Android开发艺术探索 - 第9章 四大组件的工作过程
1.Activity启动过程 ref
从Activity的startActivity方法开始。startActivity的多个重载方法，最终都会调用startActivityForResult方法。mParent代表的是ActivityGroup，API 13之前用于在一个界面中嵌入多个Activity，之后被Fragment替代，所以这里一般为null。该方法中主要调用了Instrumentation#execStartActivity，其中参数mMainThread.getApplicationThread()得到的是ActivityThread的子类ApplicationThread对象，这两个类在Activity的启动过程中发挥了重要的作用：
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
@Nullable Bundle options) {
if (mParent == null) {
options = transferSpringboardActivityOptions(options);
Instrumentation.ActivityResult ar =
mInstrumentation.execStartActivity(
this, mMainThread.getApplicationThread(), mToken, this,
intent, requestCode, options);
if (ar != null) {
mMainThread.sendActivityResult(
mToken, mEmbeddedID, requestCode, ar.getResultCode(),
ar.getResultData());
}
execStartActivity的关键代码，即ActivityManager.getService().startActivity。从API 26开始引入了新的ActicityManager类，替代之前旧的实现ActivityManagerNative，不过最终得到都是一个IActivityManager的单例对象，其具体实现为ActivityManagerService（AMS）。紧随其后的方法checkStartActivityResult，则处理了常见的找不到Intent时抛出异常的情况：
public ActivityResult execStartActivity(
Context who, IBinder contextThread, IBinder token, Activity target,
Intent intent, int requestCode, Bundle options) {
...
try {
intent.migrateExtraStreamToClipData();
intent.prepareToLeaveProcess(who);
int result = ActivityManager.getService()
.startActivity(whoThread, who.getBasePackageName(), intent,
intent.resolveTypeIfNeeded(who.getContentResolver()),
token, target != null ? target.mEmbeddedID : null,
requestCode, 0, null, options);
checkStartActivityResult(result, intent);
public static void checkStartActivityResult(int res, Object intent) {
if (!ActivityManager.isStartResultFatalError(res)) {
return;
}
switch (res) {
case ActivityManager.START_INTENT_NOT_RESOLVED:
case ActivityManager.START_CLASS_NOT_FOUND:
if (intent instanceof Intent && ((Intent)intent).getComponent() != null)
throw new ActivityNotFoundException(
"Unable to find explicit activity class "
+ ((Intent)intent).getComponent().toShortString()
+ "; have you declared this activity in your AndroidManifest.xml?");
throw new ActivityNotFoundException(
"No Activity found to handle " + intent);
然后来到AMS#startActivity方法，最终通过startActivityAsUser方法，调用了ActivityStartController#obtainsStarter得到一个ActivityStarter对象，执行了其execute方法。setMayWait设置了其wait标志位为true：
public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,
boolean validateIncomingUser) {
enforceNotIsolatedCaller("startActivity");
userId = mActivityStartController.checkTargetUser(userId, validateIncomingUser,
Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");
// TODO: Switch to user app stacks here.
return mActivityStartController.obtainStarter(intent, "startActivityAsUser")
.setCaller(caller)
.setCallingPackage(callingPackage)
.setResolvedType(resolvedType)
.setResultTo(resultTo)
.setResultWho(resultWho)
.setRequestCode(requestCode)
.setStartFlags(startFlags)
.setProfilerInfo(profilerInfo)
.setActivityOptions(bOptions)
.setMayWait(userId)
.execute();
转到ActivityStarter#execute方法，调用了startActivityMayWait方法（上面提到wait被置为true），经过一翻流转：ActivityStarter->ActivityStackSupervisor->ActivityStack->ActivityStackSupervisor，最终调用到ActivityStackSupervisor#realStartActivityLocked方法，关键代码如下。与之前不同，API 28开始，通过事务的方式启动Activity：
// Create activity launch transaction.
final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,
r.appToken);
clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
System.identityHashCode(r), r.info,
// TODO: Have this take the merged configuration instead of separate global
// and override configs.
mergedConfiguration.getGlobalConfiguration(),
mergedConfiguration.getOverrideConfiguration(), r.compat,
r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
r.persistentState, results, newIntents, mService.isNextTransitionForward(),
profilerInfo));
...
