从源码角度来学习Activit的启动流程

免责声明：本文是本人的学习记录文档，有问题可以评论区指出，谢谢

一、从Launcher点击桌面图标，拉起app进程（不同进程间拉组件）

从桌面点击icon图标拉起进程，这个就涉及到很多逻辑了，我们一步步来看。

1.首先就是launcher的逻辑，点击icon拉起activity（进程），走的是startActivityForSafe()，launcher(桌面)其实也是一个activity，我们来看下这个源码

Activity.java
@Override
    public void startActivity(Intent intent) {
        this.startActivity(intent, null);
    }

最终会走到startActivityForResult()

Activity.java
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(    //拉起activity核心逻辑
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
            if (requestCode >= 0) {
                // If this start is requesting a result, we can avoid making
                // the activity visible until the result is received.  Setting
                // this code during onCreate(Bundle savedInstanceState) or onResume() will keep the
                // activity hidden during this time, to avoid flickering.
                // This can only be done when a result is requested because
                // that guarantees we will get information back when the
                // activity is finished, no matter what happens to it.
                mStartedActivity = true;
            }

            cancelInputsAndStartExitTransition(options);
            // TODO Consider clearing/flushing other event sources and events for child windows.
        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
                // Note we want to go through this method for compatibility with
                // existing applications that may have overridden it.
                mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

ok，我们开始正式进入源码中最复杂的部分，execStartActivity()，我们继续往下看源码

Instrumentation.java
public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        //....
        try {
            intent.migrateExtraStreamToClipData(who);
            intent.prepareToLeaveProcess(who);
            //核心逻辑，跨进程调用 ActivityTaskManagerService.startActivity
            int result = ActivityTaskManager.getService().startActivity(whoThread,
                    who.getOpPackageName(), who.getAttributionTag(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()), token,
                    target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
            notifyStartActivityResult(result, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

who：启动 Activity 的上下文
contextThread：ActivityThread 中的 ApplicationThread 对象 mAppThread
token：令牌，标识着 Activity，系统唯一标识
target：在哪个 Activity 中启动，会接收启动完成的结果
intent：启动意图
requestCode：请求码，用于将结果和请求对应上
options：可选参数

最终走到了ActivityTaskManager的startActivity，这里看个源码，不做具体解析，很显然能知道这是aidl跨进程通信，android源码中这个特性到处都有使用

ActivityTaskManager.java
public static IActivityTaskManager getService() {
        return IActivityTaskManagerSingleton.get();
    }

    @UnsupportedAppUsage(trackingBug = 129726065)
    private static final Singleton<IActivityTaskManager> IActivityTaskManagerSingleton =
            new Singleton<IActivityTaskManager>() {
                @Override
                protected IActivityTaskManager create() {
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE);
                    return IActivityTaskManager.Stub.asInterface(b);
                }
            };

通过aidl通信，逻辑走到了ActivityTaskManagerService.startActivity()中，我们继续往下看源码

ActivityTaskManagerService.java
public final int startActivity(IApplicationThread caller, String callingPackage,
            String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
            String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
            Bundle bOptions) {
        return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType,
                resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions,
                UserHandle.getCallingUserId());
    }

再往下看

ActivityTaskManagerService.java
private int startActivityAsUser(IApplicationThread caller, String callingPackage,
            @Nullable String callingFeatureId, Intent intent, String resolvedType,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
        mAmInternal.addCreatorToken(intent, callingPackage);
        final int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
        final SafeActivityOptions opts = SafeActivityOptions.fromBundle(
                bOptions, callingPid, callingUid);

        //...

        userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser,
                callingPid, callingUid, "startActivityAsUser");

        // 核心逻辑，传入各类参数，调用execute()要执行拉起activity逻辑
        return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
                .setCaller(caller)
                .setCallingPackage(callingPackage)
                .setCallingFeatureId(callingFeatureId)
                .setResolvedType(resolvedType)
                .setResultTo(resultTo)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setStartFlags(startFlags)
                .setProfilerInfo(profilerInfo)
                .setActivityOptions(opts)
                .setUserId(userId)
                .execute();
    }

getActivityStartController返回的是一个ActivityStartController对象，然后obtainStart()，拿到ActivityStarter对象，查看execute源码

