App 启动流程全解析

概述

Activity 启动过程分为两种，一种是根Activity的启动过程，另一种是普通Activity的启动过程。这里介绍是是根Activity的启动过程，也可以理解为应用程序启动过程。

Launcher 请求AMS过程

Launcher 启动后会将已安装应用程序的快捷图标显示到桌面上，这些应用程序的快捷图标就是启动根Activity的入口，当我们点击某个应用程序的快捷图标时，就会通过Launcher请求AMS来启动该应用程序。

Launcher请求AMS的时序图

流程分析

当点击应用程序的快捷图标时，就会调用Launcher的startActivitySafely方法。

//基于Android11 源码， packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

public boolean startActivitySafely(View v, Intent intent, ItemInfo item, @Nullable String sourceContainer) {
    ...
    boolean success = super.startActivitySafely(v, intent, item, sourceContainer);
    ...
     return success;
}


//基于Android11 源码， /packages/apps/Launcher3/src/com/android/launcher3/BaseDraggingActivity.java

public boolean startActivitySafely(View v, Intent intent, @Nullable ItemInfo item,@Nullable String sourceContainer) {
    
    ...
    // 将Flag 设置为Intent.FLAG_ACTIVITY_NEW_TASK,这样根Activity会在新的任务栈中启动
    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
          intent.setSourceBounds(getViewBounds(v));
        }
        try {
            boolean isShortcut = (item instanceof WorkspaceItemInfo)
                    && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT
                    || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT)
                    && !((WorkspaceItemInfo) item).isPromise();
            if (isShortcut) {
                // Shortcuts need some special checks due to legacy reasons.
                startShortcutIntentSafely(intent, optsBundle, item, sourceContainer);
            } else if (user == null || user.equals(Process.myUserHandle())) {
                // startActivity方法在Activity 中实现
                startActivity(intent, optsBundle);
                AppLaunchTracker.INSTANCE.get(this).onStartApp(intent.getComponent(),
                        Process.myUserHandle(), sourceContainer);
            } else {
                getSystemService(LauncherApps.class).startMainActivity(
                        intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
                AppLaunchTracker.INSTANCE.get(this).onStartApp(intent.getComponent(), user,
                        sourceContainer);
            }
            getUserEventDispatcher().logAppLaunch(v, intent, user);
            if (item != null) {
                InstanceId instanceId = new InstanceIdSequence().newInstanceId();
                logAppLaunch(item, instanceId);
            }
            return true;
        } catch (NullPointerException|ActivityNotFoundException|SecurityException e) {
            Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();
            Log.e(TAG, "Unable to launch. tag=" + item + " intent=" + intent, e);
        }
        return false;
    
}

从上面的代码可知，Launcher的startActivitySafely方法 会调用其父类BaseDraggingActivity的startActivitySafely方法，最终会调用 Activity的startActivity方法。下面分析Activity的相关方法：

//  基于Android11 源码， frameworks/base/core/java/android/app/Activity.java

@Override
    public void startActivity(Intent intent, @Nullable Bundle options) {
        ...
        if (options != null) {
            startActivityForResult(intent, -1, options);
        } else {
            // Note we want to go through this call for compatibility with
            // applications that may have overridden the method.
            startActivityForResult(intent, -1);
        }
    }

在startActivity方法中调用startActivityForResult 方法，它的第二个参数为-1表示Launcher不需要知道Activity启动的结果。

//  基于Android11 源码， frameworks/base/core/java/android/app/Activity.java

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
        } else {
            ....
        }
    }

在上面的代码中，主要关注mParent==null这部分逻辑，mParent是Activity类型的，表示当前Activity的父类。因为目前根Activity 还没创建出来，所以mParent == null成立。

代码中需要注意 mMainThread.getApplicationThread()这个参数，它的类型是ApplicationThread，ApplicationThread是ActivityThread的一个内部类，继承IApplicationThread.Stub，是个Binder对象。Instrumentation主要用来监控应用程序和系统交互，下面接着分析Instrumentation 的execStartActivity方法：

//  基于Android11 源码， frameworks/base/core/java/android/app/Instrumentation.java

public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        .....
        try {
            intent.migrateExtraStreamToClipData(who);
            intent.prepareToLeaveProcess(who);
            int result = ActivityTaskManager.getService().startActivity(whoThread,
                    who.getBasePackageName(), who.getAttributionTag(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                    target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

从上面的代码来看，启动Activity真正的实现由ActivityTaskManager.getService()的startActivity() 方法来完成。ActivityTaskManager.getService()返回值是IActivityTaskManager类型对象，这个类型对象采用单例模式对外提供。