// Schedule transaction.
mService.getLifecycleManager().scheduleTransaction(clientTransaction);
ClientLifecycleManager#scheduleTransaction，在创建ClientTransaction的时候，IApplicationThread接口的Binder对象就从Parcel中读取出来，并指向了mClient。这里调用了transaction的schedule方法，实际就是调用了Binder对象的scheduleTransaction方法：
void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
final IApplicationThread client = transaction.getClient();
transaction.schedule();
if (!(client instanceof Binder)) {
// If client is not an instance of Binder - it's a remote call and at this point it is
// safe to recycle the object. All objects used for local calls will be recycled after
// the transaction is executed on client in ActivityThread.
transaction.recycle();
}
}
// ClientTransaction#schedule
public void schedule() throws RemoteException {
mClient.scheduleTransaction(this);
}
而这个Binder对象远程Binder实体，即是在最开始startActivityForResult方法中，mMainThread.getApplicationThread()得到的ActivityThread$ApplicationThread实例。其scheduleTransaction方法最终调用到ActivityThread父类的scheduleTransaction方法。旧版本中，没有事务的概念，而是直接调用了该方法：
// ActivityThread$ApplicationThread#scheduleTransaction
@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
ActivityThread.this.scheduleTransaction(transaction);
}
而其scheduleTransaction的实现则非常简单，直接发送了一个Message交由Handler处理：
// ClientTransactionHandler#scheduleTransaction
/** Prepare and schedule transaction for execution. */
void scheduleTransaction(ClientTransaction transaction) {
transaction.preExecute(this);
sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}
Handler中执行了mTransactionExecutor.execute(transaction);
case EXECUTE_TRANSACTION:
final ClientTransaction transaction = (ClientTransaction) msg.obj;
mTransactionExecutor.execute(transaction);
if (isSystem()) {
// Client transactions inside system process are recycled on the client side
// instead of ClientLifecycleManager to avoid being cleared before this
// message is handled.
transaction.recycle();
}
// TODO(lifecycler): Recycle locally scheduled transactions.
break;
在TransactionExecutor的excute中，调用executeCallbacks执行具体的事务ClientTransactionItem：
public void execute(ClientTransaction transaction) {
final IBinder token = transaction.getActivityToken();
log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);
executeCallbacks(transaction);
executeLifecycleState(transaction);
mPendingActions.clear();
log("End resolving transaction");
}
@VisibleForTesting
public void executeCallbacks(ClientTransaction transaction) {
final List callbacks = transaction.getCallbacks();
if (callbacks == null) {
// No callbacks to execute, return early.
return;
}
log("Resolving callbacks");
final IBinder token = transaction.getActivityToken();
ActivityClientRecord r = mTransactionHandler.getActivityClient(token);
...
final int size = callbacks.size();
for (int i = 0; i < size; ++i) {
final ClientTransactionItem item = callbacks.get(i);
...
item.execute(mTransactionHandler, token, mPendingActions);
item.postExecute(mTransactionHandler, token, mPendingActions);
而这里的ClientTransactionItem的实现类，实际为创建事务时，传入的LaunchActivityItem对象，其execute方法调用了client.handleLaunchActivity(r, pendingActions, null /* customIntent */);，这里的client就是ActivityThread：
@Override
public void execute(ClientTransactionHandler client, IBinder token,
PendingTransactionActions pendingActions) {
Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
mPendingResults, mPendingNewIntents, mIsForward,
mProfilerInfo, client);
client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}
在ActivityThread的ActivityThread方法中，最终调用到了performLaunchActivity方法：
@Override
public Activity handleLaunchActivity(ActivityClientRecord r,
PendingTransactionActions pendingActions, Intent customIntent) {
...
