Android 9.0 點擊桌面應用圖標，啓動Activity的過程分析

下面分析從手指點擊桌面的應用圖標，是如何啓動一個應用的Activity的過程：
首先需要明確一個問題，我們的桌面Launcher其實也是一個Activity，它是繼承BaseDraggingActivity，而BaseDraggingActivity也是通過層層繼承，最終還是繼承了Activity。當點擊桌面應用圖標時，會執行Launcher這個類的startActivitySafely方法，下面看看這個方法的實現：

http://androidxref.com/9.0.0_r3/xref/packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
        boolean success = super.startActivitySafely(v, intent, item);
        // ...
        return success;
}

這個方法內部回調用super.startActivitySafely方法，由於Launcher也是一個Activity,它繼承BaseDraggingActivity，所以，super.startActivitySafely方法其實就是調用的下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/packages/apps/Launcher3/src/com/android/launcher3/BaseDraggingActivity.java

public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
	// ...
    try {
        boolean isShortcut = Utilities.ATLEAST_MARSHMALLOW
                && (item instanceof ShortcutInfo)
                && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT
                || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT)
                && !((ShortcutInfo) item).isPromise();
        if (isShortcut) {
            startShortcutIntentSafely(intent, optsBundle, item);
        } else if (user == null || user.equals(Process.myUserHandle())) {
            // 關鍵代碼
            startActivity(intent, optsBundle);
        } else {
            LauncherAppsCompat.getInstance(this).startActivityForProfile(
                    intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
        }
        getUserEventDispatcher().logAppLaunch(v, intent);
        return true;
    } 
	//...
    return false;
}

這個方法內部，會調用startActivity方法，由於BaseDraggingActivity是繼承Activity的，所以，最終會調用Activity的startActivity方法。在Activity類中，startActivity方法會最終調用startActivityForResult方法。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Activity.java

@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        startActivityForResult(intent, -1);
    }
}

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
        @Nullable Bundle options) {
    if (mParent == null) {
        options = transferSpringboardActivityOptions(options);
        Instrumentation.ActivityResult ar =
            mInstrumentation.execStartActivity(
                this, mMainThread.getApplicationThread(), mToken, this,
                intent, requestCode, options);
        if (ar != null) {
            mMainThread.sendActivityResult(
                mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                ar.getResultData());
        }
        if (requestCode >= 0) {
            mStartedActivity = true;
        }

        cancelInputsAndStartExitTransition(options);
    } else {
        if (options != null) {
            mParent.startActivityFromChild(this, intent, requestCode, options);
        } else {
            mParent.startActivityFromChild(this, intent, requestCode);
        }
    }
}

在startActivityForResult方法中，if (mParent == null)這個判斷，mParent是一個ActivityGroup類型的對象，它的具體實現類是TabActivity,這個在api 13中，google已經棄用了，推薦使用Fragment。所以這裏的mParent==null是成立的。接着都會調用Instrumentation的execStartActivity方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Instrumentation.java

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    Uri referrer = target != null ? target.onProvideReferrer() : null;
   // ...
    
    try {
	// ...
	//關鍵代碼
        int result = ActivityManager.getService()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, options);
	//關鍵代碼
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

這個方法內部，會調用ActivityManager.getServcie()方法獲取的是SystemServer進程的ActivityManagerService(後面簡稱AMS)在Launcher進程的一個binder代理對象。ActivityManager.getService().startActivity()方法執行後，Luancher進程會掛起，直到SystemServer進程中的AMS執行完startActivity方法後返回一個result，具體AMS中是如何啓動Activity的，下面會分析，返回這個result後，會調用checkStartActivityResult方法檢查返回的結果。下面看看這個方法的實現：

public static void checkStartActivityResult(int res, Object intent) {
    if (!ActivityManager.isStartResultFatalError(res)) {
        return;
    }

    switch (res) {
        case ActivityManager.START_INTENT_NOT_RESOLVED:
        case ActivityManager.START_CLASS_NOT_FOUND:
            if (intent instanceof Intent && ((Intent)intent).getComponent() != null)
                throw new ActivityNotFoundException(
                        "Unable to find explicit activity class "
                        + ((Intent)intent).getComponent().toShortString()
                        + "; have you declared this activity in your AndroidManifest.xml?");
            throw new ActivityNotFoundException(
                    "No Activity found to handle " + intent);
        // ...

        default:
            throw new AndroidRuntimeException("Unknown error code "
                    + res + " when starting " + intent);
    }
}

這個方法內部，有一個很常見的異常，ActivityNotFoundException,異常的具體描述信息是：
have you declared this activity in your AndroidManifest.xml? ，這個就是當啓動的Activity未在Manifest文件中聲明時，就會報這個異常。下面繼續看看AMS中，是如何啓動Activity的(AMS是運行在SystemServer中的)，AMS中，調用startActivity方法，接着調用了startActivityAsUser以及其重載方法，這個方法內部，mActivityStartController.obtainStarter(intent, “startActivityAsUser”)方法獲取的是一個ActivityStarter類型的對象，接着通過鏈式調用給ActivityStarter類型的對象設置各種參數，其中，要注意setMayWait(userId),這個在後續，會用到。這樣Activity的啓動就跳轉到了ActivityStarter類中的execute方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

int execute() {
    try {
        if (mRequest.mayWait) {
            return startActivityMayWait(mRequest.caller, mRequest.callingUid,
                    mRequest.callingPackage, mRequest.intent, mRequest.resolvedType,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.startFlags,
                    mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig,
                    mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId,
                    mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        } else {
            return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,
                    mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,
                    mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,
                    mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,
                    mRequest.ignoreTargetSecurity, mRequest.componentSpecified,
                    mRequest.outActivity, mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        }
    } finally {
        onExecutionComplete();
    }
}

