chromium 84.0.4122.0 WebView apk 启动流程
之前的博客介绍了chromium代码的下载和编译，调试环境的搭建。接下来我们根据编译的WebViewInstrumentation.apk来梳理浏览器的入口，看看chromium demo apk的启动流程。
从日志上看WebViewInstrumentation.apk 的activity是：org.chromium.android_webview.shell/.AwShellActivity。我们看看webview apk的启动流程。
当Android程序启动时系统会创建一个Application对象，用来存储系统的一些信息。Android系统自动会为每个程序运行时创建一个Application类的对象且只创建一个，所以Application可以说是单例（singleton）模式的一个类。通常们是不需要指定一个Application的，系统会自动帮我们创建，WebViewInstrumentation apk在AndroidManifest.xml 文件中的application标签添加了AwShellApplication。所以我们先看看AwShellApplication.java都做了什么，代码如下：
public class AwShellApplication extends Application {
// Called by the framework for ALL processes. Runs before ContentProviders are created.
// Quirk: context.getApplicationContext() returns null during this method.
@Override
protected void attachBaseContext(Context context) {
super.attachBaseContext(context);
ContextUtils.initApplicationContext(this);
PathUtils.setPrivateDataDirectorySuffix("webview", "WebView");
CommandLine.initFromFile("/data/local/tmp/android-webview-command-line");
ResourceBundle.setAvailablePakLocales(
new String[] {}, AwLocaleConfig.getWebViewSupportedPakLocales());
}
}
这部分的实现都是在base目录下，这里都是一些初始化的操作，这里也记住下commoand读取的路径。好了接着看AwShellActivity.java onCreate执行了哪些操作：
1 首先调用registerResources(this)，其实现就是调用getResources获取resource，然后存储在AwResource全局变量sResources中， 设置Uuid存储在AwResource就没干啥了；
2 AwBrowserProcess.loadLibrary(null) ，加载库；
3 判断/data/local/tmp/android-webview-command-line是否含trace命令，如果有则设置trace enable；
4 createAwTestContainerView，可以看到其实现先调用AwBrowserProcess.start()起browser进程，new AwTestContainerView设置硬件渲染，new AwSettings部分参数设置，new AwDevToolsServer，将devtool调试开关设置为开；
5 然后是获取NavigationController，设置焦点、URL初始化，前进、后退安静初始化，加载URL
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
AwShellResourceProvider.registerResources(this);
AwBrowserProcess.loadLibrary(null);
if (CommandLine.getInstance().hasSwitch(AwShellSwitches.ENABLE_ATRACE)) {
Log.e(TAG, "Enabling Android trace.");
TraceEvent.setATraceEnabled(true);
}
setContentView(R.layout.testshell_activity);
mAwTestContainerView = createAwTestContainerView();
mWebContents = mAwTestContainerView.getWebContents();
mNavigationController = mWebContents.getNavigationController();
LinearLayout contentContainer = (LinearLayout) findViewById(R.id.content_container);
mAwTestContainerView.setLayoutParams(new LinearLayout.LayoutParams(
LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT, 1f));
contentContainer.addView(mAwTestContainerView);
mAwTestContainerView.requestFocus();
initializeUrlField();
initializeNavigationButtons();
String startupUrl = getUrlFromIntent(getIntent());
if (TextUtils.isEmpty(startupUrl)) {
startupUrl = INITIAL_URL;
}
mAwTestContainerView.getAwContents().loadUrl(startupUrl);
AwContents.setShouldDownloadFavicons();
mUrlTextView.setText(startupUrl);
}
代码路径：./android_webview/test/shell/src/org/chromium/android_webview/shell/AwShellActivity.java
接下来看看上面1~5的实现：
1、registerResources的实现，并没什么复杂的操作；
public static void registerResources(Context context) {
if (sInitialized) {
return;
}
AwResource.setResources(context.getResources());
AwResource.setConfigKeySystemUuidMapping(R.array.config_key_system_uuid_mapping);
sInitialized = true;
}代码路径：./android_webview/test/shell/src/org/chromium/android_webview/shell/AwShellResourceProvider.java
2、AwBrowserProcess.loadLibrary(null) ，加载库
public static void loadLibrary(String processDataDirSuffix) {
LibraryLoader.getInstance().setLibraryProcessType(LibraryProcessType.PROCESS_WEBVIEW);
if (processDataDirSuffix == null) {
PathUtils.setPrivateDataDirectorySuffix(WEBVIEW_DIR_BASENAME, "WebView");
} else {
String processDataDirName = WEBVIEW_DIR_BASENAME + "_" + processDataDirSuffix;
PathUtils.setPrivateDataDirectorySuffix(processDataDirName, processDataDirName);
}
StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskReads();
try {
LibraryLoader.getInstance().loadNow();
// Switch the command line implementation from Java to native.
