    // 发送消息到主线程的辅助方法
    private void sendMessage(int what, Object obj) {
        sendMessage(what, obj, 0, 0, false);
    }
    
    private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        // 关键：通过Handler发送到主线程的消息队列
        mH.sendMessage(msg);
    }
}

H (Handler)：主线程端的处理器

// frameworks/base/core/java/android/app/ActivityThread.java
class H extends Handler {
    // 消息类型常量
    public static final int BIND_APPLICATION = 110;
    public static final int LAUNCH_ACTIVITY = 100;
    public static final int RESUME_ACTIVITY = 107;
    public static final int PAUSE_ACTIVITY = 101;
    public static final int EXECUTE_TRANSACTION = 159;
    
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BIND_APPLICATION:
                // 现在在主线程执行了！
                handleBindApplication((AppBindData)msg.obj);
                break;
                
            case LAUNCH_ACTIVITY:
                // 在主线程处理Activity启动
                handleLaunchActivity((ActivityClientRecord)msg.obj, null, "LAUNCH_ACTIVITY");
                break;
                
            case RESUME_ACTIVITY:
                // 在主线程处理Activity恢复
                handleResumeActivity((IBinder)msg.obj, true, msg.arg1 != 0, true);
                break;
                
            case EXECUTE_TRANSACTION:
                // 处理事务执行
                final ClientTransaction transaction = (ClientTransaction) msg.obj;
                mTransactionExecutor.execute(transaction);
                break;
        }
    }
}

2.9.6. activityINfo的信息是怎么创建的?

Android 系统中 ActivityInfo 的创建主要发生在应用安装或系统启动时 ，由 PackageManagerService (PMS) 负责解析 APK 文件中的 AndroidManifest.xml 并生成。这个过程的核心是解析 <activity> 标签并将其属性转化为 ActivityInfo 对象的字段。

为了让你快速把握核心流程，我用一张图来展示 ActivityInfo 从创建到使用的全过程： ActivityInfo 的创建和封装主要发生在 PMS 解析 APK 文件的过程中。

1. 解析时机 ：当 APK 被安装或系统启动扫描已安装应用时，PMS 会解析 APK 包中的 AndroidManifest.xml 文件5。
2. 解析器 ：PMS 使用 PackageParser 来解析 APK。PackageParser 会遍历 AndroidManifest.xml 中的所有组件，包括 <activity>、<receiver>、<service> 和 <provider>5。
3. 创建 ActivityInfo ：对于每一个 <activity> 标签，PackageParser 都会创建一个 ActivityInfo 对象，并将标签中的属性（如 android:name, android:launchMode, android:screenOrientation, android:theme, android:exported 等）提取出来，填充到该 ActivityInfo 对象的相应字段中6。
4. 存储 ：解析得到的 ActivityInfo 会存储在 PMS 的内部数据结构中（例如 mActivities 等），以便后续快速查询

2.9.7： 进程的pid和Uid

ActivityStarter.startActivityMayWait().里面得到pid,uid();

在Android系统中，PID（Process ID） 和 UID（User ID） 是进程管理和安全机制的核心标识符：

• PID（进程ID） ：操作系统分配给每个进程的唯一数字标识，用于进程管理和调度
• UID（用户ID） ：Android用于标识应用身份和权限的数字标识，是安全沙箱的基础

PID和UID在进程记录中的存储

// frameworks/base/services/core/java/com/android/server/am/ProcessRecord.java
final class ProcessRecord implements WindowProcessListener {
    // 进程基本信息
    final String processName;    // 进程名
    final ApplicationInfo info;  // 应用信息
    final int uid;               // 用户ID
    int pid;                     // 进程ID
    
    // 运行时状态
    IApplicationThread thread;   // 与应用进程通信的Binder接口
    
    // 组件状态
    ArraySet<ActivityRecord> activities = new ArraySet<>();     // 运行的Activity
    ArraySet<ServiceRecord> services = new ArraySet<>();        // 运行的服务
}

3.从Launcher启动应用的流程

总的架构图：

分为4个步骤的总图：

3.1 从Launcher到AMS

3.2 从AMS到应用程序进程

3.3 在应用程序进程中创建进程

判断进程是否创建

ActivityStack ------>startSpecificActivityLocked();

ActivityManagerService---->getProcessRecordLocked();

void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        // Is this activity's process already running?
        ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);

        r.task.stack.setLaunchTime(r);

        if (app != null && app.thread != null) {
            ...
        }
        
        ActivityManagerService---->startProcessLocked();
        // 主要分析进程的创建过程和 application 的创建绑定过程
        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
    }

3.4 在应用程序进程中创建和启动根Activity

ActivityThread--->scheduleLaunchActivity()

         ActivityThread---> handleLaunchActivity   

                  1）.ActivityThread--->   performLaunchActivity

                          mInstrumentation--->newActivity()通过反射创建的！

                              activity.attach()

                                  mInstrumentation.callActivityOnCreate()

                                       2). ActivityThread--->  handleResumeActivity

                                              setContent---->创建window。把绘制交给了WMS

4.从系统启动，到Launcher,到点击桌面启动应用全流程

1、点击桌面App图标，Launcher进程采用Binder IPC向system_server(AMS)进程发起startActivity请求；（launcher----AMS）

2、system_server进程接收到请求后，向zygote进程发送创建进程的请求；(AMS------zygote)

3、Zygote进程fork出新的子进程，即App进程；（APP进程被创建, 注意：如果是子进程在不会重新创建，而是热启动）

4、App进程，通过Binder IPC向sytem_server(AMS)进程发起attachApplication请求；

5、system_server进程在收到请求后，进行一系列准备工作后，再通过binder IPC向App进程发送scheduleLaunchActivity请求；

6、App进程的binder线程（ApplicationThread）在收到请求后，通过handler向主线程发送LAUNCH_ACTIVITY消息；

7、主线程在收到Message后，通过发射机制创建目标Activity，并回调Activity.onCreate()等方法

8 .到此,App 便正式启动，开始进入Activity 生命周期，执行完onCreate/onStart/onResume 方法，UI 渲染结束后便可以看到App 的主界面

Activity的启动流程总结：

1、Launcher被调用点击事件，转到Instrumentation类的startActivity方法。 Instrumentation通过AIDL方式使用Binder机制告诉ATMS要启动应用的需求。

2.、ATMS收到需求后，反馈Launcher，让Launcher进入Paused状态 .Launcher进入Paused状态，ATMS将创建进程的任务交给AMS，AMS通过socket与Zygote通信，告知Zygote需要新建进程。

3. Zygote进程fork 出新的子进程，即App进程；并调用ActivityThread的main方法，也就是app的入口。还会创建Binder 线程池（ProcessState.startThreadPool()

4、在上面创建了APP进程之后。然后通过反射，进入到了 .ActivityThread的main方法新建了ActivityThread实例，并新建了Looper实例，开始loop循环。

5、ActivityThread也告知AMS，进程创建完毕，开始创建Application，Provider，并调用Applicaiton的attach，onCreate方法。

6、Ams处理后，向APP进程发送scheduleLaunchActivity请求，于是乎，activity真正启动了。是scheduleLaunchActivity??????

7. 最后就是创建上下文，通过类加载器加载Activity，调用Activity的onCreate方法。