這個方法內部，會if(mRequest.mayWait),由於在給AMS的startActivityAsUser方法中，給ActivityStarter類型的對象設置過setMayWait

ActivityStarter setMayWait(int userId) {
    mRequest.mayWait = true;
    mRequest.userId = userId;

    return this;
}

所以這裏的mRequest.mayWait = true，所以if(mRequest.mayWait)判斷條件成立，執行startActivityMayWait方法：

private int startActivityMayWait(IApplicationThread caller, int callingUid,
        String callingPackage, Intent intent, String resolvedType,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        IBinder resultTo, String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, WaitResult outResult,
        Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,
        int userId, TaskRecord inTask, String reason,
        boolean allowPendingRemoteAnimationRegistryLookup) {
    
	// ...

    synchronized (mService) {
	// ...
	    //關鍵代碼
        int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,
                voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,
                callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,
                ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,
                allowPendingRemoteAnimationRegistryLookup);

        // ...
        return res;
    }
}

接着調用startActivity的幾個重載方法，在這幾個startActviity重載方法中，經過權限和參數合法性檢查，將Intent中的參數保存等操作後，

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
            ActivityRecord[] outActivity) {
	// ...
    try {
        // ...
        result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, outActivity);
    } 
	// ...

    return result;
}


private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
        ActivityRecord[] outActivity) {

	// ...

    ActivityRecord reusedActivity = getReusableIntentActivity();

   
	// reusedActivity是爲null的，所以這個判斷不成立
    if (reusedActivity != null) {
       
        //...
    }

    //...


    final ActivityStack topStack = mSupervisor.mFocusedStack;
    final ActivityRecord topFocused = topStack.getTopActivity();
    final ActivityRecord top = topStack.topRunningNonDelayedActivityLocked(mNotTop);
    final boolean dontStart = top != null && mStartActivity.resultTo == null
            && top.realActivity.equals(mStartActivity.realActivity)
            && top.userId == mStartActivity.userId
            && top.app != null && top.app.thread != null
            && ((mLaunchFlags & FLAG_ACTIVITY_SINGLE_TOP) != 0
            || isLaunchModeOneOf(LAUNCH_SINGLE_TOP, LAUNCH_SINGLE_TASK));
	// donStart的值爲false，所以不走if()判斷不成立
    if (dontStart) {
        
        //...
    }

    boolean newTask = false;
    //...

    
    int result = START_SUCCESS;
	//判斷條件成立
    if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask
            && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {
	    // 是一個新的任務棧
        newTask = true;
	    //創建新的任務棧
        result = setTaskFromReuseOrCreateNewTask(taskToAffiliate, topStack);
    }
	// ...
  
	//這個方法內部，主要是將新建的任務棧置於任務棧集合的頂部。
    mTargetStack.startActivityLocked(mStartActivity, topFocused, newTask, mKeepCurTransition,
            mOptions);
	// mDoResume 傳入的值就是true 
    if (mDoResume) {
        final ActivityRecord topTaskActivity =
                mStartActivity.getTask().topRunningActivityLocked();
        if (!mTargetStack.isFocusable()
                || (topTaskActivity != null && topTaskActivity.mTaskOverlay
                && mStartActivity != topTaskActivity)) {

            mTargetStack.ensureActivitiesVisibleLocked(null, 0, !PRESERVE_WINDOWS);
          
            mService.mWindowManager.executeAppTransition();
        } else {

            if (mTargetStack.isFocusable() && !mSupervisor.isFocusedStack(mTargetStack)) {
                mTargetStack.moveToFront("startActivityUnchecked");
            }

		//關鍵代碼
            mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity,
                    mOptions);
        }
    }
	// ...

    return START_SUCCESS;
}

這個方法內部，會判斷需要啓動的Activity是不是已經存在了，存在就重用這個Activity,由於是從桌面啓動(之前未啓動過)，所以，這裏的判斷就不成立，後面，爲這個要啓動的Activity創建一個新的任務棧，並將這個新建的任務棧置於任務棧集合的頂部。由於目標Activity，也就是要啓動的Activity還未獲取到焦點的任務棧，所以，執行mSupervisor.resumeFocusedStackTopActivityLocked方法，下面看看ActivityStackSupervisor類的resumeFocusedStackTopActivityLocked方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

boolean resumeFocusedStackTopActivityLocked(
        ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
	// 傳入的三個參數都是 null
	// ...
	//由於targetStack是null,所以判斷不成立
    if (targetStack != null && isFocusedStack(targetStack)) {
        return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
    }

    final ActivityRecord r = mFocusedStack.topRunningActivityLocked();
    if (r == null || !r.isState(RESUMED)) {
	    // 關鍵代碼
        mFocusedStack.resumeTopActivityUncheckedLocked(null, null);
    } 
	// ...

    return false;
}

這個方法內部又跳轉到ActivityStack類的resumeTopActivityUncheckedLocked方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStack.java

@GuardedBy("mService")
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
	// 傳入的兩個參數都是 null

    // ...
    try {
       // ...

