Android随笔-Activity启动流程深度分析

从 startActivity() 到 onCreate() 的完整链路，按进程边界拆解为 6 大阶段。

阶段一：应用进程 → 请求启动（App Process）

1.1 Activity.startActivity()

// Activity.java
@Override
public void startActivity(Intent intent) {
    startActivity(intent, null);
}

@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    // 获取 ApplicationThread（Binder 代理，指向应用进程的 ActivityThread）
    // mMainThread 是 ActivityThread，getApplicationThread() 返回 ApplicationThread
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        startActivityForResult(intent, -1);
    }
}

1.2 startActivityForResult()

// Activity.java
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
        @Nullable Bundle options) {
    // mParent 为 null 表示不是嵌套在 ActivityGroup/TabActivity 中
    if (mParent == null) {
        options = transferSpringboardActivityOptions(options);
        // 核心：调用 Instrumentation.execStartActivity()
        Instrumentation.ActivityResult ar =
            mInstrumentation.execStartActivity(
                this, mMainThread.getApplicationThread(), mToken, this,
                intent, requestCode, options);
    } else {
        // 嵌套场景（已废弃）
        ...
    }
}

关键参数：

• mMainThread.getApplicationThread()：ApplicationThread 实例，是应用进程暴露给 system_server 的 Binder 接口
• mToken：IBinder 类型，是 AMS 分配给当前 Activity 的唯一标识，WMS 也用它管理窗口

1.3 Instrumentation.execStartActivity()

// Instrumentation.java
public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    
    // 将 ApplicationThread 转为 IApplicationThread（Binder 接口）
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    
    // 如果有 ActivityMonitor（用于测试），先检查
    ...
    
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess(who);
        
        // 核心：通过 Binder 调用 ATMS.startActivity()
        // ActivityTaskManager.getService() 获取 IActivityTaskManager 代理
        int result = ActivityTaskManager.getService()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, options);
        
        // 检查结果（如权限拒绝、Activity 未找到等）
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

ActivityTaskManager.getService() 获取的是 IActivityTaskManager 的 Binder 代理，指向 system_server 中的 ActivityTaskManagerService。

阶段二：system_server → 调度决策（System Server）

2.1 ActivityTaskManagerService.startActivity()

// ActivityTaskManagerService.java
@Override
public int startActivity(IApplicationThread caller, String callingPackage,
        Intent intent, String resolvedType, IBinder resultTo,
        String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, Bundle bOptions) {
    
    // 将调用者信息封装为 SafeActivityOptions
    // 然后委托给内部方法
    return mActivityStartController.obtainStarter(intent, "startActivityAsUser")
        .setCaller(caller)
        .setCallingPackage(callingPackage)
        .setResolvedType(resolvedType)
        .setResultTo(resultTo)
        .setResultWho(resultWho)
        .setRequestCode(requestCode)
        .setStartFlags(startFlags)
        .setProfilerInfo(profilerInfo)
        .setActivityOptions(bOptions)
        .execute();  // ← 核心
}

2.2 ActivityStarter.execute()

ActivityStarter 是 Android 10+ 引入的类，专门负责解析 Intent、计算启动模式、决定如何启动 Activity。

// ActivityStarter.java
int execute() {
    try {
        // 1. 解析 Intent，找到目标 ActivityInfo
        if (mRequest.activityInfo == null) {
            mRequest.resolveActivity(mSupervisor);
        }
        
        // 2. 权限检查
        int res = obtainStarter(intent, "startActivityAsUser")
            .execute();  // 递归或内部调用
        
        // 3. 核心执行
        int err = executeRequest(mRequest);
        
        // 4. 返回结果
        return err;
    } finally {
        onExecutionComplete();
    }
}

2.3 ActivityStarter.executeRequest()

这是整个启动流程中最复杂的决策逻辑，包含：

// ActivityStarter.java
private int executeRequest(Request request) {
    // 1. 获取 caller 的进程和 Activity 记录
    WindowProcessController callerApp = mService.getProcessController(caller);
    ActivityRecord sourceRecord = mRootWindowContainer.isInAnyStack(resultTo);
    
    // 2. 解析 Intent，获取 ActivityInfo
    ActivityInfo aInfo = request.activityInfo;
    
    // 3. 检查启动权限（exported、permission、appLink）
    ...
    