//  基于Android11 源码， frameworks/base/core/java/android/app/ActivityTaskManager.java

    public static IActivityTaskManager getService() {
        return IActivityTaskManagerSingleton.get();
    }

    @UnsupportedAppUsage(trackingBug = 129726065)
    private static final Singleton<IActivityTaskManager> IActivityTaskManagerSingleton =
            new Singleton<IActivityTaskManager>() {
                @Override
                protected IActivityTaskManager create() {
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE);
                    return IActivityTaskManager.Stub.asInterface(b);
                }
            };

从上面的代码分析来看，得到一个IBinder对象，意味着获取一个跨进程的服务，这个服务就是ActivityTaskManagerService。ActivityTaskManagerService 继承自IActivityTaskManager.Stub，是其实现类，它是个Binder对象。

Activity是由ActivityTaskManager.getService()来启动的，而ActivityTaskManager.getService()实际上是ActivityTaskManagerService，因此Activity的启动过程又转移到ActivityTaskManagerService中，这个过程意味着Activity的启动跨进程（IPC）,转移到系统进程提供的服务ActivityTaskManagerService中了。

ATMS 到ApplicationThread 过程

ATMS 到ApplicationThread 的时序图

流程分析

为了继续分析这个过程，只需要查看ActivityTaskManagerService的startActivity 方法。

//  基于Android11 源码，frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java

public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
   
    @Override
    public final int startActivity(IApplicationThread caller, String callingPackage,
            String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
            String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
            Bundle bOptions) {
        return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType,
                resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions,
                UserHandle.getCallingUserId());
    }
    
     @Override
    public int startActivityAsUser(IApplicationThread caller, String callingPackage,
            String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
            String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
            Bundle bOptions, int userId) {
        return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType,
                resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions, userId,
                true /*validateIncomingUser*/);
    }
    
    private int startActivityAsUser(IApplicationThread caller, String callingPackage,
            @Nullable String callingFeatureId, Intent intent, String resolvedType,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
        assertPackageMatchesCallingUid(callingPackage);
        enforceNotIsolatedCaller("startActivityAsUser");

        userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser,
                Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");

        // TODO: Switch to user app stacks here.
        return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
                .setCaller(caller)
                .setCallingPackage(callingPackage)
                .setCallingFeatureId(callingFeatureId)
                .setResolvedType(resolvedType)
                .setResultTo(resultTo)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setStartFlags(startFlags)
                .setProfilerInfo(profilerInfo)
                .setActivityOptions(bOptions)
                .setUserId(userId)
                .execute();

    }
}

从上面的代码分析来看，ActivityTaskManagerService的startActivity方法最终调用了ActivityStartController 的obtainStarter 方法 得到ActivityStarter 对象。

ActivityTaskManagerService是在Android10中新增的，分担了之前ActivityManagerService的一部分功能（activitytask相关）。ActivityTaskManagerService是用于管理Activity及其容器（任务、堆栈、显示等）的系统服务，运行在系统服务进程（system_server）之中。

接下来分析ActivityStarter类，该类主要是启动Activity 的控制器

//  基于Android11 源码， frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

class ActivityStarter {
  
  private final ActivityStackSupervisor mSupervisor;

  Request mRequest = new Request();
  
  ActivityStarter setCaller(IApplicationThread caller) {
        mRequest.caller = caller;
        return this;
  }
  
 ...
    
    // 执行开始启动活动的请求
    int execute() {
         
        try {
            .....
            synchronized (mService.mGlobalLock) {
                ...
                // 执行活动启动请求
                res = executeRequest(mRequest);
            }
            ....    
        }finally {
            onExecutionComplete();
        }   
    }
}

从上面的代码分析来看，ActivityStarter通过一系列set方法，配置开启Activity需要的参数，通过executeRequest()执行开启Activity.下面具体分析executeRequest方法：

//  基于Android11 源码， frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

private int executeRequest(Request request) {
   // 创建了ActivityRecord 对象，存储activity相关的信息
   final ActivityRecord r = new ActivityRecord(mService, callerApp, callingPid, callingUid,
                callingPackage, callingFeatureId, intent, resolvedType, aInfo,
                mService.getGlobalConfiguration(), resultRecord, resultWho, requestCode,
                request.componentSpecified, voiceSession != null, mSupervisor, checkedOptions,
                sourceRecord);
        mLastStartActivityRecord = r;
    