ActivityStarter.java
int execute() {
        // ...
        try {
            onExecutionStarted();  //开始执行
            //...

            final LaunchingState launchingState;
            synchronized (mService.mGlobalLock) {
                final ActivityRecord caller = ActivityRecord.forTokenLocked(mRequest.resultTo);
                final int callingUid = mRequest.realCallingUid == Request.DEFAULT_REAL_CALLING_UID
                        ?  Binder.getCallingUid() : mRequest.realCallingUid;
                launchingState = mSupervisor.getActivityMetricsLogger().notifyActivityLaunching(
                        mRequest.intent, caller, callingUid);
                callerActivityName = caller != null ? caller.info.name : null;
            }

            if (mRequest.intent != null) {
                mRequest.componentSpecified |= mRequest.intent.getComponent() != null;
            }

            // If the caller hasn't already resolved the activity, we're willing
            // to do so here. If the caller is already holding the WM lock here,
            // and we need to check dynamic Uri permissions, then we're forced
            // to assume those permissions are denied to avoid deadlocking.
            if (mRequest.activityInfo == null) {
                mRequest.resolveActivity(mSupervisor);
            }
            //...
            int res = START_CANCELED;   //activity启动结果，默认取消
            synchronized (mService.mGlobalLock) {
                //...
                    res = resolveToHeavyWeightSwitcherIfNeeded();
                    if (res != START_SUCCESS) {
                        return res;
                    }

                    res = executeRequest(mRequest);   //二次赋值，得到执行结果，也是核心逻辑
                } finally {
                    Binder.restoreCallingIdentity(origId);
                    mRequest.logMessage.append(" result code=").append(res);
                    Slog.i(TAG, mRequest.logMessage.toString());
                    mRequest.logMessage.setLength(0);
                }

                //...
                if (mRequest.waitResult != null) {
                    mRequest.waitResult.result = res;
                    res = waitResultIfNeeded(mRequest.waitResult, mLastStartActivityRecord,
                            launchingState);
                }
                return getExternalResult(res);
            }
        } finally {
            //....
            onExecutionComplete();//执行完毕
        }
    }

可以看到，这个函数返回的int类型，代表activity启动结果
ActivityManager.START_ABORTED ：启动被拦截
ActivityManager.START_CANCELED ： 启动取消
ActivityManager.START_CLASS_NOT_FOUND ：找不到activity
ActivityManager.START_DELIVERED_TO_TOP;
ActivityManager.START_FLAG_ONLY_IF_NEEDED;
ActivityManager.START_PERMISSION_DENIED ：权限问题被拒绝启动
ActivityManager.START_RETURN_INTENT_TO_CALLER;
ActivityManager.START_RETURN_LOCK_TASK_MODE_VIOLATION;
ActivityManager.START_SUCCESS ：启动成功
ActivityManager.START_TASK_TO_FRONT ：栈移动到前端启动
目前有这些状态，可以自行查阅源码继续阅读，本人能力有限，很多状态也没看懂

下一步就是executeRequest()，也是核心逻辑，看下源码，这个源码非常非常长，我们只要关注两个点，第一：这个逻辑中创建了ActivityRecord，第二：进入了startActivityUnCheck()

ActivityStarter.java
private int executeRequest(Request request) {
        if (TextUtils.isEmpty(request.reason)) {
            throw new IllegalArgumentException("Need to specify a reason.");
        }
        mLastStartReason = request.reason;
        mLastStartActivityTimeMs = System.currentTimeMillis();

        final IApplicationThread caller = request.caller;
        Intent intent = request.intent;
        NeededUriGrants intentGrants = request.intentGrants;
        String resolvedType = request.resolvedType;
        ActivityInfo aInfo = request.activityInfo;
        ResolveInfo rInfo = request.resolveInfo;
        final IVoiceInteractionSession voiceSession = request.voiceSession;
        final IBinder resultTo = request.resultTo;
        String resultWho = request.resultWho;
        int requestCode = request.requestCode;
        int callingPid = request.callingPid;
        int callingUid = request.callingUid;
        int intentCreatorUid = request.intentCreatorUid;
        String intentCreatorPackage = request.intentCreatorPackage;
        String callingPackage = request.callingPackage;
        String callingFeatureId = request.callingFeatureId;
        final int realCallingPid = request.realCallingPid;
        final int realCallingUid = request.realCallingUid;
        final int startFlags = request.startFlags;
        final SafeActivityOptions options = request.activityOptions;
        Task inTask = request.inTask;
        TaskFragment inTaskFragment = request.inTaskFragment;