final Activity a = performLaunchActivity(r, customIntent);
进入performLaunchActivity方法，开始创建Activity：
- 从ActivityClientRecord中获取待启动的Activity的组件信息：
ActivityInfo aInfo = r.activityInfo; if (r.packageInfo == null) { r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo, Context.CONTEXT_INCLUDE_CODE); } ComponentName component = r.intent.getComponent(); if (component == null) { component = r.intent.resolveActivity( mInitialApplication.getPackageManager()); r.intent.setComponent(component); } if (r.activityInfo.targetActivity != null) { component = new ComponentName(r.activityInfo.packageName, r.activityInfo.targetActivity); } - 创建ContextImpl，通过Instrumentation#newActivity方法使用ClassLoader创建Activity对象：
ContextImpl appContext = createBaseContextForActivity(r);
Activity activity = null;
try {
java.lang.ClassLoader cl = appContext.getClassLoader();
activity = mInstrumentation.newActivity(
cl, component.getClassName(), r.intent);
StrictMode.incrementExpectedActivityCount(activity.getClass());
r.intent.setExtrasClassLoader(cl);
r.intent.prepareToEnterProcess();
if (r.state != null) {
r.state.setClassLoader(cl);
}
- 通过LoadedApk#makeApplication方法尝试创建Application对象。如果Application已经创建过了，则不会再次创建，所以一个应用只有一个Application。而创建过程同Activity也是通过Instrumentation#newApplication方法使用ClassLoader创建，创建完成后，通过callApplicationOnCreate回调Application#onCreate方法：
Application app = r.packageInfo.makeApplication(false, mInstrumentation);
public Application makeApplication(boolean forceDefaultAppClass,
Instrumentation instrumentation) {
if (mApplication != null) {
return mApplication;
}
try {
java.lang.ClassLoader cl = getClassLoader();
if (!mPackageName.equals("android")) {
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
"initializeJavaContextClassLoader");
initializeJavaContextClassLoader();
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
}
ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
app = mActivityThread.mInstrumentation.newApplication(
cl, appClass, appContext);
...
if (instrumentation != null) {
try {
instrumentation.callApplicationOnCreate(app);
- 通过Activity#attach方法来完成重要数据的初始化，与ContextImpl的关联，以及Window创建和与Window的关联。
appContext.setOuterContext(activity);
activity.attach(appContext, this, getInstrumentation(), r.token,
r.ident, app, r.intent, r.activityInfo, title, r.parent,
r.embeddedID, r.lastNonConfigurationInstances, config,
r.referrer, r.voiceInteractor, window, r.configCallback);
- 调用Activity#onCreate方法
通过mInstrumentation.callActivityOnCreate(activity, r.state);回调Activity#onCreate。至此，Activity创建完毕。
2.Service
- 启动过程
Activity#startService->ContextWrapper#startService，这里的mBase，即是创建Activity时，关联的ContextImpl对象。ContextWrapper的实现大部分由ContextImpl完成，典型的桥接模式：
@Override
public ComponentName startService(Intent service) {
return mBase.startService(service);
}
ContextImpl#startService->startServiceCommon，同Activity，同样会通过AMS去执行startService操作：
```
@Override
public ComponentName startService(Intent service) {
warnIfCallingFromSystemProcess();
return startServiceCommon(service, false, mUser);
}
private ComponentName startServiceCommon(Intent service, boolean requireForeground,
UserHandle user) {
try {
validateServiceIntent(service);
service.prepareToLeaveProcess(this);
ComponentName cn = ActivityManager.getService().startService(
mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
getContentResolver()), requireForeground,
getOpPackageName(), user.getIdentifier());
```
AMS#startService中调用mService的startServiceLocked方法，这个mService的类型是ActiveService，他的作用是辅助AMS进行service的启动/绑定/停止：
@Override
public ComponentName startService(IApplicationThread caller, Intent service,
String resolvedType, boolean requireForeground, String callingPackage, int userId)
throws TransactionTooLargeException {
...