    // 持有必要权限开启Activity,或者在启动不成功时删除启动活动
     mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
                request.voiceInteractor, startFlags, true /* doResume */, checkedOptions, inTask,
                restrictedBgActivity, intentGrants);
    
    return mLastStartActivityResult;            
}

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
                IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                int startFlags, boolean doResume, ActivityOptions options, Task inTask,
                boolean restrictedBgActivity, NeededUriGrants intentGrants) {
       final ActivityStack startedActivityStack;
        try {
           ...
            result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                    startFlags, doResume, options, inTask, restrictedBgActivity, intentGrants);
        } finally {
          ...
        }

       ....

        return result;             
}

int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            boolean restrictedBgActivity, NeededUriGrants intentGrants) {
    ...
 if (mDoResume) {
  final ActivityRecord topTaskActivity =
  mStartActivity.getTask().topRunningActivityLocked(); 
  if (!mTargetStack.isTopActivityFocusable()
                    || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                    && mStartActivity != topTaskActivity)) {
    mTargetStack.ensureActivitiesVisible(null /* starting */,
                        0 /* configChanges */, !PRESERVE_WINDOWS);
    mTargetStack.getDisplay().mDisplayContent.executeAppTransition();
 }else {
   if (mTargetStack.isTopActivityFocusable()&&!mRootWindowContainer.isTopDisplayFocusedStack(mTargetStack)) {
     mTargetStack.moveToFront("startActivityInner");
       
   }
   // 这里调用RootActivityContainer类相关方法
    mRootWindowContainer.resumeFocusedStacksTopActivities(mTargetStack, mStartActivity, mOptions);
  }
 }
    ....                
}

从上面的代码来看，executeRequest方法调用了startActivityUnchecked方法，接着又调用了startActivityInner方法，最终调用RootActivityContainer类resumeFocusedStacksTopActivities方法。

RootActivityContainer是Android10新增的类，分担了之前ActivityStackSupervisor的部分功能。下面来看下RootActivityContainer类resumeFocusedStacksTopActivities方法：

// 基于Android11 源码，frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java

boolean resumeFocusedStacksTopActivities(
            ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
    boolean result = false;
        if (targetStack != null && (targetStack.isTopStackInDisplayArea()
                || getTopDisplayFocusedStack() == targetStack)) {
            result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
        }
    
    for (int displayNdx = getChildCount() - 1; displayNdx >= 0; --displayNdx) {
        ....
        
        if (!resumedOnDisplay) {
            final ActivityStack focusedStack = display.getFocusedStack();
                if (focusedStack != null) {
                    result |= focusedStack.resumeTopActivityUncheckedLocked(target, targetOptions);
                } else if (targetStack == null) {
                    result |= resumeHomeActivity(null /* prev */, "no-focusable-task",
                            display.getDefaultTaskDisplayArea());
                }
        }
    }        
}

以上代码，通过RootActivityContainer，将调用ActivityStack的resumeTopActivityUncheckedLocked方法，下面查看相关代码：

// 基于Android11 源码, /frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java
 
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
    
    try {
            // Protect against recursion.
            mInResumeTopActivity = true;
            result = resumeTopActivityInnerLocked(prev, options);
            final ActivityRecord next = topRunningActivity(true /* focusableOnly */);
            if (next == null || !next.canTurnScreenOn()) {
                checkReadyForSleep();
            }
        } finally {
            mInResumeTopActivity = false;
        }

        return result;
}

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
    ....
    boolean pausing = taskDisplayArea.pauseBackStacks(userLeaving, next);
        if (mResumedActivity != null) {
            if (DEBUG_STATES) Slog.d(TAG_STATES,
                    "resumeTopActivityLocked: Pausing " + mResumedActivity);
            // 暂停上一个Activity        
            pausing |= startPausingLocked(userLeaving, false /* uiSleeping */, next);
        }
    ....
 //只有启动了的Activity才会返回true    
 if (next.attachedToProcess()) {
   try {
      final ClientTransaction transaction =
         ClientTransaction.obtain(next.app.getThread(), next.appToken); 
      ....
    transaction.setLifecycleStateRequest(
          ResumeActivityItem.obtain(next.app.getReportedProcState(),dc.isNextTransitionForward()));
    mAtmService.getLifecycleManager().scheduleTransaction(transaction);
    }catch (Exception e) {
       .....
       mStackSupervisor.startSpecificActivity(next, true, false);
        return true;
    }       
 }else{
    if (!next.hasBeenLaunched) {
                next.hasBeenLaunched = true;
        } else {
          if (SHOW_APP_STARTING_PREVIEW) {
         //冷启动时出现白屏的原因  
        next.showStartingWindow(null /* prev */, false /* newTask */,  false /* taskSwich */);
        }
         if (DEBUG_SWITCH) Slog.v(TAG_SWITCH,"Restarting: " + next);
                