        //..上面都是各种校验，判断结果，如果流程都没问题，比如权限啊什么都正常，那么最终走到这里
        //创建了ActivityRecord实例
        final ActivityRecord r = new ActivityRecord.Builder(mService)
                .setCaller(callerApp)
                .setLaunchedFromPid(callingPid)
                .setLaunchedFromUid(callingUid)
                .setLaunchedFromPackage(callingPackage)
                .setLaunchedFromFeature(callingFeatureId)
                .setIntent(intent)
                .setResolvedType(resolvedType)
                .setActivityInfo(aInfo)
                .setConfiguration(mService.getGlobalConfiguration())
                .setResultTo(resultRecord)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setComponentSpecified(request.componentSpecified)
                .setRootVoiceInteraction(voiceSession != null)
                .setActivityOptions(checkedOptions)
                .setSourceRecord(sourceRecord)
                .build();

        mLastStartActivityRecord = r;

        //...

        //进入startActivityUnchecked()
        mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
                request.voiceInteractor, startFlags, checkedOptions,
                inTask, inTaskFragment, balVerdict, intentGrants, realCallingUid, transition,
                isIndependent);

        if (request.outActivity != null) {
            request.outActivity[0] = mLastStartActivityRecord;
        }

        return mLastStartActivityResult;
    }

来，我们继续查看startActivityUnchecked源码

ActivityStarter.java
private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, ActivityOptions options, Task inTask,
            TaskFragment inTaskFragment,
            BalVerdict balVerdict,
            NeededUriGrants intentGrants, int realCallingUid, Transition transition,
            boolean isIndependentLaunch) {
        int result = START_CANCELED;
        final Task startedActivityRootTask;
        //...
        }
        try {
            mService.deferWindowLayout();
            r.mTransitionController.collect(r);
            try {
                Trace.traceBegin(Trace.TRACE_TAG_WINDOW_MANAGER, "startActivityInner");
                result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                        startFlags, options, inTask, inTaskFragment, balVerdict,
                        intentGrants, realCallingUid);
            } catch (Exception ex) {
                Slog.e(TAG, "Exception on startActivityInner", ex);
            } finally {
                Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);
                startedActivityRootTask = handleStartResult(r, options, result, isIndependentLaunch,
                        remoteTransition, transition);
            }
        } finally {
            mService.continueWindowLayout();
        }
        postStartActivityProcessing(r, result, startedActivityRootTask);
        return result;
    }

源码注释很简单：当所有权限校验结束后会进入此逻辑，同时此逻辑也是确保activity没有启动会被remove掉。可以看到又进一步进入了startActivityInner()，二话不说查看源码

int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, ActivityOptions options, Task inTask,
            TaskFragment inTaskFragment, BalVerdict balVerdict,
            NeededUriGrants intentGrants, int realCallingUid) {

        computeLaunchingTaskFlags();
        mIntent.setFlags(mLaunchFlags);
        //...
        computeLaunchParams(r, sourceRecord, targetTask);

        // 判断拉起的activity要开新栈还是用旧栈
        int startResult = isAllowedToStart(r, newTask, targetTask);
        if (startResult != START_SUCCESS) {
            if (r.resultTo != null) {
                r.resultTo.sendResult(INVALID_UID, r.resultWho, r.requestCode, RESULT_CANCELED,
                        null /* data */, null /* callerToken */, null /* dataGrants */);
            }
            return startResult;
        }

        if (targetTask != null) {
            //...
        }

        final ActivityRecord targetTaskTop = newTask
                ? null : targetTask.getTopNonFinishingActivity();
        if (targetTaskTop != null) {
            //...
            if (startResult != START_SUCCESS) {
                return startResult;
            }
        } else {
            mAddingToTask = true;
        }

        //...
        if (newTask) {  //这里举例拉起新进程，所以是newTask
            final Task taskToAffiliate = (mLaunchTaskBehind && mSourceRecord != null)
                    ? mSourceRecord.getTask() : null;
            setNewTask(taskToAffiliate);   //设置新栈
        } else if (mAddingToTask) {
            //...
        }