try {
res = mServices.startServiceLocked(caller, service,
resolvedType, callingPid, callingUid,
requireForeground, callingPackage, userId);
startServiceLocked->startServiceInnerLocked，传递的ServiceRecord描述了一个service记录，其一直贯穿整个service的启动过程。然后调用bringUpServiceLocked：
ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r,
boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {
ServiceState stracker = r.getTracker();
if (stracker != null) {
stracker.setStarted(true, mAm.mProcessStats.getMemFactorLocked(), r.lastActivity);
}
r.callStart = false;
synchronized (r.stats.getBatteryStats()) {
r.stats.startRunningLocked();
}
String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
bringUpServiceLocked->realStartServiceLocked，其中主要关注两个调用：首先同Activity，远程调用了ApplicationThread#scheduleCreateService创建service，回调onCreate方法；然后通过sendServiceArgsLocked方法来调用其他方法，如onStartCommand方法：
private final void realStartServiceLocked(ServiceRecord r,
ProcessRecord app, boolean execInFg) throws RemoteException {
...
try {
...
app.thread.scheduleCreateService(r, r.serviceInfo,
mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
app.repProcState);
...
sendServiceArgsLocked(r, execInFg, true);
ApplicationThread#scheduleCreateService，同Activity，也是发送Message给Handler处理：
public final void scheduleCreateService(IBinder token,
ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
updateProcessState(processState, false);
CreateServiceData s = new CreateServiceData();
s.token = token;
s.info = info;
s.compatInfo = compatInfo;
sendMessage(H.CREATE_SERVICE, s);
}
Handler异步回调handleCreateService创建service：
- 通过ClassLoader创建service：
LoadedApk packageInfo = getPackageInfoNoCheck( data.info.applicationInfo, data.compatInfo); Service service = null; try { java.lang.ClassLoader cl = packageInfo.getClassLoader(); service = packageInfo.getAppFactory() .instantiateService(cl, data.info.name, data.intent); } catch (Exception e) { if (!mInstrumentation.onException(service, e)) { throw new RuntimeException( "Unable to instantiate service " + data.info.name + ": " + e.toString(), e); } } - 创建ContextImpl，并通过service的attach方法进行关联；视情况创建Application实例，同Activity；回调service的onCreate方法；最后，将service实例存储到ArrayMap中：
ContextImpl context = ContextImpl.createAppContext(this, packageInfo); context.setOuterContext(service); Application app = packageInfo.makeApplication(false, mInstrumentation); service.attach(context, this, data.info.name, data.token, app, ActivityManager.getService()); service.onCreate(); mServices.put(data.token, service);final ArrayMap
service创建完毕，之后会被远程调用handleServiceArgs方法，进而回调onStartCommand。
2. 绑定过程
Activity#bindService->ContextWrapper#bindService->ContextWrapper#bindServiceCommon，首先，通过LoadedApk#getServiceDispatcher方法，根据ServiceConnection得到IServiceConnection接口的Binder对象，因为bind操作可能是跨进程，所以要使用Binder支持IPC。然后调用AMS的远程bindService方法：
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler handler, UserHandle user) {
// Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser.
IServiceConnection sd;
...
if (mPackageInfo != null) {
sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
...
try {
...
int res = ActivityManager.getService().bindService(
mMainThread.getApplicationThread(), getActivityToken(), service,
service.resolveTypeIfNeeded(getContentResolver()),
sd, flags, getOpPackageName(), user.getIdentifier());
获得IServiceConnection接口Binder对象的过程：每个Context对应一个map，存储了
public final IServiceConnection getServiceDispatcher(ServiceConnection c,
Context context, Handler handler, int flags) {
synchronized (mServices) {
LoadedApk.ServiceDispatcher sd = null;
ArrayMap map = mServices.get(context);
if (map != null) {
if (DEBUG) Slog.d(TAG, "Returning existing dispatcher " + sd + " for conn " + c);
sd = map.get(c);
}
if (sd == null) {
sd = new ServiceDispatcher(c, context, handler, flags);
if (DEBUG) Slog.d(TAG, "Creating new dispatcher " + sd + " for conn " + c);
if (map == null) {
map = new ArrayMap<>();
mServices.put(context, map);
}
map.put(c, sd);
} else {
sd.validate(context, handler);
}
return sd.getIServiceConnection();
}
}
AMS#bindService->ActiveServices#bindServiceLocked->bringUpServiceLocked->realStartServiceLocked，之后的流程同创建Service，会通过ApplicationThread来完成service创建以及onCreate方法的回调。另外，realStartServiceLocked方法中，会调用requestServiceBindingsLocked(r, execInFg)方法，根据record执行app.thread.scheduleBindService来进行onBind回调：
private final void requestServiceBindingsLocked(ServiceRecord r, boolean execInFg)
throws TransactionTooLargeException {
for (int i=r.bindings.size()-1; i>=0; i--) {
IntentBindRecord ibr = r.bindings.valueAt(i);
if (!requestServiceBindingLocked(r, ibr, execInFg, false)) {
break;
}
}
}
private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,
boolean execInFg, boolean rebind) throws TransactionTooLargeException {
...