// It's okay for the WebView to do this before initialization because we have
// setup the JNI bindings by this point.
LibraryLoader.getInstance().switchCommandLineForWebView();
} finally {
StrictMode.setThreadPolicy(oldPolicy);
}
}
代码路径：./android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java
如果想跟整个so的加载流程，可以在loadWithSystemLinkerAlreadyLocked函数中添加堆栈，查看整个调用流程
private void loadWithSystemLinkerAlreadyLocked(ApplicationInfo appInfo, boolean inZygote) {
setEnvForNative();
preloadAlreadyLocked(appInfo, inZygote);
// If the libraries are located in the zip file, assert that the device API level is M or
// higher. On devices <=M, the libraries should always be loaded by LegacyLinker.
assert !isInZipFile() || Build.VERSION.SDK_INT >= VERSION_CODES.M;
// Load libraries using the system linker.
for (String library : NativeLibraries.LIBRARIES) {
if (!isInZipFile()) {
System.loadLibrary(library);
} else {
// Load directly from the APK.
boolean is64Bit = ApiHelperForM.isProcess64Bit();
String zipFilePath = appInfo.sourceDir;
boolean crazyPrefix = forceSystemLinker(); // See comment in this function.
String fullPath = zipFilePath + "!/"
+ makeLibraryPathInZipFile(library, crazyPrefix, is64Bit);
Log.i(TAG, "libraryName: %s", fullPath);
System.load(fullPath);
}
}
}
代码路径：./base/android/java/src/org/chromium/base/library_loader/LibraryLoader.java
3 判断/data/local/tmp/android-webview-command-line是否含trace命令，如果有则设置trace enable
public static void setATraceEnabled(boolean enabled) {
if (sATraceEnabled == enabled) return;
sATraceEnabled = enabled;
if (enabled) {
// Calls TraceEvent.setEnabled(true) via
// TraceLog::EnabledStateObserver::OnTraceLogEnabled
TraceEventJni.get().startATrace();
} else {
// Calls TraceEvent.setEnabled(false) via
// TraceLog::EnabledStateObserver::OnTraceLogDisabled
TraceEventJni.get().stopATrace();
}
}
代码路径：./base/android/java/src/org/chromium/base/TraceEvent.java
4 createAwTestContainerView的函数实现如下
private AwTestContainerView createAwTestContainerView() {
AwBrowserProcess.start();
AwTestContainerView testContainerView = new AwTestContainerView(this, true);
......
SharedPreferences sharedPreferences =
getSharedPreferences(PREFERENCES_NAME, Context.MODE_PRIVATE);
if (mBrowserContext == null) {
mBrowserContext = new AwBrowserContext(
sharedPreferences, AwBrowserContext.getDefault().getNativePointer(), true);
}
final AwSettings awSettings =
new AwSettings(this /* context */, false /* isAccessFromFileURLsGrantedByDefault */,
false /* supportsLegacyQuirks */, false /* allowEmptyDocumentPersistence */,
true /* allowGeolocationOnInsecureOrigins */,
false /* doNotUpdateSelectionOnMutatingSelectionRange */);
// Required for WebGL conformance tests.