       }
       
       if (DEBUG_STATES) Slog.d(TAG_STATES, "resumeTopActivityLocked: Restarting " + next);
        // 普通activity的正常启动
        mStackSupervisor.startSpecificActivity(next, true, true);
 }
   
}

 final boolean startPausingLocked(boolean userLeaving, boolean uiSleeping,
            ActivityRecord resuming) {
    if (prev.attachedToProcess()) {
            if (DEBUG_PAUSE) Slog.v(TAG_PAUSE, "Enqueueing pending pause: " + prev);
            try {
                ......
              mAtmService.getLifecycleManager().scheduleTransaction(prev.app.getThread(),
                        prev.appToken, PauseActivityItem.obtain(prev.finishing, userLeaving,
                                prev.configChangeFlags, pauseImmediately));
            } catch (Exception e) {
               .....
            }
        }        
                    
}

从上面的代码看，主要有两个重要操作：一个是调用函数startPausingLocked，通知上一个Activity执行onPause；另一个是通知启动新的Activity。ActivityStack类主要作用是决定怎样发送生命周期的信号到应用进程。

下面继续看ActivityStackSupervisor类的startSpecificActivity 方法.

// 基于Android11 源码，/frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java

void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
    
    final WindowProcessController wpc =
        mService.getProcessController(r.processName, r.info.applicationInfo.uid);
    
        boolean knownToBeDead = false;
        // 是否启动了应用进程
        if (wpc != null && wpc.hasThread()) {
            try {
               //如果应用进程已启动，去创建Activity
                realStartActivityLocked(r, wpc, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            knownToBeDead = true;
        }
    ....    

    final boolean isTop = andResume && r.isTopRunningActivity();
    mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
}

 void startProcessAsync(ActivityRecord activity, boolean knownToBeDead, boolean isTop,String hostingType) {
        try {
            ....
            // 说明没有进程，就会创建进程
            final Message m = PooledLambda.obtainMessage(ActivityManagerInternal::startProcess,
                    mAmInternal, activity.processName, activity.info.applicationInfo, knownToBeDead,
                    isTop, hostingType, activity.intent.getComponent());
            mH.sendMessage(m);
        } finally {
            Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
        }
    }
    
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig) throws RemoteException {
    
    ..... 
    //ClientTransaction是包含一系列的待客户端处理的事务的容器，客户端接收后取出事务并执行
    // 其中参数proc.getThread()是IApplicationThread
    final ClientTransaction clientTransaction = ClientTransaction.obtain(
                        proc.getThread(), r.appToken);                
    
    final DisplayContent dc = r.getDisplay().mDisplayContent;
    // 通过addCallback 方法添加LaunchActivityItem，LaunchActivityItem用来启动activity
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),System.identityHashCode(r), r.info,mergedConfiguration.getGlobalConfiguration(),
                mergedConfiguration.getOverrideConfiguration(), r.compat,
        r.launchedFromPackage, task.voiceInteractor, proc.getReportedProcState(),
        r.getSavedState(), r.getPersistentSavedState(), results, newIntents,
        dc.isNextTransitionForward(), proc.createProfilerInfoIfNeeded(),
        r.assistToken, r.createFixedRotationAdjustmentsIfNeeded()));
    
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) {
        lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward());
    } else {
        lifecycleItem = PauseActivityItem.obtain();
    }
    clientTransaction.setLifecycleStateRequest(lifecycleItem);
    // 通过ATMS的getLifecycleManager() 得到ClientLifecycleManager
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    .....
}

从上面的代码分析来看，通过 if (wpc != null && wpc.hasThread())判断是否启动了应用进程，内部是通过IApplicationThread是否为空来判断。接着继续查看应用进程启动情况下，调用了realStartActivityLocked 方法。在方法中调用了mService.getLifecycleManager().scheduleTransaction(clientTransaction)，mService是ActivityTaskManagerService（ATMS），getLifecycleManager()方法获取的是ClientLifecycleManager实例。下面分析ClientLifecycleManage类的scheduleTransaction方法：

// 基于Android11 源码，frameworks/base/services/core/java/com/android/server/wm/ClientLifecycleManager.java

class ClientLifecycleManager {
 
 void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        final IApplicationThread client = transaction.getClient();
        transaction.schedule();
        if (!(client instanceof Binder)) {
            transaction.recycle();
        }
 }
 
}

frameworks/base/core/java/android/app/servertransaction/ClientTransaction.java

public class ClientTransaction implements Parcelable, ObjectPoolItem {
    
    /** Target client. */
    private IApplicationThread mClient;
 
    public void schedule() throws RemoteException {
        mClient.scheduleTransaction(this);
    } 
 }