if ((!i.requested || rebind) && i.apps.size() > 0) {
try {
bumpServiceExecutingLocked(r, execInFg, "bind");
r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);
r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,
r.app.repProcState);
在ActivityThread中，同样是通过Handler，最终执行到其handleBindService方法。回调service的onBind方法，onBind返回一个Binder对象，通过AMS#publishService将其传递给client，client的onServiceConnected接收到，bind操作完成：
// ApplicationThread#scheduleBindService
public final void scheduleBindService(IBinder token, Intent intent,
boolean rebind, int processState) {
...
sendMessage(H.BIND_SERVICE, s);
}
private void handleBindService(BindServiceData data) {
Service s = mServices.get(data.token);
if (DEBUG_SERVICE)
Slog.v(TAG, "handleBindService s=" + s + " rebind=" + data.rebind);
if (s != null) {
try {
data.intent.setExtrasClassLoader(s.getClassLoader());
data.intent.prepareToEnterProcess();
try {
if (!data.rebind) {
IBinder binder = s.onBind(data.intent);
ActivityManager.getService().publishService(
data.token, data.intent, binder);
} else {
s.onRebind(data.intent);
ActivityManager.getService().serviceDoneExecuting(
data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
}
client接收Binder的具体过程：AMS#publishService->ActiveServices#publishServiceLocked，其关键代码c.conn.connected(r.name, service, false)，c.conn即IServiceConnection接口，对应之前的ServiceDispatcher.InnerConnection类型：
public void connected(ComponentName name, IBinder service, boolean dead)
throws RemoteException {
LoadedApk.ServiceDispatcher sd = mDispatcher.get();
if (sd != null) {
sd.connected(name, service, dead);
}
}
进而调用ServiceDispatcher#connected。这里的mActivityThread的类型为Handler，他是在创建ServiceDispatcher时，传递进来的ActivityThread的Handler实例。所以最终会通过该Handler在主线程执行RunConnection：
public void connected(ComponentName name, IBinder service, boolean dead) {
if (mActivityThread != null) {
mActivityThread.post(new RunConnection(name, service, 0, dead));
} else {
doConnected(name, service, dead);
}
}
RunConnection#run则执行了ServiceDispatcher#doConnected，client的onServiceConnected被调用：
public void doConnected(ComponentName name, IBinder service, boolean dead) {
...
// If there is a new viable service, it is now connected.
if (service != null) {
mConnection.onServiceConnected(name, service);
}
3.BroadcastReceiver
- 注册过程
静态注册，同其他三大组件，在应用安装时通过PMS（PackageManagerService）解析并注册。
动态注册过程如下。
ContextWrapper#registerReceiver->ContextImpl#registerReceiver->registerReceiverInternal。与bind service类似，也是先得到一个供远程AMS调用的Binder实例，类型为IIntentReceiver，实现类为ReceiverDispatcher.InnerReceiver；之后调用AMS#registerReceiver方法：
private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId,
IntentFilter filter, String broadcastPermission,
Handler scheduler, Context context, int flags) {
IIntentReceiver rd = null;
...
rd = new LoadedApk.ReceiverDispatcher(
receiver, context, scheduler, null, true).getIIntentReceiver();
}
}
try {
final Intent intent = ActivityManager.getService().registerReceiver(
mMainThread.getApplicationThread(), mBasePackageName, rd, filter,
broadcastPermission, userId, flags);
AMS#registerReceiver关键代码，将InnerReceiver远程Binder和IntentFilter对象存储起来：
public Intent registerReceiver(IApplicationThread caller, String callerPackage,
IIntentReceiver receiver, IntentFilter filter, String permission, int userId,
int flags) {
...
mRegisteredReceivers.put(receiver.asBinder(), rl);
...
BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage,
permission, callingUid, userId, instantApp, visibleToInstantApps);
if (rl.containsFilter(filter)) {
Slog.w(TAG, "Receiver with filter " + filter
+ " already registered for pid " + rl.pid
+ ", callerPackage is " + callerPackage);
} else {
rl.add(bf);
if (!bf.debugCheck()) {
Slog.w(TAG, "==> For Dynamic broadcast");
}
mReceiverResolver.addFilter(bf);
- 发送接收过程
从广播的发送开始。
ContextWrapper#sendBroadcast->ContextImpl#sendBroadcast->AMS#broadcastIntent->AMS#broadcastIntentLocked。首先，为其Intent中添加Intent.FLAG_EXCLUDE_STOPPED_PACKAGES，从Android 5.0起，默认不会向已经停止的app发送广播。如果希望向停止的app发送广播，添加Intent.FLAG_INCLUDE_STOPPED_PACKAGES即可，当两个flag同时存在，以include为准：
// By default broadcasts do not go to stopped apps.
intent.addFlags(Intent.FLAG_EXCLUDE_STOPPED_PACKAGES);
之后，broadcastIntentLocked的主要工作就是，根据intent-filter查找出匹配的receiver，终将满足的receiver添加到BroadcastRecord中，接着执行scheduleBroadcastsLocked方法发送广播：
int NR = registeredReceivers != null ? registeredReceivers.size() : 0;
if (!ordered && NR > 0) {
...
final BroadcastQueue queue = broadcastQueueForIntent(intent);
BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
callerPackage, callingPid, callingUid, callerInstantApp, resolvedType,
requiredPermissions, appOp, brOptions, registeredReceivers, resultTo,
resultCode, resultData, resultExtras, ordered, sticky, false, userId);
...
if (!replaced) {
queue.enqueueParallelBroadcastLocked(r);
queue.scheduleBroadcastsLocked();
}
registeredReceivers = null;
NR = 0;
}
...
if ((receivers != null && receivers.size() > 0)
|| resultTo != null) {
BroadcastQueue queue = broadcastQueueForIntent(intent);
BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp,
callerPackage, callingPid, callingUid, callerInstantApp, resolvedType,
requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode,
resultData, resultExtras, ordered, sticky, false, userId);
...
} else {
queue.enqueueOrderedBroadcastLocked(r);
queue.scheduleBroadcastsLocked();
}
BroadcastQueue#scheduleBroadcastsLocked只是发出一个message：
public void scheduleBroadcastsLocked() {
if (DEBUG_BROADCAST) Slog.v(TAG_BROADCAST, "Schedule broadcasts ["
+ mQueueName + "]: current="
+ mBroadcastsScheduled);
if (mBroadcastsScheduled) {
return;
}
mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
mBroadcastsScheduled = true;
}
之后，Handler调用processNextBroadcast->processNextBroadcastLocked。以无序广播为例，取出BroadcastRecord，遍历其中的receiver，调用deliverToRegisteredReceiverLocked方法向target发出广播：
// First, deliver any non-serialized broadcasts right away.
while (mParallelBroadcasts.size() > 0) {
r = mParallelBroadcasts.remove(0);
...
for (int i=0; ideliverToRegisteredReceiverLocked->performReceiveLocked，最终调用了app.thread.scheduleRegisteredReceiver，回到了ApplicationThread：
void performReceiveLocked(ProcessRecord app, IIntentReceiver receiver,
Intent intent, int resultCode, String data, Bundle extras,
boolean ordered, boolean sticky, int sendingUser) throws RemoteException {
// Send the intent to the receiver asynchronously using one-way binder calls.
if (app != null) {
if (app.thread != null) {
// If we have an app thread, do the call through that so it is
// correctly ordered with other one-way calls.