awSettings.setMediaPlaybackRequiresUserGesture(false);
// Allow zoom and fit contents to screen
awSettings.setBuiltInZoomControls(true);
awSettings.setDisplayZoomControls(false);
awSettings.setUseWideViewPort(true);
awSettings.setLoadWithOverviewMode(true);
awSettings.setLayoutAlgorithm(AwSettings.LAYOUT_ALGORITHM_TEXT_AUTOSIZING);
testContainerView.initialize(new AwContents(mBrowserContext, testContainerView,
testContainerView.getContext(), testContainerView.getInternalAccessDelegate(),
testContainerView.getNativeDrawFunctorFactory(), awContentsClient, awSettings));
testContainerView.getAwContents().getSettings().setJavaScriptEnabled(true);
if (mDevToolsServer == null) {
mDevToolsServer = new AwDevToolsServer();
mDevToolsServer.setRemoteDebuggingEnabled(true);
}
return testContainerView;
}
4.1 我们先来看如何browser线程，看start的实现如下，调用了startBrowserProcessesSync函数
public static void start() {
try (ScopedSysTraceEvent e1 = ScopedSysTraceEvent.scoped("AwBrowserProcess.start")) {
final Context appContext = ContextUtils.getApplicationContext();
AwDataDirLock.lock(appContext);
// We must post to the UI thread to cover the case that the user
// has invoked Chromium startup by using the (thread-safe)
// CookieManager rather than creating a WebView.
ThreadUtils.runOnUiThreadBlocking(() -> {
boolean multiProcess =
CommandLine.getInstance().hasSwitch(AwSwitches.WEBVIEW_SANDBOXED_RENDERER);
if (multiProcess) {
ChildProcessLauncherHelper.warmUp(appContext, true);
}
// The policies are used by browser startup, so we need to register the policy
// providers before starting the browser process. This only registers java objects
// and doesn't need the native library.
CombinedPolicyProvider.get().registerProvider(new AwPolicyProvider(appContext));
// Check android settings but only when safebrowsing is enabled.
try (ScopedSysTraceEvent e2 =
ScopedSysTraceEvent.scoped("AwBrowserProcess.maybeEnable")) {
AwSafeBrowsingConfigHelper.maybeEnableSafeBrowsingFromManifest(appContext);
}
try (ScopedSysTraceEvent e2 = ScopedSysTraceEvent.scoped(
"AwBrowserProcess.startBrowserProcessesSync")) {
BrowserStartupController.getInstance().startBrowserProcessesSync(
LibraryProcessType.PROCESS_WEBVIEW, !multiProcess);
}
});
}
}
代码路径：./android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java
startBrowserProcessesSync 实现代码如下，通过调用contentStart函数，调用ContentMain.start()函数：
public void startBrowserProcessesSync(
@LibraryProcessType int libraryProcessType, boolean singleProcess) {
......
if (contentStart() > 0) {
// Failed. The callbacks may not have run, so run them.
enqueueCallbackExecution(STARTUP_FAILURE);
startedSuccessfully = false;
}
......
}
代码路径：./content/public/android/java/src/org/chromium/content/browser/BrowserStartupControllerImpl.java
ContentMain.start函数实现如下，往下调用的函数是jni函数nativeStart：
public static int start(boolean startServiceManagerOnly) {
return ContentMainJni.get().start(startServiceManagerOnly);
}代码路径：./content/public/android/java/src/org/chromium/content/app/ContentMain.java
接下来我们看看nativeStart在c++做啥，函数实现如下，调用service_manager Main;
static jint JNI_ContentMain_Start(JNIEnv* env,
jboolean start_service_manager_only) {
TRACE_EVENT0("startup", "content::Start");
DCHECK(!g_service_manager_main_delegate.Get() || !start_service_manager_only);
if (!g_service_manager_main_delegate.Get()) {
g_service_manager_main_delegate.Get() =
std::make_unique(
ContentMainParams(g_content_main_delegate.Get().get()));
}
static_cast(
g_service_manager_main_delegate.Get().get())
->SetStartServiceManagerOnly(start_service_manager_only);
service_manager::MainParams main_params(
g_service_manager_main_delegate.Get().get());
return service_manager::Main(main_params);
}
代码路径：./content/app/android/content_main.cc
接着往下看看service_manager Main做了什么，做了mojo的初始然，然后是通过delegate->RunEmbedderProcess()调用content_service_manager_main_delegate.cc的RunEmbedderProcess。
int Main(const MainParams& params) {
MainDelegate* delegate = params.delegate;
......