从上面代码来看，mClient是IApplicationThread类型，调用scheduleTransaction()方法。由于IApplicationThread是ApplicationThread在系统进程的代理，所以真正执行的地方就是客户端的ApplicationThread。也就是说，Activity启动的操作又跨进程的还给了客户端。

小结

当前代码逻辑运行在AMS所在的进程（SystemServer进程）中，通过ApplicationThread 来与应用程序进行Binder通信。

ActivityThead 启动 Activity 的过程

ActivityThead 启动 Activity的时序图

流程分析

目前的代码逻辑运行在应用程序中，接下来查看ActivityThead 源码：

// 基于Android11 源码，frameworks/base/core/java/android/app/ActivityThread.java

public final class ActivityThread extends ClientTransactionHandler {
  final H mH = new H();
  
  private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);

  .....
  private class ApplicationThread extends IApplicationThread.Stub {
      @Override
      public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
           ActivityThread.this.scheduleTransaction(transaction);
      }
 
  }
  
  void sendMessage(int what, Object obj) {
      sendMessage(what, obj, 0, 0, false);
  }
  
  private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        if (DEBUG_MESSAGES) {
            Slog.v(TAG,
                    "SCHEDULE " + what + " " + mH.codeToString(what) + ": " + arg1 + " / " + obj);
        }
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        mH.sendMessage(msg);
    }
 
 class H extends Handler {
    ...
    public static final int EXECUTE_TRANSACTION = 159;
    ...
    
    public void handleMessage(Message msg) {
    ...
       case EXECUTE_TRANSACTION:
            final ClientTransaction transaction = (ClientTransaction) msg.obj;
            mTransactionExecutor.execute(transaction);
            if (isSystem()) {
                transaction.recycle();
            }
            break;        
     ...   
    }
    
   }
  .....
}

// 基于Android11 源码，frameworks/base/core/java/android/app/ClientTransactionHandler.java

public abstract class ClientTransactionHandler {

    void scheduleTransaction(ClientTransaction transaction) {
        transaction.preExecute(this);
        sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
    }
    
    abstract void sendMessage(int what, Object obj);
    ....
}

从上面的代码分析来看，ApplicationThread调用了scheduleTransaction()方法,实际上调用了ActivityThread 父类ClientTransactionHandler的scheduleTransaction()方法，方法中调用了抽象的sendMessage()方法，真正实现的是ActivityThread类sendMessage()方法。

mH是自定义Handler子类H的实例，使用sendMessage就把消息发送到了主线程。这个消息是由ApplicationThread的scheduleTransaction方法发送的，该方法执行在Binder的线程池中（服务器的Binder方法运行在Binder的线程池中，也就是说系统进行跨进程调用ApplicationThread的scheduleTransaction就是执行在Binder的线程池中）。

Handler类的handleMessage方法中，该行代码mTransactionExecutor.execute(transaction)执行启动Activity逻辑。下面接着分析TransactionExecutor 的execute 方法：

//  基于Android11 源码，frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {

    final IBinder token = transaction.getActivityToken();
    ....
    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    
    ...
}

public void executeCallbacks(ClientTransaction transaction) {
    
    final IBinder token = transaction.getActivityToken();
    ActivityClientRecord r = mTransactionHandler.getActivityClient(token);
    ....
    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        ...
        item.execute(mTransactionHandler, token, mPendingActions);
        item.postExecute(mTransactionHandler, token, mPendingActions);
        ...
    }
    ....
}

从上面代码分析来看，遍历Callbacks，调用ClientTransactionItem的execute方法，真正实现的是其子类LaunchActivityItem的execute方法：

//  基于Android11 源码，frameworks/base/core/java/android/app/servertransaction/LaunchActivityItem.java
 
 public class LaunchActivityItem extends ClientTransactionItem {
     
@Override
public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
        ....
        ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
                mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
                mPendingResults, mPendingNewIntents, mIsForward,
                mProfilerInfo, client, mAssistToken, mFixedRotationAdjustments);
        client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
        .....
    }
 }
 

从上面的代码来看，调用了client.handleLaunchActivity方法，client是ClientTransactionHandler类的实例。下面来分析下调用过程：

// TransactionExecutor 类源码

public class TransactionExecutor {
    // clientTransactionHandler 作为TransactionExecutor类的构造函数的参数传入的
    public TransactionExecutor(ClientTransactionHandler clientTransactionHandler) {
        mTransactionHandler = clientTransactionHandler;
    }
}