try {
app.thread.scheduleRegisteredReceiver(receiver, intent, resultCode,
data, extras, ordered, sticky, sendingUser, app.repProcState);
ApplicationThread#scheduleRegisteredReceiver->IIntentReceiver.performReceive，IIntentReceiver即为注册receiver时，创建的Binder对象实例，类型为ReceiverDispatcher.InnerReceiver：
public void scheduleRegisteredReceiver(IIntentReceiver receiver, Intent intent,
int resultCode, String dataStr, Bundle extras, boolean ordered,
boolean sticky, int sendingUser, int processState) throws RemoteException {
updateProcessState(processState, false);
receiver.performReceive(intent, resultCode, dataStr, extras, ordered,
sticky, sendingUser);
}
InnerReceiver#performReceive->ReceiverDispatcher#performReceive，该方法中，通过
创建一个Runnable，将调用onReceive的操作，交给mActivityThread即Handler去执行，该Handler就是ActivityThread中的H：
public void performReceive(Intent intent, int resultCode, String data,
Bundle extras, boolean ordered, boolean sticky, int sendingUser) {
final Args args = new Args(intent, resultCode, data, extras, ordered,
sticky, sendingUser);
...
if (intent == null || !mActivityThread.post(args.getRunnable())) {
最终，onReceive在主线程中被调用:
try {
ClassLoader cl = mReceiver.getClass().getClassLoader();
intent.setExtrasClassLoader(cl);
intent.prepareToEnterProcess();
setExtrasClassLoader(cl);
receiver.setPendingResult(this);
receiver.onReceive(mContext, intent);
4.ContentProvider
应用启动流程：
- VM调用ActivityThread的main方法。
- main方法中，会创建ActivityThread的实例，然后调用其attach方法；同时会创建主线程的消息队列。
- attch方法中，会调用AMS的远程方法attachApplication，将其ApplicationThread传递给AMS。ApplicationThread是个Binder对象，用于ActivityThread和AMS的通信。
- 在AMS的attachApplication方法中，会远程调用ApplicationThread的bindApplication方法，ApplicationThread转而交由ActivityThread的Handler处理，具体方法为handleBindApplication。
- 在handleBindApplication方法中，会创建Application对象，并加载ContentProvider。加载过程发生在回调Application的onCreate方法之前。
ContentProvider可以通过android:multiProcess来为其指定多实例，在每个调用者的进程中，都存在一个CopntentProvider实例。不过大部分的使用场景，ContentProvider为单实例。
访问ContentProvider使用的ContentResolver是个抽象类，getContentResolver得到的实例实际为ContextImpl.ApplicationContentResolver。当通过其四个方法访问ContentProvider时，其所在进程未启动，则会触发其创建，并伴随着ContentProvider的创建。这里以query为例。
ContentResolver#query首先调用了acquireUnstableProvider方法，来获取一个IContentProvider实例。然后调用了子类的acquireUnstableProvider方法，这里的mMainThread即是ActivityThread：
@Override
protected IContentProvider acquireUnstableProvider(Context c, String auth) {
return mMainThread.acquireProvider(c,
ContentProvider.getAuthorityWithoutUserId(auth),
resolveUserIdFromAuthority(auth), false);
}
ActivityThread#acquireProvider，首先会判断目标provider是否存在，如果存在直接返回；如果不存在则通过AMS#getContentProvider方法去创建他，最后通过installProvider修改引用计数：
public final IContentProvider acquireProvider(
Context c, String auth, int userId, boolean stable) {
final IContentProvider provider = acquireExistingProvider(c, auth, userId, stable);
if (provider != null) {
return provider;
}
...
try {
synchronized (getGetProviderLock(auth, userId)) {
holder = ActivityManager.getService().getContentProvider(
getApplicationThread(), auth, userId, stable);
...
// Install provider will increment the reference count for us, and break
// any ties in the race.
holder = installProvider(c, holder, holder.info,
true /*noisy*/, holder.noReleaseNeeded, stable);
return holder.provider;
}
AMS#getContentProvider->AMS#getContentProviderImpl->startProcessLocked->startProcess，首先创建目标进程。具体为调用了Process.start方法：
private ProcessStartResult startProcess(String hostingType, String entryPoint,
ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
String seInfo, String requiredAbi, String instructionSet, String invokeWith,
long startTime) {
...
startResult = Process.start(entryPoint,
app.processName, uid, uid, gids, runtimeFlags, mountExternal,
app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
app.info.dataDir, invokeWith,
new String[] {PROC_START_SEQ_IDENT + app.startSeq});
新进程启动后，其入口方法为ActivityThread#main：
public static void main(String[] args) {
...