       //關鍵代碼
        result = resumeTopActivityInnerLocked(prev, options);

	  // ...
    } 
    // ...

    return result;
}


@GuardedBy("mService")
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
// 參入的兩個參數都爲null 
       // ...

	//返回當前Activity棧中，未finish的，在頂部的Activity，也就是要啓動的Activity，顯然next不爲null
        final ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */);

	// hasRunningActivity = true
        final boolean hasRunningActivity = next != null;

	// ...
	//判斷不成立
        if (!hasRunningActivity) {
            
            return resumeTopActivityInNextFocusableStack(prev, options, "noMoreActivities");
        }

        next.delayedResume = false;

        // ...

        mStackSupervisor.setLaunchSource(next.info.applicationInfo.uid);

       // ...

        // 如果當前有處於Resume狀態的Activity時，則先將這個Activity暫停(執行onPause方法)
	// 比如在AcivityA中啓動ActivityB(設置了ActivityB的process屬性，ActivityB運行在一個新的進程中)，那麼
	// 此時ActivityA就要執行onPause方法，在去爲ActivityB創建一個app進程(如果ActivityB所屬的進程不存在的話)，
	//如果ActivityB所在的進程存在，則直接啓動ActivityB，下面的代碼的邏輯，就是這樣處理的
        if (mResumedActivity != null) {
            if (DEBUG_STATES) Slog.d(TAG_STATES,
                    "resumeTopActivityLocked: Pausing " + mResumedActivity);
                    //關鍵代碼，startPausingLocked方法會執行上個Activity的OnPause方法
            pausing |= startPausingLocked(userLeaving, false, next, false);
        }

       // ...

        ActivityStack lastStack = mStackSupervisor.getLastStack();
	//如果要啓動的Activity所屬的進程存在
        if (next.app != null && next.app.thread != null) {
            //...

            synchronized(mWindowManager.getWindowManagerLock()) {
                // This activity is now becoming visible.
		// ...

                boolean notUpdated = true;

                if (mStackSupervisor.isFocusedStack(this)) {
                    
                    notUpdated = !mStackSupervisor.ensureVisibilityAndConfig(next, mDisplayId,
                            true /* markFrozenIfConfigChanged */, false /* deferResume */);
                }

                if (notUpdated) {
 
                    ActivityRecord nextNext = topRunningActivityLocked();
		    // ...
                    if (nextNext != next) {
                        // Do over!
			//關鍵代碼
                        mStackSupervisor.scheduleResumeTopActivities();
                    }
                    // ...
                    return true;
                }

		// ...
            }
            
           // ...
        } else {
            // Whoops, need to restart this activity!
	    //要啓動的Activity所在的進程未創建
            // ...
	    //關鍵代碼
            mStackSupervisor.startSpecificActivityLocked(next, true, true);
        }

        // ...
        return true;
}

這個方法中，會判斷，如果當前有處於Resume狀態的Activity時，則先將這個Activity暫停(執行onPause方法，具體的分析過程，可以看Android 9.0 Activity的OnPuse方法執行過程分析),比如在AcivityA中啓動ActivityB(設置了ActivityB的process屬性，ActivityB運行在一個新的進程中)，那麼此時ActivityA就要執行onPause方法，在去爲ActivityB創建一個app進程(如果ActivityB所屬的進程不存在的話)，如果ActivityB所在的進程存在，則直接啓動ActivityB。我們我們的前提是，從桌面啓動一個全新的Activity,所以要啓動的Activity的進程是不存在的，所以，代碼邏輯走mStackSupervisor.startSpecificActivityLocked(next, true, true);
下面接着看ActivityStackSupervisor類的startSpecificActivityLocked方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

    void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?
        ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                r.info.applicationInfo.uid, true);

        // ... 

        if (app != null && app.thread != null) {
            try {
                if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                        || !"android".equals(r.info.packageName)) {
                    // Don't add this if it is a platform component that is marked
                    // to run in multiple processes, because this is actually
                    // part of the framework so doesn't make sense to track as a
                    // separate apk in the process.
                    app.addPackage(r.info.packageName, r.info.applicationInfo.longVersionCode,
                            mService.mProcessStats);
                }
                realStartActivityLocked(r, app, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
        }

        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
}

這個方法中，ProcessRecord類型的對象記錄了進程相關的信息，app.thread 其實就是IApplicationThread類型的對象，這兩個對象在進程爲創建時，都是爲null的，所在執行mService.startProcessLocked方法，這裏的mService就是AMS，下面看AMS類中的startProcessLocked方法實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@GuardedBy("this")
final ProcessRecord startProcessLocked(String processName,
        ApplicationInfo info, boolean knownToBeDead, int intentFlags,
        String hostingType, ComponentName hostingName, boolean allowWhileBooting,
        boolean isolated, boolean keepIfLarge) {
    return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType,
            hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
            null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
            null /* crashHandler */);
}