int exit_code = -1;
base::debug::GlobalActivityTracker* tracker = nullptr;
ProcessType process_type = delegate->OverrideProcessType();
static bool is_initialized = false;
if (!is_initialized) {
is_initialized = true;
......
mojo::core::Configuration mojo_config;
if (process_type == ProcessType::kDefault &&
command_line.GetSwitchValueASCII(switches::kProcessType) ==
switches::kProcessTypeServiceManager) {
mojo_config.is_broker_process = true;
}
mojo_config.max_message_num_bytes = kMaximumMojoMessageSize;
delegate->OverrideMojoConfiguration(&mojo_config);
mojo::core::Init(mojo_config);
ui::RegisterPathProvider();
tracker = base::debug::GlobalActivityTracker::Get();
exit_code = delegate->Initialize(init_params);
if (exit_code >= 0) {
if (tracker) {
tracker->SetProcessPhase(
base::debug::GlobalActivityTracker::PROCESS_LAUNCH_FAILED);
tracker->process_data().SetInt("exit-code", exit_code);
}
return exit_code;
}
......
if (base::CommandLine::ForCurrentProcess()->HasSwitch(
::switches::kTraceToConsole)) {
base::trace_event::TraceConfig trace_config =
tracing::GetConfigForTraceToConsole();
base::trace_event::TraceLog::GetInstance()->SetEnabled(
trace_config, base::trace_event::TraceLog::RECORDING_MODE);
}
}
const auto& command_line = *base::CommandLine::ForCurrentProcess();
if (process_type == ProcessType::kDefault) {
std::string type_switch =
command_line.GetSwitchValueASCII(switches::kProcessType);
if (type_switch == switches::kProcessTypeServiceManager) {
process_type = ProcessType::kServiceManager;
} else if (type_switch == switches::kProcessTypeService) {
process_type = ProcessType::kService;
} else {
process_type = ProcessType::kEmbedder;
}
}
switch (process_type) {
case ProcessType::kDefault:
NOTREACHED();
break;
case ProcessType::kServiceManager:
exit_code = RunServiceManager(delegate);
break;
case ProcessType::kService:
CommonSubprocessInit();
exit_code = RunService(delegate);
break;
case ProcessType::kEmbedder:
if (delegate->IsEmbedderSubprocess())
CommonSubprocessInit();
exit_code = delegate->RunEmbedderProcess();
break;
}
if (tracker) {
if (exit_code == 0) {
tracker->SetProcessPhaseIfEnabled(
base::debug::GlobalActivityTracker::PROCESS_EXITED_CLEANLY);
} else {
tracker->SetProcessPhaseIfEnabled(
base::debug::GlobalActivityTracker::PROCESS_EXITED_WITH_CODE);
tracker->process_data().SetInt("exit-code", exit_code);
}
}
......
if (process_type == ProcessType::kEmbedder)
delegate->ShutDownEmbedderProcess();
return exit_code;
}代码路径：./services/service_manager/embedder/main.cc
然后可以看content_main_runner_impl.cc的Run函数,调用RegisterMainThreadFactories，创建InProcessUtility、InProcessRenderer、InProcessGpu线程并注册。然后是调用RunServiceManager，然后是创建起来的相关任务，我在browser_main_loop.cc的CreateStartupTasks函数中添加了堆栈，方便看流程。
int ContentMainRunnerImpl::Run(bool start_service_manager_only) {
......
const base::CommandLine& command_line =
*base::CommandLine::ForCurrentProcess();
std::string process_type =
command_line.GetSwitchValueASCII(switches::kProcessType);
// Run this logic on all child processes. Zygotes will run this at a later
// point in time when the command line has been updated.
if (!process_type.empty() &&
process_type != service_manager::switches::kZygoteProcess) {
InitializeFieldTrialAndFeatureList();
delegate_->PostFieldTrialInitialization();
}
......