ActivityThread thread = new ActivityThread();
thread.attach(false, startSeq);
if (sMainThreadHandler == null) {
sMainThreadHandler = thread.getHandler();
}
if (false) {
Looper.myLooper().setMessageLogging(new
LogPrinter(Log.DEBUG, "ActivityThread"));
}
// End of event ActivityThreadMain.
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
如前述，Activity#attach->AMS#attachApplication->AMS#attachApplicationImpl->ApplicationThread#bindApplication，然后交由ActivityThread的Handler处理，具体在handleBindApplication方法：
首先，创建ContextImpl和Instrumentation：
final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);
try {
final ClassLoader cl = instrContext.getClassLoader();
mInstrumentation = (Instrumentation)
cl.loadClass(data.instrumentationName.getClassName()).newInstance();
} catch (Exception e) {
throw new RuntimeException(
"Unable to instantiate instrumentation "
+ data.instrumentationName + ": " + e.toString(), e);
}
final ComponentName component = new ComponentName(ii.packageName, ii.name);
mInstrumentation.init(this, instrContext, appContext, component,
data.instrumentationWatcher, data.instrumentationUiAutomationConnection);
创建Application：
Application app;
...
try {
// If the app is being launched for full backup or restore, bring it up in
// a restricted environment with the base application class.
app = data.info.makeApplication(data.restrictedBackupMode, null);
...
mInitialApplication = app;
创建ContentProvider，并调用其onCreate方法。
- installContentProviders方法中，遍历当前进程的ProviderInfo列表，一一调用其installProvider方法来启动他们。然后将ContentProvider发布到AMS当中，AMS会把其存储在ProviderMap中，下次调用便可直接获得provider实例：
installContentProviders(app, data.providers);
private void installContentProviders(
Context context, List providers) {
final ArrayList results = new ArrayList<>();
for (ProviderInfo cpi : providers) {
if (DEBUG_PROVIDER) {
StringBuilder buf = new StringBuilder(128);
buf.append("Pub ");
buf.append(cpi.authority);
buf.append(": ");
buf.append(cpi.name);
Log.i(TAG, buf.toString());
}
ContentProviderHolder cph = installProvider(context, null, cpi,
false /*noisy*/, true /*noReleaseNeeded*/, true /*stable*/);
if (cph != null) {
cph.noReleaseNeeded = true;
results.add(cph);
}
}
try {
ActivityManager.getService().publishContentProviders(
getApplicationThread(), results);
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}
}
- provider的具体创建过程在installProvider方法中完成。通过ClassLoader创建provider对象，然后调用其attachInfo回调onCreate方法：
private ContentProviderHolder installProvider(Context context,
ContentProviderHolder holder, ProviderInfo info,
boolean noisy, boolean noReleaseNeeded, boolean stable) {
...
try {
final java.lang.ClassLoader cl = c.getClassLoader();
LoadedApk packageInfo = peekPackageInfo(ai.packageName, true);
if (packageInfo == null) {
// System startup case.
packageInfo = getSystemContext().mPackageInfo;
}
localProvider = packageInfo.getAppFactory()
.instantiateProvider(cl, info.name);
...
localProvider.attachInfo(c, info);
provider创建完成，调用Application的onCreate方法：
try {
mInstrumentation.callApplicationOnCreate(app);
至此，ContentProvider创建完成，其进程的Application也创建完成。使用ContentProvider时，实际上是通过获得的IContentProvider接口去执行远程调用，实际类型为ContentProvider.Transport，其query方法：
@Override
public Cursor query(String callingPkg, Uri uri, @Nullable String[] projection,
@Nullable Bundle queryArgs, @Nullable ICancellationSignal cancellationSignal) {
...
try {
return ContentProvider.this.query(
uri, projection, queryArgs,
CancellationSignal.fromTransport(cancellationSignal));
调用ContentProvider的query方法，然后通过Binder传递给client，完成了一次调用，其他方法类似。