// ActivityThread 类源码
public final class ActivityThread extends ClientTransactionHandler {
    ....
    private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this);
    ....
    
    public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionActions pendingActions, Intent customIntent) {
        
        ...
        
         final Activity a = performLaunchActivity(r, customIntent);
         
         ...
    }
}

从代码分析来看，mTransactionExecutor是在ActivityThread中创建实例，而且ActivityThread是ClientTransactionHandler的子类，并且作为ClientTransactionHandler构造方法的参数传入，所以client.handleLaunchActivity方法就是ActivityThread的handleLaunchActivity方法。

接着，继续看ActivityThread类的handleLaunchActivity方法

// ActivityThread 类源码

public final class ActivityThread extends ClientTransactionHandler {
    ....
    public LoadedApk packageInfo;
    
    private final TransactionExecutor 
    mTransactionExecutor = new TransactionExecutor(this);
    ....
    
  @Override
    public Activity handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, Intent customIntent) {
        ....
        final Activity a = performLaunchActivity(r, customIntent);
        ....
    }
    
    // activity 启动的核心实现
    private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
        // 从ActivityClientRecord获取待启动的Activity的组件信息
        ActivityInfo aInfo = r.activityInfo; 
        if (r.packageInfo == null) {
            r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                    Context.CONTEXT_INCLUDE_CODE);
        }
        
        ComponentName component = r.intent.getComponent();
        if (component == null) {
            component = r.intent.resolveActivity(
                mInitialApplication.getPackageManager());
            r.intent.setComponent(component);
        }
        
        if (r.activityInfo.targetActivity != null) {
            component = new ComponentName(r.activityInfo.packageName,
                    r.activityInfo.targetActivity);
        }
        //创建ContextImpl对象
        ContextImpl appContext = createBaseContextForActivity(r);
        Activity activity = null;
        try {
            java.lang.ClassLoader cl = appContext.getClassLoader();
            //创建activity实例
            activity = mInstrumentation.newActivity(
                    cl, component.getClassName(), r.intent);
            StrictMode.incrementExpectedActivityCount(activity.getClass());
            r.intent.setExtrasClassLoader(cl);
            r.intent.prepareToEnterProcess();
            if (r.state != null) {
                r.state.setClassLoader(cl);
            }
        } catch (Exception e) {
            ....
        }
        try {
            // 创建Application对象
            Application app = r.packageInfo.makeApplication(false, mInstrumentation);
            ....
            if (activity != null) {
                CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
                Configuration config = new Configuration(mCompatConfiguration);
                if (r.overrideConfig != null) {
                    config.updateFrom(r.overrideConfig);
                }
                ....
                Window window = null;
                if (r.mPendingRemoveWindow != null && r.mPreserveWindow) {
                    window = r.mPendingRemoveWindow;
                    r.mPendingRemoveWindow = null;
                    r.mPendingRemoveWindowManager = null;
                }

                // Activity resources must be initialized with the same loaders as the
                // application context.
                appContext.getResources().addLoaders(
                        app.getResources().getLoaders().toArray(new ResourcesLoader[0]));

                appContext.setOuterContext(activity);
                //attach方法关联上下文环境
                activity.attach(appContext, this, getInstrumentation(), r.token,
                        r.ident, app, r.intent, r.activityInfo, title, r.parent,
                        r.embeddedID, r.lastNonConfigurationInstances, config,
                        r.referrer, r.voiceInteractor, window, r.configCallback,
                        r.assistToken);

                if (customIntent != null) {
                    activity.mIntent = customIntent;
                }
                r.lastNonConfigurationInstances = null;
                checkAndBlockForNetworkAccess();
                activity.mStartedActivity = false;
                int theme = r.activityInfo.getThemeResource();
                if (theme != 0) {
                    activity.setTheme(theme);
                }

                activity.mCalled = false;
                // 调用生命周期onCreate方法
                if (r.isPersistable()) {
                    mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
                } else {
                    mInstrumentation.callActivityOnCreate(activity, r.state);
                }
                ....
                r.activity = activity;
                mLastReportedWindowingMode.put(activity.getActivityToken(),
                        config.windowConfiguration.getWindowingMode());
            }
            r.setState(ON_CREATE);
             ....
        } catch (SuperNotCalledException e) {
            throw e;