調用幾個startProcessLocked的重載方法後，在下面這個重載方法中，調用了
private final boolean startProcessLocked(ProcessRecord app, String hostingType, 
        String hostingNameStr, boolean disableHiddenApiChecks, String abiOverride) {
    ...
    final String entryPoint = "android.app.ActivityThread";
    return startProcessLocked(hostingType, hostingNameStr, entryPoint, app, uid, gids, runtimeFlags, 
            mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startTime); // 調用#43
    ...
}

@GuardedBy("this")
private boolean startProcessLocked(String hostingType, String hostingNameStr, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    // ...
    if (mConstants.FLAG_PROCESS_START_ASYNC) {
        if (DEBUG_PROCESSES) Slog.i(TAG_PROCESSES,
                "Posting procStart msg for " + app.toShortString());
        mProcStartHandler.post(() -> {
            try {
               // ...
                final ProcessStartResult startResult = startProcess(app.hostingType, entryPoint,
                        app, app.startUid, gids, runtimeFlags, mountExternal, app.seInfo,
                        requiredAbi, instructionSet, invokeWith, app.startTime);
                synchronized (ActivityManagerService.this) {
                    handleProcessStartedLocked(app, startResult, startSeq);
                }
            } 
		// ...
        });
        return true;
    } else {
        try {
            final ProcessStartResult startResult = startProcess(hostingType, entryPoint, app,
                    uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet,
                    invokeWith, startTime);
            handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                    startSeq, false);
        } 
	    // ...
        return app.pid > 0;
    }
}

這個方法內部，給entryPoint不管是異步還是同步，都調用了startProcess方法，下面看看startProcess方法

private ProcessStartResult startProcess(String hostingType, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
        String seInfo, String requiredAbi, String instructionSet, String invokeWith,
        long startTime) {
    try {
        // ... 
        final ProcessStartResult startResult;
        if (hostingType.equals("webview_service")) {
            startResult = startWebView(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, null,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        } else {
	    // 關鍵代碼
            startResult = Process.start(entryPoint,
                    app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                    app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                    app.info.dataDir, invokeWith,
                    new String[] {PROC_START_SEQ_IDENT + app.startSeq});
        }
        checkTime(startTime, "startProcess: returned from zygote!");
        return startResult;
    }
	// ...
}

這個方法內部，會調用Process.start方法，下面看看Process類的start方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/os/Process.java

public static final ProcessStartResult start(final String processClass,
                                final String niceName,
                                int uid, int gid, int[] gids,
                                int runtimeFlags, int mountExternal,
                                int targetSdkVersion,
                                String seInfo,
                                String abi,
                                String instructionSet,
                                String appDataDir,
                                String invokeWith,
                                String[] zygoteArgs) {
      return zygoteProcess.start(processClass, niceName, uid, gid, gids,
                  runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                  abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}

這個方法內部又調用了ZygoteProcess類的start方法。這個過程是SystemServer進程和ZygoteProcess進程進行通信的過程，它們之間通信是通過Socket進行通信的。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/os/ZygoteProcess.java


public final Process.ProcessStartResult start(final String processClass,
                                              final String niceName,
                                              int uid, int gid, int[] gids,
                                              int runtimeFlags, int mountExternal,
                                              int targetSdkVersion,
                                              String seInfo,
                                              String abi,
                                              String instructionSet,
                                              String appDataDir,
                                              String invokeWith,
                                              String[] zygoteArgs) {
    try {
        return startViaZygote(processClass, niceName, uid, gid, gids,
                runtimeFlags, mountExternal, targetSdkVersion, seInfo,
                abi, instructionSet, appDataDir, invokeWith, false /* startChildZygote */,
                zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        Log.e(LOG_TAG,
                "Starting VM process through Zygote failed");
        throw new RuntimeException(
                "Starting VM process through Zygote failed", ex);
    }
}


private Process.ProcessStartResult startViaZygote(final String processClass,
                                                  final String niceName,
                                                  final int uid, final int gid,
                                                  final int[] gids,
                                                  int runtimeFlags, int mountExternal,
                                                  int targetSdkVersion,
                                                  String seInfo,
                                                  String abi,
                                                  String instructionSet,
                                                  String appDataDir,
                                                  String invokeWith,
                                                  boolean startChildZygote,
                                                  String[] extraArgs)
                                                  throws ZygoteStartFailedEx {
    ArrayList<String> argsForZygote = new ArrayList<String>();

    // ...

    synchronized(mLock) {
    //關鍵代碼
        return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
    }
}

zygoteSendArgsAndGetResult方法創建一個App進程。至此，app進程總算創建完成。接着會執行app進程的ActivityThread的main方法。這個main方法是app進程的入口。下面看看ActivityThread類的main方法。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
    // ...

    Process.setArgV0("<pre-initialized>");

    Looper.prepareMainLooper();

    // ...