    // 4. 计算启动标志（Launch Flags）
    // 结合 manifest 中的 launchMode 和 Intent 中的 Flags
    final int launchFlags = ...;
    
    // 5. 决定是复用已有实例还是创建新实例
    // 如果是 singleTask/singleTop，查找已有实例
    final ActivityRecord reusedActivity = getReusableIntentActivity();
    
    if (reusedActivity != null) {
        // 复用逻辑：调用 onNewIntent()，可能 clearTop
        ...
    }
    
    // 6. 确定目标 Task
    final Task targetTask = reusedActivity != null 
        ? reusedActivity.getTask() 
        : computeTargetTask();
    
    // 7. 决定是否需要新建进程
    final WindowProcessController proc = mService.getProcessController(
        aInfo.processName, aInfo.applicationInfo.uid);
    
    if (proc == null || proc.getThread() == null) {
        // 目标进程不存在，需要新建
        mService.startProcessAsync(...);
    }
    
    // 8. 组装 ActivityRecord，准备启动
    final ActivityRecord r = new ActivityRecord(mService, callerApp,
            callingUid, callingPackage, intent, resolvedType, aInfo,
            mService.getConfiguration(), resultRecord, resultWho,
            requestCode, componentSpecified, ...);
    
    // 9. 最终调用 startActivityUnchecked()
    return startActivityUnchecked(r, sourceRecord, ...);
}

2.4 startActivityUnchecked() → RootWindowContainer

// ActivityStarter.java
private int startActivityUnchecked(...) {
    // 1. 根据 launchMode 和 Flags 计算 Activity 在栈中的位置
    computeLaunchingTaskFlags();
    
    // 2. 找到或创建合适的 Task
    mTargetTask = getOrCreateTargetTask();
    
    // 3. 将 ActivityRecord 加入 Task 栈
    mTargetTask.addChild(r, ...);
    
    // 4. 如果目标进程已存在，直接发送启动请求
    // 如果进程不存在，等进程启动后再发
    mRootWindowContainer.resumeFocusedStacksTopActivities();
}

2.5 RootWindowContainer.resumeFocusedStacksTopActivities()

// RootWindowContainer.java
boolean resumeFocusedStacksTopActivities(...) {
    // 遍历所有 Display，找到 focused Stack
    for (int displayNdx = mChildren.size() - 1; displayNdx >= 0; --displayNdx) {
        final DisplayContent display = mChildren.get(displayNdx);
        final ActivityStack focusedStack = display.getFocusedStack();
        
        if (focusedStack != null) {
            // 核心：恢复栈顶 Activity
            resumed |= focusedStack.resumeTopActivityUncheckedLocked(target, targetOptions);
        }
    }
    return resumed;
}

2.6 ActivityStack.resumeTopActivityUncheckedLocked()

// ActivityStack.java
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
    // 如果栈正在暂停中，等暂停完成后再恢复
    if (mInResumeTopActivity) {
        return false;
    }
    
    boolean result = false;
    try {
        mInResumeTopActivity = true;
        result = resumeTopActivityInnerLocked(prev, options);
    } finally {
        mInResumeTopActivity = false;
    }
    return result;
}

2.7 resumeTopActivityInnerLocked()

这是最关键的状态转换方法，处理：

// ActivityStack.java
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
    // 1. 找到栈顶要恢复的 Activity
    final ActivityRecord next = topRunningActivity(true);
    
    // 2. 如果当前有正在显示的 Activity，先暂停它
    final ActivityRecord lastResumedActivity = mLastResumedActivity;
    if (lastResumedActivity != null) {
        // 发送 PAUSE 事务给当前 Activity
        startPausingLocked(lastResumedActivity, ...);
    }
    
    // 3. 检查目标进程是否存在
    final WindowProcessController proc = next.getProcessController();
    if (proc == null || proc.getThread() == null) {
        // 进程不存在，启动进程
        mAtmService.startProcessAsync(next.processName, ...);
        return true;
    }
    
    // 4. 进程已存在，直接启动 Activity
    // 组装 ClientTransaction
    final ClientTransaction transaction = ClientTransaction.obtain(
            proc.getThread(), next.appToken);  // appToken 是 IBinder
    
    // 添加 LaunchActivityItem
    transaction.addCallback(LaunchActivityItem.obtain(...));
    
    // 添加 ResumeActivityItem（生命周期状态请求）
    transaction.setLifecycleStateRequest(
        ResumeActivityItem.obtain(next.info.screenOrientation, ...));
    