        } catch (Exception e) {
           ....
        }

        return activity;
    }
}

从以上代码分析来看，performLaunchActivity 方法主要完成如下工作：

• 从ActivityClientRecord中获取待启动的Activity的组件信息
• 通过mInstrumentation.newActivity方法使用类加载器创建activity实例。
• 通过LoadedApk的makeApplication方法创建Application对象，makeApplication方法内部调用了instrumentation.callApplicationOnCreate方法，也就是Application的onCreate方法。
• 创建ContextImpl对象并通过activity的attach方法对重要数据初始化。ContextImpl是Context的具体实现，Context中大部分逻辑都是由ContextImpl来完成的。ContextImpl是通过Activity的attach方法来和Activity建立关联的，除此之外，在attach方法中Activity还会完成window的创建并建立自己和Window的关联，这样当Window接收到外部输入事件后就可以将事件传递给Activity。
• 调用Activity的onCreate方法，是通过mInstrumentation.callActivityOnCreate方法完成。

接着分析Instrumentation的callActivityOnCreate方法：

// Android11源码，frameworks/base/core/java/android/app/Instrumentation.java

public void callActivityOnCreate(Activity activity, Bundle icicle, PersistableBundle persistentState) {
   prePerformCreate(activity);
   activity.performCreate(icicle, persistentState);
    postPerformCreate(activity);
}

//Android11源码，frameworks/base/core/java/android/app/Activity.java

final void performCreate(Bundle icicle, PersistableBundle persistentState) {
    ...
    if (persistentState != null) {
       onCreate(icicle, persistentState);
    }else {
        onCreate(icicle);
    }
    ...
}

在performCreate方法中调用Activity的onCreate方法，到这里，根Activity就启动了，即应用程序就启动了。

Activity 显示过程

下面接着分析Activity的onStart方法、onResume方法如何被调用？查看ActivityStackSupervisor的realStartActivityLocked方法

//  Android11源码  ActivityStackSupervisor类 

boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig) throws RemoteException {
    
    try {
                ....
                // Create activity launch transaction.
                final ClientTransaction clientTransaction = ClientTransaction.obtain(
                        proc.getThread(), r.appToken);

                final DisplayContent dc = r.getDisplay().mDisplayContent;
                clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                        System.identityHashCode(r), r.info,
                        mergedConfiguration.getGlobalConfiguration(),
                        mergedConfiguration.getOverrideConfiguration(), r.compat,
                        r.launchedFromPackage, task.voiceInteractor, proc.getReportedProcState(),
                        r.getSavedState(), r.getPersistentSavedState(), results, newIntents,
                        dc.isNextTransitionForward(), proc.createProfilerInfoIfNeeded(),
                        r.assistToken, r.createFixedRotationAdjustmentsIfNeeded()));

                // Set desired final state.
                final ActivityLifecycleItem lifecycleItem;
                if (andResume) {
                    lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward());
                } else {
                    lifecycleItem = PauseActivityItem.obtain();
                }
                clientTransaction.setLifecycleStateRequest(lifecycleItem);

                // Schedule transaction.
                mService.getLifecycleManager().scheduleTransaction(clientTransaction);

               ......

            } catch (RemoteException e) {
               ....
            }
        } finally {
           ....
        }    
                
                 
}

以上源码中，clientTransaction.addCallback()添加LaunchActivityItem实例,下面接着调用了clientTransaction.setLifecycleStateRequest(lifecycleItem)方法，lifecycleItem是ResumeActivityItem或PauseActivityItem实例。通过clientTransaction.setLifecycleStateRequest(lifecycleItem)方法设置生命周期状态的请求，最终交由TransactionExecutor类的execute方法执行。

//Android11源码  TransactionExecutor类 

public void execute(ClientTransaction transaction) {

    final IBinder token = transaction.getActivityToken();
    ....
    executeCallbacks(transaction);
    // 发起请求，执行该方法
    executeLifecycleState(transaction);
    
    ...
}

private void executeLifecycleState(ClientTransaction transaction) {
        final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
        if (lifecycleItem == null) {
            // No lifecycle request, return early.
            return;
        }

        final IBinder token = transaction.getActivityToken();
        final ActivityClientRecord r = mTransactionHandler.getActivityClient(token);
        ....