        // 在activity attachtask后，但在activity实际启动逻辑钱
        recordTransientLaunchIfNeeded(mLastStartActivityRecord);

        //...
        final Task startedTask = mStartActivity.getTask();
        //...
        mStartActivity.getTaskFragment().clearLastPausedActivity();
        //...

        final boolean isTaskSwitch = startedTask != prevTopTask;
        mTargetRootTask.startActivityLocked(mStartActivity, topRootTask, newTask, isTaskSwitch,
                mOptions, sourceRecord);
        if (mDoResume) {
            final ActivityRecord topTaskActivity = startedTask.topRunningActivityLocked();
            if (!mTargetRootTask.isTopActivityFocusable()
                    || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                    && mStartActivity != topTaskActivity)) {
                //...
            } else {
                //核心，开始查顶部activity
                mRootWindowContainer.resumeFocusedTasksTopActivities(
                        mTargetRootTask, mStartActivity, mOptions, mTransientLaunch);
            }
        }
        mRootWindowContainer.updateUserRootTask(mStartActivity.mUserId, mTargetRootTask);

        // Update the recent tasks list immediately when the activity starts
        mSupervisor.mRecentTasks.add(startedTask);
        mSupervisor.handleNonResizableTaskIfNeeded(startedTask,
                mPreferredWindowingMode, mPreferredTaskDisplayArea, mTargetRootTask);

        // If Activity's launching into PiP, move the mStartActivity immediately to pinned mode.
        // Note that mStartActivity and source should be in the same Task at this point.
        if (mOptions != null && mOptions.isLaunchIntoPip()
                && sourceRecord != null && sourceRecord.getTask() == mStartActivity.getTask()
                && balVerdict.allows()) {
            mRootWindowContainer.moveActivityToPinnedRootTask(mStartActivity,
                    sourceRecord, "launch-into-pip", null /* bounds */);
        }

        mSupervisor.getBackgroundActivityLaunchController()
                .onNewActivityLaunched(mStartActivity);

        return START_SUCCESS;
    }

这个函数逻辑非常复杂，我这边也是看的一知半解，简单来说：这个函数分配 Task 的重点函数，就是根据 activty 的启动模式找到合适的 task 来放置 activity，如果找不到，就会新建一个。
我们来看resumeFocusedTasksTopActivities源码，此方法用于恢复任务栈顶部 Activity 的核心方法，主要涉及窗口管理、任务栈调整及 Activity 生命周期控制，
resumeFocusedTasksTopActivities实现机制：
‌窗口可见性检查‌：通过 RootWindowContainer 管理所有窗口和显示状态，若目标 Activity 所在任务栈不可见或被其他应用遮挡，则不执行恢复操作； ‌
‌任务栈调整‌：将目标 Activity 所在的栈移至显示区域顶部，并通过 Task.activityUncheckedLocked() 完成具体恢复逻辑——摘自文言一心

源码这边不看了后续再看，反正一步步开始调用：RootWindowContainer.resumeFocusedTasksTopActivities——>Task.resumeTopActivityUncheckedLocked——>Task.resumeTopActivityInnerLocked——>TaskFragment.resumeTopActivity——>TaskFragment. startPausing——>TaskFragment.schedulePauseActivity

TaskFragment.java
 void schedulePauseActivity(ActivityRecord prev, boolean userLeaving,
            boolean pauseImmediately, boolean autoEnteringPip, String reason) {
        ProtoLog.v(WM_DEBUG_STATES, "Enqueueing pending pause: %s", prev);
        try {
            prev.mPauseSchedulePendingForPip = false;
            //...

            final PauseActivityItem item = new PauseActivityItem(prev.token, prev.finishing,
                    userLeaving, pauseImmediately, autoEnteringPip);
            //通过lifecycleManager告知暂停，这里回调状态        
            mAtmService.getLifecycleManager().scheduleTransactionItem(prev.app.getThread(), item);
        } catch (Exception e) {
            //...
        }
    }

scheduleTransactionItem这个方法最终会调用到PauseActivityItem.execute()方法中——关于 ClientLifecycleManager 机制，请参考 深入理解 ClientLifecycleManager 机制（后续待学习）