    // 5. 通过 Binder 发送给应用进程
    mAtmService.getLifecycleManager().scheduleTransaction(transaction);
    
    return true;
}

阶段三：进程创建（Zygote Fork）

如果目标应用进程不存在，system_server 会触发进程创建：

3.1 ActivityManagerService.startProcessLocked()

// ActivityManagerService.java
final ProcessRecord startProcessLocked(...) {
    // 1. 检查是否已有同名进程
    ProcessRecord app = getProcessRecordLocked(processName, info.uid);
    
    // 2. 准备启动参数
    final String entryPoint = "android.app.ActivityThread";
    
    // 3. 通过 ProcessList 启动进程
    return mProcessList.startProcessLocked(..., entryPoint, ...);
}

3.2 ProcessList.startProcessLocked()

// ProcessList.java
private Process.ProcessStartResult startProcess(...) {
    // 组装参数：uid、gid、processName、entryPoint 等
    final ArrayList<String> args = new ArrayList<>();
    args.add("--setuid=" + uid);
    args.add("--setgid=" + gid);
    args.add("--setgroups=" + ...);
    args.add("--nice-name=" + processName);
    args.add("--app-data-dir=" + appDataDir);
    args.add("--entrypoint=" + entryPoint);  // android.app.ActivityThread
    
    // 通过 ZygoteProcess 向 Zygote 进程发送 fork 请求
    return zygoteProcess.start(...);
}

3.3 Zygote Fork

// ZygoteProcess.java
public final Process.ProcessStartResult start(..., String entryPoint, ...) {
    try {
        // 通过 LocalSocket 连接到 ZygoteServer
        final ZygoteState zygoteState = mZygoteState;
        
        // 发送参数，请求 fork
        final BufferedWriter writer = zygoteState.writer;
        final DataInputStream inputStream = zygoteState.inputStream;
        
        writer.write(Integer.toString(args.size()));
        writer.newLine();
        for (String arg : args) {
            writer.write(arg);
            writer.newLine();
        }
        writer.flush();
        
        // 读取 fork 结果（pid）
        Process.ProcessStartResult result = new Process.ProcessStartResult();
        result.pid = inputStream.readInt();
        result.usingWrapper = inputStream.readBoolean();
        return result;
    } ...
}

Zygote 进程在系统启动时预加载了 Framework 类和资源，fork 时通过 Copy-On-Write 共享这些内存，极大加快应用启动速度。

阶段四：新进程启动 → 绑定到 AMS（New Process）

4.1 ActivityThread.main()

fork 后，新进程入口：

// ActivityThread.java
public static void main(String[] args) {
    // 1. 关闭 Zygote 继承的 socket
    closeAndroidServerSocket();
    
    // 2. 创建主线程 Looper
    Looper.prepareMainLooper();
    
    // 3. 创建 ActivityThread 实例
    ActivityThread thread = new ActivityThread();
    thread.attach(false, startSeq);  // ← 核心：绑定到 AMS
    
    // 4. 创建主线程 Handler（H）
    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }
    
    // 5. 开启消息循环
    Looper.loop();
    
    // 6. 正常情况下不会执行到这里
    throw new RuntimeException("Main thread loop unexpectedly exited");
}

4.2 ActivityThread.attach()

// ActivityThread.java
private void attach(boolean system, long startSeq) {
    // system = false 表示普通应用进程
    if (!system) {
        // 获取 AMS 的 Binder 代理
        final IActivityManager mgr = ActivityManager.getService();
        
        try {
            // 核心：向 AMS 注册应用进程
            // mAppThread 是 ApplicationThread（Binder 服务端）
            mgr.attachApplication(mAppThread, startSeq);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
    }
    ...
}

4.3 AMS.attachApplication()

// ActivityManagerService.java
@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    // 1. 找到对应的 ProcessRecord
    synchronized (this) {
        ProcessRecord app = mProcessList.getProcessRecordLocked(startSeq);
        
        // 2. 绑定 ApplicationThread
        app.makeActive(thread, mProcessStats);
        
        // 3. 初始化应用（创建 Application）
        thread.bindApplication(processName, appInfo, ...);
        
        // 4. 检查是否有等待启动的 Activity
        // 如果有，调用 realStartActivityLocked()
        if (mPendingActivityLaunches.size() > 0) {
            // 启动之前因进程未就绪而挂起的 Activity
            ...
        }
    }
}

4.4 ApplicationThread.bindApplication()

// ActivityThread.ApplicationThread (内部类)
@Override
public final void bindApplication(String processName, ApplicationInfo appInfo, ...) {
    // 将参数封装为 AppBindData
    final AppBindData data = new AppBindData();
    data.processName = processName;
    data.appInfo = appInfo;
    ...
    