        // Execute the final transition with proper parameters.
        lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
        lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
}

//Android11源码  ResumeActivityItem类 

@Override
public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
    client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
                "RESUME_ACTIVITY");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

从以上源码可以看出，在executeLifecycleState()方法中通过getLifecycleStateRequest()得到ActivityLifecycleItem实例，并调用execute() 方法，实际上是调用了ResumeActivityItem 类的方法，因为它是抽象类ActivityLifecycleItem的具体实现。
在ResumeActivityItem类execute()方法调用client.handleResumeActivity,经上文中可知，实际上走到ActivityThread的handleResumeActivity方法。

//Android11源码  ActivityThread类 

@Override
public void handleResumeActivity(IBinder token, boolean finalStateRequest, boolean isForward,String reason) {
    ....
    final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);
    ....
    if (r.window == null && !a.mFinished &&willBeVisible) {
        r.window = r.activity.getWindow();
        View decor = r.window.getDecorView();
        decor.setVisibility(View.INVISIBLE);
        ViewManager wm = a.getWindowManager();
        WindowManager.LayoutParams l = r.window.getAttributes();
        a.mDecor = decor;
        l.type = WindowManager.LayoutParams.TYPE_BASE_APPLICATION;
        l.softInputMode |= forwardBit;
        if (r.mPreserveWindow) {
            a.mWindowAdded = true;
            r.mPreserveWindow = false;
        
            ViewRootImpl impl = decor.getViewRootImpl();
            if (impl != null) {
                impl.notifyChildRebuilt();
            }
        }
            if (a.mVisibleFromClient) {
                if (!a.mWindowAdded) {
                    a.mWindowAdded = true;
                    wm.addView(decor, l);
                } else {
                    a.onWindowAttributesChanged(l);
                }
            }

        
        } else if (!willBeVisible) {
            ....
        }
    if (!r.activity.mFinished && willBeVisible && r.activity.mDecor != null && !r.hideForNow) {
            if (r.newConfig != null) {
                performConfigurationChangedForActivity(r, r.newConfig);
                if (DEBUG_CONFIGURATION) {
                    Slog.v(TAG, "Resuming activity " + r.activityInfo.name + " with newConfig "
                            + r.activity.mCurrentConfig);
                }
                r.newConfig = null;
            }
            if (localLOGV) Slog.v(TAG, "Resuming " + r + " with isForward=" + isForward);
            WindowManager.LayoutParams l = r.window.getAttributes();
            if ((l.softInputMode
                    & WindowManager.LayoutParams.SOFT_INPUT_IS_FORWARD_NAVIGATION)
                    != forwardBit) {
                l.softInputMode = (l.softInputMode
                        & (~WindowManager.LayoutParams.SOFT_INPUT_IS_FORWARD_NAVIGATION))
                        | forwardBit;
                if (r.activity.mVisibleFromClient) {
                    ViewManager wm = a.getWindowManager();
                    View decor = r.window.getDecorView();
                    wm.updateViewLayout(decor, l);
                }
            }

            r.activity.mVisibleFromServer = true;
            mNumVisibleActivities++;
            if (r.activity.mVisibleFromClient) {
                r.activity.makeVisible();
            }
        }
}

public ActivityClientRecord performResumeActivity(IBinder token, boolean finalStateRequest,String reason) {
    final ActivityClientRecord r =mActivities.get(token); ....
     try {
            ....
            r.activity.performResume(r.startsNotResumed, reason);
            ....
        } catch (Exception e) {
            ....
        }
        return r;
}

从上面源码可以看出，通过performResumeActivity方法，内部调用生命周期onStart、onResume方法；通过activity.makeVisible方法，添加window、设置可见。接着继续查看Activity源码：

//Android11源码  Activity类

final void performResume(boolean followedByPause, String reason) {
    dispatchActivityPreResumed();
    // 调用 onStart 方法
    performRestart(true /* start */, reason);
    ....
    // 调用 onResume 方法
    mInstrumentation.callActivityOnResume(this);
    ....
     // 调用 fragment的onResume 方法
    mFragments.dispatchResume();
    mFragments.execPendingActions();
}

void makeVisible() {
        if (!mWindowAdded) {
            ViewManager wm = getWindowManager();
            wm.addView(mDecor, getWindow().getAttributes());
            mWindowAdded = true;
        }
        mDecor.setVisibility(View.VISIBLE);
}

以上代码可以看出，先是调用了performRestart()——>performStart()——>mInstrumentation.callActivityOnStart(this),也就是Activity的onStart()方法；然后是mInstrumentation.callActivityOnResume()，也就是Activity的OnResume()方法；

在makeVisible()方法中，activity的顶级布局mDecor通过windowManager.addView()方法，把视图添加到window，并设置mDecor可见，到这儿视图是真正可见了。注意： 视图的真正可见是在onResume方法之后的。

总结

根Activity 启动过程中涉及到4个进程，分别是Zygote进程、Launcher 进程、AMS所在进程（SystemServer）、应用程序进程。时序图如下：

首先Launcher 进程向AMS请求根Activity，AMS会判断根Activity所需的应用程序进程是否存在并启动，如果不存在就会请求Zygote进程创建应用程序进程。应用程序进程启动后，AMS会请求创建应用程序进程并启动根Activity。