PauseActivityItem.java
 @Override
    public void execute(@NonNull ClientTransactionHandler client, @NonNull ActivityClientRecord r,
            @NonNull PendingTransactionActions pendingActions) {
        Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityPause");
        //这里的client实际上就是Launcher的ActivityThread了，这里触发handlePauseActivity，再执行 performPauseActivity()，最终一步步回调到我们熟悉的activity的onPause()
        client.handlePauseActivity(r, mFinished, mUserLeaving, mAutoEnteringPip,
                pendingActions, "PAUSE_ACTIVITY_ITEM");
        Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
    }

到这里结束，会把当前前端的activity设置为pause状态，即Launcher状态是pause了。简单来说：如果发现当前还有处于 resume 状态的 Activity，会先走 puase 流程，暂停当前的 Activity。

回归到TaskFragment.resumeTopActivity中，调用完startPausing后，会继续调用ActivityTaskSupervisor.startSpecificActivity，开始真正创建activity

ActivityTaskSupervisor.java
void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // 判断activity的application是否存在，不为空说明是普通activity拉起
        final WindowProcessController wpc =
                mService.getProcessController(r.processName, r.info.applicationInfo.uid);

        boolean knownToBeDead = false;
        if (wpc != null && wpc.hasThread()) {
            try {
                //普通activity拉起
                realStartActivityLocked(r, wpc, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
            knownToBeDead = true;
            // Remove the process record so it won't be considered as alive.
            mService.mProcessNames.remove(wpc.mName, wpc.mUid);
            mService.mProcessMap.remove(wpc.getPid());
        } else if (ActivityTaskManagerService.isSdkSandboxActivityIntent(
                mService.mContext, r.intent)) {
            Slog.e(TAG, "Abort sandbox activity launching as no sandbox process to host it.");
            r.finishIfPossible("No sandbox process for the activity", false /* oomAdj */);
            r.launchFailed = true;
            r.detachFromProcess();
            return;
        }

        r.notifyUnknownVisibilityLaunchedForKeyguardTransition();

        final boolean isTop = andResume && r.isTopRunningActivity();
        //如果application为空，那就通过AMS向Zygote进程请求创建新的进程
        mService.startProcessAsync(r, knownToBeDead, isTop,
                isTop ? HostingRecord.HOSTING_TYPE_TOP_ACTIVITY
                        : HostingRecord.HOSTING_TYPE_ACTIVITY);
    }

现在我们要正式开启一个进程了，继续阅读源码

ActivityTaskManagerService.java
void startProcessAsync(ActivityRecord activity, boolean knownToBeDead, boolean isTop,
            String hostingType) {
        if (!mStartingProcessActivities.contains(activity)) {
            mStartingProcessActivities.add(activity);
            // Let the activity with higher z-order be started first.
            if (mStartingProcessActivities.size() > 1) {
                mStartingProcessActivities.sort(null /* by WindowContainer#compareTo */);
            }
        } else if (mProcessNames.get(
                activity.processName, activity.info.applicationInfo.uid) != null) {
            // The process is already starting. Wait for it to attach.
            return;
        }
        try {
            //...核心，调用startProcess
            final Message m = PooledLambda.obtainMessage(ActivityManagerInternal::startProcess,
                    mAmInternal, activity.processName, activity.info.applicationInfo, knownToBeDead,
                    isTop, hostingType, activity.intent.getComponent());
            //指定一个消息，并发送
            mH.sendMessage(m);
        } finally {
            Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
        }
    }

调用ActivityManagerInternal这个抽象类的startProcess，此抽象类具体实现是在ActivityManagerService中，是一个内部final类

ActivityManagerService$LocalService.java
 public final class LocalService extends ActivityManagerInternal
            implements ActivityManagerLocal{
	 	@Override
        public void startProcess(String processName, ApplicationInfo info, boolean knownToBeDead,
                boolean isTop, String hostingType, ComponentName hostingName) {
            try {
                //...
                synchronized (ActivityManagerService.this) {
                    // If the process is known as top app, set a hint so when the process is
                    // started, the top priority can be applied immediately to avoid cpu being
                    // preempted by other processes before attaching the process of top app.
                    HostingRecord hostingRecord =
                            new HostingRecord(hostingType, hostingName, isTop);
                    ProcessRecord rec = getProcessRecordLocked(processName, info.uid);
                    ProcessRecord app = startProcessLocked(processName, info, knownToBeDead,
                            0 /* intentFlags */, hostingRecord,
                            ZYGOTE_POLICY_FLAG_LATENCY_SENSITIVE, false /* allowWhileBooting */,
                            false /* isolated */);
                }
            } finally {
                Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
            }
        }
}