    // 发送消息到主线程 Handler（H）
    sendMessage(H.BIND_APPLICATION, data);
}

4.5 H.handleMessage() → handleBindApplication()

// ActivityThread.H (Handler)
class H extends Handler {
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case BIND_APPLICATION:
                AppBindData data = (AppBindData) msg.obj;
                handleBindApplication(data);
                break;
            ...
        }
    }
}

// ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 1. 设置进程名
    Process.setArgV0(data.processName);
    
    // 2. 创建 LoadedApk（加载 APK 资源和代码）
    final LoadedApk packageInfo = getPackageInfoNoCheck(...);
    
    // 3. 创建 ContextImpl
    final ContextImpl appContext = ContextImpl.createAppContext(this, packageInfo);
    
    // 4. 创建 Application
    Application app = packageInfo.makeApplication(...);
    
    // 5. 调用 Application.onCreate()
    mInstrumentation.callApplicationOnCreate(app);
}

阶段五：system_server → 真正启动 Activity（Real Start）

进程绑定完成后，system_server 继续之前挂起的启动流程：

5.1 ActivityStackSupervisor.realStartActivityLocked()

// ActivityStackSupervisor.java
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
        boolean andResume, boolean checkConfig) {
    
    // 1. 创建 ClientTransaction
    final ClientTransaction clientTransaction = ClientTransaction.obtain(
            proc.getThread(), r.appToken);
    
    // 2. 添加 LaunchActivityItem（启动 Activity）
    final Intent intent = r.intent;
    clientTransaction.addCallback(LaunchActivityItem.obtain(
            new Intent(r.intent),  // 复制 Intent
            System.identityHashCode(r),
            r.info,                // ActivityInfo
            r.getFilteredConfiguration(),
            r.compat,              // 兼容性信息
            proc.getReportedProcState(),
            r.getSavedState(),     // savedInstanceState
            r.persistentState,
            results,               // pending results
            newIntents,            // pending new intents
            proc.isActivityOrGame(),
            r.mActivityOptions,
            r.assistToken));
    
    // 3. 设置最终生命周期状态请求
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) {
        lifecycleItem = ResumeActivityItem.obtain(...);
    } else {
        lifecycleItem = PauseActivityItem.obtain(...);
    }
    clientTransaction.setLifecycleStateRequest(lifecycleItem);
    
    // 4. 调度事务到应用进程
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    
    return true;
}

5.2 ClientTransaction 设计

ClientTransaction 是 Android 9+ 引入的事务机制，将多个操作打包发送到应用进程：

// ClientTransaction.java
public class ClientTransaction implements Parcelable {
    // 回调列表（如 LaunchActivityItem、StopActivityItem）
    private List<ClientTransactionItem> mActivityCallbacks;
    
    // 最终生命周期状态请求（如 ResumeActivityItem、PauseActivityItem）
    private ActivityLifecycleItem mLifecycleStateRequest;
    
    // 目标 Activity 的 token
    private IBinder mActivityToken;
    
    // 目标进程的 IApplicationThread
    private IApplicationThread mClient;
}

设计目的：将多个生命周期操作（如 onCreate + onResume）打包为一次 Binder 调用，减少 IPC 次数。

阶段六：应用进程 → Activity 实例化与生命周期回调（App Process）

6.1 ApplicationThread.scheduleTransaction()

// ActivityThread.ApplicationThread
@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    // 直接转发给 ActivityThread
    ActivityThread.this.scheduleTransaction(transaction);
}

6.2 ClientTransactionHandler.scheduleTransaction()

// ClientTransactionHandler.java (ActivityThread 的父类)
void scheduleTransaction(ClientTransaction transaction) {
    transaction.preExecute(this);
    // 发送 EXECUTE_TRANSACTION 消息到主线程 Handler
    sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

6.3 H.handleMessage() → TransactionExecutor.execute()

// ActivityThread.H
case EXECUTE_TRANSACTION:
    final ClientTransaction transaction = (ClientTransaction) msg.obj;
    mTransactionExecutor.execute(transaction);
    break;