    ActivityThread thread = new ActivityThread();
    thread.attach(false, startSeq);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

   // ...
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

這個方法內部， 主要是準備一個Looper對象，並準備一個消息列表，用於存在主線程的handler發送的消息。並創建一個ActivityThread對象。並調用attach方法，並且，如果sMainThreadHandler爲null，給sMainThreadHandler賦值，並且調用Looper.loop方法循環
到從消息隊列中抽取消息。下面來看看attach方法的具體實現：

private void attach(boolean system, long startSeq) {
    sCurrentActivityThread = this;
    mSystemThread = system;
    if (!system) {
        // ...
        final IActivityManager mgr = ActivityManager.getService();
        try {
            mgr.attachApplication(mAppThread, startSeq);
        } 
        // ...
    } else {
        // ...
    }

    // ...
}

這個方法中，獲取了ActivityManagerServcie在app客戶端的代理對象，調用代理對象的attachApplication方法，這時，app進程掛起，SystemServer進程的AMS類的attachApplication方法執行。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    synchronized (this) {
        // ...
	    //關鍵代碼
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}


@GuardedBy("this")
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
	// ...

    try {
	 // ...
        if (app.isolatedEntryPoint != null) {

            thread.runIsolatedEntryPoint(app.isolatedEntryPoint, app.isolatedEntryPointArgs);
        } else if (app.instr != null) {
            thread.bindApplication(processName, appInfo, providers,
                    app.instr.mClass,
                    profilerInfo, app.instr.mArguments,
                    app.instr.mWatcher,
                    app.instr.mUiAutomationConnection, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        } else {
            thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        }
        // ...
    }
// ...
// See if the top visible activity is waiting to run in this process...
if (normalMode) {
    try {
	//關鍵代碼
        if (mStackSupervisor.attachApplicationLocked(app)) {
            didSomething = true;
        }
    } catch (Exception e) {
        Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
        badApp = true;
    }
}
    // ...

    return true;
}

這個方法內部又調用了thread.bindApplication方法。這個thread其實是IApplicationThread類型的。它是在attachApplication方法被調用是，從app進程傳過來的參數，同IApplicationThread也是繼承Binder的，所以這裏thread.bindApplication()也是個進程間通信，這時，SystemServer進程是作爲客戶端，app進程作爲服務端。由於ApplicationThread是ActivityThread類的內部類，所以，看看ApplicationThread的bindApplication方法時，
下面貼出的是ActivityThread類的路徑

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

public final void bindApplication(String processName, ApplicationInfo appInfo,
        List<ProviderInfo> providers, ComponentName instrumentationName,
        ProfilerInfo profilerInfo, Bundle instrumentationArgs,
        IInstrumentationWatcher instrumentationWatcher,
        IUiAutomationConnection instrumentationUiConnection, int debugMode,
        boolean enableBinderTracking, boolean trackAllocation,
        boolean isRestrictedBackupMode, boolean persistent, Configuration config,
        CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
        String buildSerial, boolean autofillCompatibilityEnabled) {

    if (services != null) {
      // ....

        // Setup the service cache in the ServiceManager
        ServiceManager.initServiceCache(services);
    }

    setCoreSettings(coreSettings);

    AppBindData data = new AppBindData();
    // ...
    sendMessage(H.BIND_APPLICATION, data);
}

sendMessage方法執行後，在ActivityThread的H類的handleMessage方法中，會執行BIND_APPLICATION這個case,

 public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                case BIND_APPLICATION:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                    AppBindData data = (AppBindData)msg.obj;
		    //關鍵代碼
                    handleBindApplication(data);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
		// ...

}


private void handleBindApplication(AppBindData data) {
       // ...

        if (ii != null) {
            // ...
            final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);

            try {
                final ClassLoader cl = instrContext.getClassLoader();
                mInstrumentation = (Instrumentation)
                    cl.loadClass(data.instrumentationName.getClassName()).newInstance();
            } 
	    // ...

            final ComponentName component = new ComponentName(ii.packageName, ii.name);
            mInstrumentation.init(this, instrContext, appContext, component,
                    data.instrumentationWatcher, data.instrumentationUiAutomationConnection);

            //...
        } else {
            mInstrumentation = new Instrumentation();
            mInstrumentation.basicInit(this);
        }

       // ...
        try {            

           //...
	 //關鍵代碼
	app = data.info.makeApplication(data.restrictedBackupMode, null);
	//...
            try {
                mInstrumentation.callApplicationOnCreate(app);
            } catch (Exception e) {
                if (!mInstrumentation.onException(app, e)) {
                    throw new RuntimeException(
                      "Unable to create application " + app.getClass().getName()
                      + ": " + e.toString(), e);
                }
            }
        } 
	// ...  
}

這個方法內部，創建了LoadedApk對象，創建了Instrumentation對象，並調用了LoadedApk類中的makeApplication方法創建Application對象，並調用Instrumentation類的callApplicationOnCreate方法，是Application的onCreate方法執行。下面看看LoadedApk類中的makeApplication方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/LoadedApk.java

public Application makeApplication(boolean forceDefaultAppClass,
        Instrumentation instrumentation) {
    if (mApplication != null) {
        return mApplication;
    }

   //...