RegisterMainThreadFactories();
if (process_type.empty()){
return RunServiceManager(main_params, start_service_manager_only);
}
return RunOtherNamedProcessTypeMain(process_type, main_params, delegate_);
}
代码路径：./content/app/content_main_runner_impl.cc
堆栈打印的流程如下，接着往下可以看看都创建了什么任务：
./../../content/browser/browser_main_loop.cc:899 BrowserMainLoop::CreateStartupTasks
./../../content/browser/browser_main_runner_impl.cc:129 main_loop_->CreateStartupTasks();
./../../android_webview/lib/aw_main_delegate.cc:307 int exit_code = browser_runner_->Initialize(main_function_params);
./../../content/app/content_main_runner_impl.cc:502 int exit_code = delegate->RunProcess("", main_function_params);
./../../content/app/content_main_runner_impl.cc:950 return RunBrowserProcessMain(main_params, delegate_);
./../../content/app/content_main_runner_impl.cc:851 return RunServiceManager(main_params, start_service_manager_only);
./../../services/service_manager/embedder/main.cc:459 exit_code = delegate->RunEmbedderProcess();
./../../content/app/android/content_main.cc:62 return service_manager::Main(main_params);
4.2 然后是DevToolsServer对象的新建，devtool不太了解的小伙伴可以看看这个链接，devtool sever的开启便于后面的调试 https://developers.google.com/web/tools/chrome-devtools。这里只介绍如何启动devtool server，不介绍devtool server 如何实现。
if (mDevToolsServer == null) {
mDevToolsServer = new AwDevToolsServer();
mDevToolsServer.setRemoteDebuggingEnabled(true);
} public void setRemoteDebuggingEnabled(boolean enabled) {
AwDevToolsServerJni.get().setRemoteDebuggingEnabled(
AwDevToolsServer.this, mNativeDevToolsServer, enabled);
}static void JNI_AwDevToolsServer_SetRemoteDebuggingEnabled(
JNIEnv* env,
const JavaParamRef& obj,
jlong server,
jboolean enabled) {
AwDevToolsServer* devtools_server =
reinterpret_cast(server);
if (enabled) {
devtools_server->Start();
} else {
devtools_server->Stop();
}
}
代码路径：./android_webview/browser/aw_devtools_server.cc
5 我们来看看URL的加载mAwTestContainerView.getAwContents().loadUrl(startupUrl);兜兜转转会调用到NavigationControllerImpl.java的loadUrl函数，调用一个JNI又是到C++了，调用的是navigation_controller_impl.cc的LoadURL，后面资源加载部分，再对整个请求流程进行分析。
public void loadUrl(LoadUrlParams params) {
if (mNativeNavigationControllerAndroid != 0) {
NavigationControllerImplJni.get().loadUrl(mNativeNavigationControllerAndroid,
NavigationControllerImpl.this, params.getUrl(), params.getLoadUrlType(),
params.getTransitionType(),
params.getReferrer() != null ? params.getReferrer().getUrl() : null,
params.getReferrer() != null ? params.getReferrer().getPolicy() : 0,
params.getUserAgentOverrideOption(), params.getExtraHeadersString(),
params.getPostData(), params.getBaseUrl(), params.getVirtualUrlForDataUrl(),
params.getDataUrlAsString(), params.getCanLoadLocalResources(),
params.getIsRendererInitiated(), params.getShouldReplaceCurrentEntry());
}
}
代码路径：./content/public/android/java/src/org/chromium/content/browser/framehost/NavigationControllerImpl.java
往下就是开始资源加载了，在下篇博客中进行更新