6.4 TransactionExecutor.execute()

// TransactionExecutor.java
public void execute(ClientTransaction transaction) {
    // 1. 执行所有回调（如 LaunchActivityItem）
    executeCallbacks(transaction);
    
    // 2. 执行生命周期状态请求（如 ResumeActivityItem）
    executeLifecycleState(transaction);
}

private void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        item.execute(mTransactionHandler, token, mPendingActions);
        item.postExecute(mTransactionHandler, token, mPendingActions);
    }
}

6.5 LaunchActivityItem.execute()

// LaunchActivityItem.java
@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    // 创建 ActivityClientRecord
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, ...);
    r.packageInfo = client.getPackageInfoNoCheck(...);
    
    // 核心：调用 ActivityThread.handleLaunchActivity()
    client.handleLaunchActivity(r, pendingActions, null);
}

6.6 ActivityThread.handleLaunchActivity()

// ActivityThread.java
public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
    
    // 1. 初始化 WindowManager（如果尚未初始化）
    if (mInstrumentation == null) {
        mInstrumentation = new Instrumentation();
    }
    
    // 2. 创建或获取 LoadedApk
    final ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, ...);
    }
    
    // 3. 创建 ComponentName
    final ComponentName component = r.intent.getComponent();
    
    // 4. 核心：调用 performLaunchActivity()
    final Activity activity = performLaunchActivity(r, customIntent);
    
    return activity;
}

6.7 ActivityThread.performLaunchActivity()

这是Activity 实例创建的核心方法：

// ActivityThread.java
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // 1. 获取 ActivityInfo
    ActivityInfo aInfo = r.activityInfo;
    
    // 2. 创建 ComponentName
    ComponentName component = r.intent.getComponent();
    if (component == null) {
        component = r.intent.resolveActivity(mInitialApplication.getPackageManager());
        r.intent.setComponent(component);
    }
    
    // 3. 创建 ContextImpl
    ContextImpl appContext = createBaseContextForActivity(r);
    
    // 4. 通过 Instrumentation 创建 Activity 实例
    // 核心：反射调用 Class.newInstance()
    java.lang.ClassLoader cl = appContext.getClassLoader();
    activity = mInstrumentation.newActivity(cl, component.getClassName(), r.intent);
    
    // 5. 创建 Application（如果尚未创建）
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    
    // 6. 调用 Activity.attach()
    // 关键：在这里创建 PhoneWindow、WindowManager、设置 Theme
    activity.attach(appContext, this, getInstrumentation(), r.token,
            r.ident, app, r.intent, r.activityInfo, title, r.parent,
            r.embeddedID, r.lastNonConfigurationInstances, config,
            r.referrer, r.voiceInteractor, window, r.configCallback,
            r.assistToken);
    
    // 7. 设置 Intent
    activity.mIntent = r.intent;
    
    // 8. 恢复 savedInstanceState
    if (r.state != null) {
        activity.mSavedInstanceState = r.state;
    }
    
    // 9. 调用 Instrumentation.callActivityOnCreate()
    // 最终触发 Activity.onCreate()
    if (r.isPersistable()) {
        mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
    } else {
        mInstrumentation.callActivityOnCreate(activity, r.state);
    }
    
    // 10. 设置状态为 CREATED
    r.setState(ON_CREATE);
    
    return activity;
}

6.8 Instrumentation.newActivity()

// Instrumentation.java
public Activity newActivity(ClassLoader cl, String className, Intent intent)
        throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    // 通过反射加载类并创建实例
    String pkg = intent != null && intent.getComponent() != null
            ? intent.getComponent().getPackageName() : null;
    return getFactory(pkg).instantiateActivity(cl, className, intent);
}

// AppComponentFactory.java
public Activity instantiateActivity(ClassLoader cl, String className, Intent intent)
        throws ClassNotFoundException, IllegalAccessException, InstantiationException {
    return (Activity) cl.loadClass(className).newInstance();
}

6.9 Activity.attach()

// Activity.java
final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor,
        Window window, ActivityConfigCallback activityConfigCallback,
        IBinder assistToken) {
    
    // 1. 关联 Context
    attachBaseContext(context);
    
    // 2. 创建 PhoneWindow（Window 的实现）
    mWindow = new PhoneWindow(this, window, activityConfigCallback);
    
    // 3. 设置 WindowManager
    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken,  // AMS 分配的 token
            mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
    
    // 4. 设置回调（Activity 实现 Window.Callback）
    mWindow.setCallback(this);
    