    Application app = null;

    // ...

    try {
        java.lang.ClassLoader cl = getClassLoader();
        // ...
        ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
        app = mActivityThread.mInstrumentation.newApplication(
                cl, appClass, appContext);
        appContext.setOuterContext(app);
    } 
	// ...
    mActivityThread.mAllApplications.add(app);
    mApplication = app;

    if (instrumentation != null) {
        try {
            instrumentation.callApplicationOnCreate(app);
        } 
	    // ...
    }

    // ...

    return app;
}

這個方法內部，會直接通過類加載器，創建application的字節碼文件，並通過反射創建Application對象。並將application對象和ContextImpl對象進行關聯。雖然instrument對象已經創建，但是這個方法傳入的instrumentation確是null,所以Instrumentation的callApplicationOnCreate方法就不會執行。接着回到ActivityThread類的handleBindApplication方法內部。

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

private void handleBindApplication(AppBindData data) {
       // ...

        if (ii != null) {
            // ...
            final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);

            try {
                final ClassLoader cl = instrContext.getClassLoader();
                mInstrumentation = (Instrumentation)
                    cl.loadClass(data.instrumentationName.getClassName()).newInstance();
            } 
	    // ...

            final ComponentName component = new ComponentName(ii.packageName, ii.name);
            mInstrumentation.init(this, instrContext, appContext, component,
                    data.instrumentationWatcher, data.instrumentationUiAutomationConnection);

            //...
        } else {
            mInstrumentation = new Instrumentation();
            mInstrumentation.basicInit(this);
        }

       // ...
        try {            

           //...
	 //關鍵代碼
	app = data.info.makeApplication(data.restrictedBackupMode, null);
	//...
            try {
                mInstrumentation.callApplicationOnCreate(app);
            } catch (Exception e) {
                if (!mInstrumentation.onException(app, e)) {
                    throw new RuntimeException(
                      "Unable to create application " + app.getClass().getName()
                      + ": " + e.toString(), e);
                }
            }
        } 
	// ...  
}

下面繼續執行Instrumentation類的callApplicationOnCreate方法，這個方法內部，最終會調用Application的onCreate方法，至此，Application就創建了，並且它的onCreate方法也執行了。
下面繼續回到SystemServer進程的AMS的attachApplicationLocked方法中：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@GuardedBy("this")
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
	// ...

    try {
	 // ...
        if (app.isolatedEntryPoint != null) {

            thread.runIsolatedEntryPoint(app.isolatedEntryPoint, app.isolatedEntryPointArgs);
        } else if (app.instr != null) {
            thread.bindApplication(processName, appInfo, providers,
                    app.instr.mClass,
                    profilerInfo, app.instr.mArguments,
                    app.instr.mWatcher,
                    app.instr.mUiAutomationConnection, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        } else {
            thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
        }
        // ...
    }

    // ...
    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
	//關鍵代碼
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
        }
    }
    // ...

    return true;
}

執行完thread.bindApplication方法後，這個方法內部，會繼續執行ActivityStackSupervisor的attachApplicationLocked方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

boolean attachApplicationLocked(ProcessRecord app) throws RemoteException {
	// ...
    for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
        final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
        for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {

            for (int i = 0; i < size; i++) {
                final ActivityRecord activity = mTmpActivityList.get(i);
                if (activity.app == null && app.uid == activity.info.applicationInfo.uid
                        && processName.equals(activity.processName)) {
                    try {
			//關鍵代碼
                        if (realStartActivityLocked(activity, app,
                                top == activity /* andResume */, true /* checkConfig */)) {
                            didSomething = true;
                        }
                    } 
			// ...
                }
            }
        }
    }
   // ...
    return didSomething;
}

這個方法內部會調用realStartActivityLocked方法

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {
	// ...
    try {
	   // ...
        try {
		// ...
            // Create activity launch transaction.
            final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,
                    r.appToken);
            clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                    System.identityHashCode(r), r.info,

                    mergedConfiguration.getGlobalConfiguration(),
                    mergedConfiguration.getOverrideConfiguration(), r.compat,
                    r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
                    r.persistentState, results, newIntents, mService.isNextTransitionForward(),
                    profilerInfo));

            // Set desired final state.
            final ActivityLifecycleItem lifecycleItem;
            if (andResume) {
                lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());
            } else {
                lifecycleItem = PauseActivityItem.obtain();
            }
            clientTransaction.setLifecycleStateRequest(lifecycleItem);

            // Schedule transaction.
            mService.getLifecycleManager().scheduleTransaction(clientTransaction);

		// ...
        } 
	    // ...
    return true;
}

這個方法內部會先創建一個ClientTransaction類型的對象clientTransaction，在給clientTransaction添加callback,注意，這裏的添加的callback是LaunchActivityItem類型的，由於傳入的doResume是true，所有lifecycleItem的賦值類型是ResumeActivityItem類型的對象，接着調用clientTransaction對象的setLifecycleStateRequest方法，將這個對象設置進去，後clientTransaction.getLifecycleStateRequest()方法返回的就是這個ResumeActivityItem類型的對象。接着執行mService.getLifecycleManager().scheduleTransaction(clientTransaction)，由於mService.getLifecycleManager()獲取的是ClientLifecycleManager對象，所以，調用代碼跳轉到了ClientLifecycleManager類中的scheduleTransaction方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/services/core/java/com/android/server/am/ClientLifecycleManager.java

void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
        final IApplicationThread client = transaction.getClient();
        // 關鍵代碼
        transaction.schedule();
        if (!(client instanceof Binder)) {
            // If client is not an instance of Binder - it's a remote call and at this point it is
            // safe to recycle the object. All objects used for local calls will be recycled after
            // the transaction is executed on client in ActivityThread.
            transaction.recycle();
        }
 }