    // 5. 关联其他成员
    mUiThread = Thread.currentThread();
    mMainThread = aThread;
    mInstrumentation = instr;
    mToken = token;
    mApplication = application;
    mIntent = intent;
    ...
}

6.10 Instrumentation.callActivityOnCreate()

// Instrumentation.java
public void callActivityOnCreate(Activity activity, Bundle icicle) {
    // 预创建
    prePerformCreate(activity);
    
    // 核心：调用 Activity.performCreate()
    activity.performCreate(icicle);
    
    // 后创建
    postPerformCreate(activity);
}

// Activity.java
final void performCreate(Bundle icicle) {
    // 分发 onCreate 前的准备工作
    dispatchActivityPreCreated(icicle);
    
    // 核心：调用 onCreate()
    if (mActivityExt != null) {
        mActivityExt.onCreate(icicle);
    } else {
        onCreate(icicle);
    }
    
    // 写入 Fragment 状态
    mFragments.dispatchCreate();
    
    // 分发 onCreate 后的通知
    dispatchActivityPostCreated(icicle);
}

完整调用链总结

【应用进程】
Activity.startActivity()
    └─> Activity.startActivityForResult()
        └─> Instrumentation.execStartActivity()
            └─> Binder IPC
                └─> IActivityTaskManager.startActivity()

【system_server】
ActivityTaskManagerService.startActivity()
    └─> ActivityStarter.execute()
        └─> ActivityStarter.executeRequest()
            └─> ActivityStarter.startActivityUnchecked()
                └─> RootWindowContainer.resumeFocusedStacksTopActivities()
                    └─> ActivityStack.resumeTopActivityUncheckedLocked()
                        └─> ActivityStack.resumeTopActivityInnerLocked()
                            ├─> 目标进程不存在？
                            │   └─> AMS.startProcessLocked()
                            │       └─> ProcessList.startProcess()
                            │           └─> ZygoteProcess.start()
                            │               └─> Zygote fork 新进程
                            │
                            └─> 目标进程已存在/已启动
                                └─> ActivityStackSupervisor.realStartActivityLocked()
                                    └─> ClientTransaction.obtain()
                                    └─> transaction.addCallback(LaunchActivityItem)
                                    └─> transaction.setLifecycleStateRequest(ResumeActivityItem)
                                    └─> Binder IPC
                                        └─> IApplicationThread.scheduleTransaction()

【新进程启动】
ActivityThread.main()
    └─> Looper.prepareMainLooper()
    └─> ActivityThread.attach()
        └─> Binder IPC
            └─> AMS.attachApplication()
                └─> ApplicationThread.bindApplication()
                    └─> H.handleMessage(BIND_APPLICATION)
                        └─> handleBindApplication()
                            └─> 创建 Application
                            └─> Application.onCreate()

【应用进程 - 事务执行】
ApplicationThread.scheduleTransaction()
    └─> H.handleMessage(EXECUTE_TRANSACTION)
        └─> TransactionExecutor.execute()
            └─> LaunchActivityItem.execute()
                └─> ActivityThread.handleLaunchActivity()
                    └─> ActivityThread.performLaunchActivity()
                        ├─> Instrumentation.newActivity()  ← 反射创建 Activity
                        ├─> Activity.attach()              ← 创建 PhoneWindow
                        ├─> Instrumentation.callActivityOnCreate()
                        │   └─> Activity.performCreate()
                        │       └─> Activity.onCreate()    ← ★ 最终到达
                        │
                        └─> TransactionExecutor.executeLifecycleState()
                            └─> ResumeActivityItem.execute()
                                └─> ActivityThread.handleResumeActivity()
                                    └─> Activity.performResume()
                                        └─> Activity.onResume()  ← ★ 最终到达前台

关键设计要点回顾

设计点	说明
Binder 通信	应用进程 ↔ system_server 之间通过 Binder IPC，关键接口：IActivityTaskManager、IApplicationThread
Token 机制	IBinder 类型的 mToken，是 Activity 在 AMS/WMS 中的唯一标识，Window 也用它关联
事务机制	ClientTransaction 将多个生命周期操作打包，减少 IPC 次数
反射创建	Instrumentation.newActivity() 通过 Class.newInstance() 创建 Activity，非反射型 DI
Window 创建	Activity.attach() 中创建 PhoneWindow，这是 View 体系的根
主线程调度	所有回调通过 ActivityThread.H（Handler）调度到主线程 Looper