這個方法內部又調用了ClientTransaction類的schedule方法，下面看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/ClientTransaction.java

public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this);
}

這裏的mClient是一個IApplicationThread類型的對象，ApplicationThread實現了IApplicationThread接口，所以mClient.scheduleTransaction(this)實際上是執行了ApplicationThread的scheduleTransaction方法。這又是進程間通信，現在SystemServer作爲客戶端，app進程作爲服務端。這樣又跳轉到了ApplicationThread類中的scheduleTransaction方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

 @Override
 public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
     ActivityThread.this.scheduleTransaction(transaction);
 }

這個方法內部，又調用了ActivityThread的scheduleTransaction方法，由於ActivityThread沒有這個方法，這個方法是其父類ClientTransactionHandler的方法，下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ClientTransactionHandler.java

void scheduleTransaction(ClientTransaction transaction) {
     transaction.preExecute(this);
     sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

這個方法內部，又調用了ActivityThread的sendMessage方法， 接着會執行到Activity類內部的H類的handleMessage方法的中的

// ...
case EXECUTE_TRANSACTION:
     final ClientTransaction transaction = (ClientTransaction) msg.obj;
     mTransactionExecutor.execute(transaction);
     //...
     break;
// ....

接着執行到TransactionExecutor類的execute方法

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

/** Cycle through all states requested by callbacks and execute them at proper times. */
@VisibleForTesting
public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
     // ...

    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        // ...
         item.execute(mTransactionHandler, token, mPendingActions);
         item.postExecute(mTransactionHandler, token, mPendingActions);
         if (r == null) {
             // Launch activity request will create an activity record.
             r = mTransactionHandler.getActivityClient(token);
         }

         if (postExecutionState != UNDEFINED && r != null) {
             // Skip the very last transition and perform it by explicit state request instead.
             final boolean shouldExcludeLastTransition =
                     i == lastCallbackRequestingState && finalState == postExecutionState;
             cycleToPath(r, postExecutionState, shouldExcludeLastTransition);
         }
     }
 }

在executeCallbacks內部，會通過transaction對象獲取callbacks，由於之前，給Transaction添加過一個LaunchActivityItem，所以這裏callback.size = 1,執行for循環，item.execute時，其實就是執行的LaunchActivityItem的execute方法。下面接着看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/LaunchActivityItem.java

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
            mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
            mPendingResults, mPendingNewIntents, mIsForward,
            mProfilerInfo, client);
     //關鍵代碼
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

這個方法內部，調用了ClientTransactionHandler的handleLaunchActivity方法，由於ClientTransactionHandler是個抽象類，所以具體執行其子類的ActivityTrhead類的handleLauncheActivity方法，下面繼續看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

@Override
public Activity handleLaunchActivity(ActivityClientRecord r,
        PendingTransactionActions pendingActions, Intent customIntent) {
   // ...
//關鍵代碼
    final Activity a = performLaunchActivity(r, customIntent);
   // ...
    return a;
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ActivityInfo aInfo = r.activityInfo;
   // ...
   // 關鍵代碼
    ContextImpl appContext = createBaseContextForActivity(r);
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = appContext.getClassLoader();
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
        // ...
    }
	// ...

    try {
		//關鍵代碼
        Application app = r.packageInfo.makeApplication(false, mInstrumentation);

       // ...

        if (activity != null) {
            // ...
            appContext.setOuterContext(activity);
		//關鍵代碼
            activity.attach(appContext, this, getInstrumentation(), r.token,
                    r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor, window, r.configCallback);
            // ...
            int theme = r.activityInfo.getThemeResource();
            if (theme != 0) {
		// 關鍵代碼
                activity.setTheme(theme);
            }

            activity.mCalled = false;
            if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }
            // ...
            r.activity = activity;
        }
        r.setState(ON_CREATE);

        mActivities.put(r.token, r);

    } 
	// ...

    return activity;
}

這個方法內部主要做了如下事情：
1.通過createBaseContextForActivity方法創建一個ContextImpl類型的對象
2.通過類加載的方式，創建Activity的字節碼對象，然後通過反射創建Activity的實例。
3.調用LoadedApk類的makeApplication方法，由於在前面的步驟中Application對象已經創建了，所以這個方法直接返回之前創建的Application對象。
4.將前面創建的appContext對象和activity關聯。
5.調用Activity類的attach方法，這個方法的主要作用是創建PhoneWindow對象，並設置WindowManager.
6.給Activity設置主題。
7.r.isPersistable()是一個boolean型的變量，它的值相對於Manifest中Application標籤的android:persistent屬性，這個屬性設置爲true,表示應用對應的Application具有持久性，它會自系統啓動後"持久的"運行，直到關機爲止，並且在運行出現異常是自動的重新啓動。
這裏假設啓動的Activity不是持久應用。所以執行Intrumentation的callActivityOnCreate方法，這個方法最終會調用Activity的onCreate方法。
下面看看Activity的attach方法具體做了什麼？

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/Activity.java

final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor,
        Window window, ActivityConfigCallback activityConfigCallback) {
    // ...

    mWindow = new PhoneWindow(this, window, activityConfigCallback);
    mWindow.setWindowControllerCallback(this);
    mWindow.setCallback(this);
    mWindow.setOnWindowDismissedCallback(this);
    // ...

    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
   // ...
}

這個方法內部，主要是創建了一個PhoneWindow對象，並給PhoneWindow對象設置callBack，並給PhoneWindow設置windowManager對象。並將PhoneWindow對象和windowManager對象賦值給Activity類的兩個mWindow和mWindowManager對象，平時開發過程中，在Activity類通過getWindow()方法和getWindowManager()方法獲取到值就是在這裏賦值的。

分析到這裏，Application創建了，Application的onCreate方法也執行了，Activity實例也創建了，onCreate方法執行了，關於Activityy的onCreate方法具體做什麼事情，可以看這篇文章，但是，我們平時啓動一個Activity時，還執行了onStart方法和onResume方法，這兩個方法什麼時候執行呢？我們接着回到TransactionExecutor類的execute方法：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();
    log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

上面已經分析完了executeCallbacks方法，接着分析executeLifecycleState方法，

 /** Transition to the final state if requested by the transaction. */
 private void executeLifecycleState(ClientTransaction transaction) {
     final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
     if (lifecycleItem == null) {
         // No lifecycle request, return early.
         return;
     }
     log("Resolving lifecycle state: " + lifecycleItem);

     final IBinder token = transaction.getActivityToken();
     final ActivityClientRecord r = mTransactionHandler.getActivityClient(token);

     if (r == null) {
         // Ignore requests for non-existent client records for now.
         return;
     }

     // Cycle to the state right before the final requested state.
     cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */);

     // Execute the final transition with proper parameters.
     lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
     lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
 }

這個方法主要做了如下兩件事：
1.調用cycleToPath方法，這個方法的作用是調用mTransactionHandler.handleStartActivity(r, mPendingActions);其實就是調用了ActivityThread的handleStartActivity方法，最終調用Activity的onStart方法，這樣Activity的onStart方法就執行了。
2.接着執行lifecycleItem.execute方法，這個lifecycleItem是通過transaction.getLifecycleStateRequest()獲取的，我們在前面分析ActivityStackSupervisor類的realStartActivityLocked方法時，提到了transaction.setLifecycleStateRequest方法傳入的就是一個ResumeActivityItem類型的對象，所以這裏lifecycleitem.execute其實就是執行的ResumeActivityItem類的execute方法。下面看看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/servertransaction/ResumeActivityItem.java

@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
    client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
            "RESUME_ACTIVITY");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

這個方法內部調用了ClientTransactionHandler類的handleResumeActivity方法，其實就是執行了ActivityThread類的hadnleResumeActivity方法，下面看這個方法的具體實現：

http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/android/app/ActivityThread.java

@Override
public void handleResumeActivity(IBinder token, boolean finalStateRequest, boolean isForward,
        String reason) {
    // ...
    final ActivityClientRecord r = performResumeActivity(token, finalStateRequest, reason);

    // ...

    if (!r.activity.mFinished && willBeVisible && r.activity.mDecor != null && !r.hideForNow) {
        //...
        if (r.activity.mVisibleFromClient) {
            r.activity.makeVisible();
        }
    }

    r.nextIdle = mNewActivities;
    mNewActivities = r;
    if (localLOGV) Slog.v(TAG, "Scheduling idle handler for " + r);
    Looper.myQueue().addIdleHandler(new Idler());
}

@VisibleForTesting
public ActivityClientRecord performResumeActivity(IBinder token, boolean finalStateRequest,
        String reason) {
    final ActivityClientRecord r = mActivities.get(token);
// ...
    try {
       // ...
       //關鍵代碼
        r.activity.performResume(r.startsNotResumed, reason);

        // ...
    } 
    // ...
    return r;
}

handleResumeActivity這個方法主要做了兩個事情：
1.執行performResumeActivity方法，最後執行Activity的performResume方法，在接着通過Instrumentation的callActivityOnResume方法，在
接着執行Activity的onResume方法，至此，Activity的onResume方法執行
2.調用Activity的makeVisible()方法，是mDecorview變成可見。

以上便是冷啓動一個Activity流程分析。

轉載自hujin2017的博客，已徵得博主同意。原文鏈接：https://blog.csdn.net/hujin2017/article/details/101389261
————————————————
版權聲明：本文爲CSDN博主「hujin2017」的原創文章，遵循CC 4.0 BY-SA版權協議，轉載請附上原文出處鏈接及本聲明。
原文鏈接：https://blog.csdn.net/hujin2017/article/details/101389261