查看startProcessLocked()

ActivityManagerService.java
final ProcessRecord startProcessLocked(String processName,
            ApplicationInfo info, boolean knownToBeDead, int intentFlags,
            HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting,
            boolean isolated) {
        return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
                hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */,
                false /* isSdkSandbox */, 0 /* sdkSandboxClientAppUid */,
                null /* sdkSandboxClientAppPackage */,
                null /* ABI override */, null /* entryPoint */,
                null /* entryPointArgs */, null /* crashHandler */);
    }

再往下看mProcessList.startProcessLocked

ProcessList.java
boolean startProcessLocked(HostingRecord hostingRecord, String entryPoint, ProcessRecord app,
            int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags, int mountExternal,
            String seInfo, String requiredAbi, String instructionSet, String invokeWith,
            long startUptime, long startElapsedTime) {
        //...
        if (mService.mConstants.FLAG_PROCESS_START_ASYNC) {
            if (DEBUG_PROCESSES) Slog.i(TAG_PROCESSES,
                    "Posting procStart msg for " + app.toShortString());
            mService.mProcStartHandler.post(() -> handleProcessStart(
                    app, entryPoint, gids, runtimeFlags, zygotePolicyFlags, mountExternal,
                    requiredAbi, instructionSet, invokeWith, startSeq));
            return true;
        } else {
            try {
                //核心，又走到了Process.ProcessStartResult的startProcess
                final Process.ProcessStartResult startResult = startProcess(hostingRecord,
                        entryPoint, app,
                        uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo,
                        requiredAbi, instructionSet, invokeWith, startUptime);
                handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                        startSeq, false);
            } catch (RuntimeException e) {
                //...
            }
            return app.getPid() > 0;
        }
    }

查看startProcess源码

ProcessList.java
private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
            ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags,
            int mountExternal, String seInfo, String requiredAbi, String instructionSet,
            String invokeWith, long startTime) {
        try {
            //...
            final Process.ProcessStartResult startResult;
            boolean regularZygote = false;
            app.mProcessGroupCreated = false;
            app.mSkipProcessGroupCreation = false;
            long forkTimeNs = SystemClock.uptimeNanos();
            if (hostingRecord.usesWebviewZygote()) {
               //...
            } else if (hostingRecord.usesAppZygote()) {
                //...
            } else {
                regularZygote = true;
                //开始创建进程了
                startResult = Process.start(entryPoint,
                        app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                        app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                        app.info.dataDir, invokeWith, app.info.packageName, zygotePolicyFlags,
                        isTopApp, app.getDisabledCompatChanges(), pkgDataInfoMap,
                        allowlistedAppDataInfoMap, bindMountAppsData, bindMountAppStorageDirs,
                        bindOverrideSysprops,
                        new String[]{PROC_START_SEQ_IDENT + app.getStartSeq()});
                // By now the process group should have been created by zygote.
                app.mProcessGroupCreated = true;
            }

           //...
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
        }
    }

查看Process.start源码，会发现一步步调用ProcessStartResult start——>ZYGOTE_PROCESS.start——>ZYGOTE_PROCESS.startViaZygote——>ZYGOTE_PROCESS.zygoteSendArgsAndGetResult——>ZYGOTE_PROCESS. attemptUsapSendArgsAndGetResult，这里连接socket通信，syste_server和Zygote进程是通过LocalSocket进行通信的，这里就是通过LocalSocket将参数指令发送给Zygote

private Process.ProcessStartResult attemptUsapSendArgsAndGetResult(
            ZygoteState zygoteState, String msgStr)
            throws ZygoteStartFailedEx, IOException {
        try (LocalSocket usapSessionSocket = zygoteState.getUsapSessionSocket()) {
            final BufferedWriter usapWriter =
                    new BufferedWriter(
                            new OutputStreamWriter(usapSessionSocket.getOutputStream()),
                            Zygote.SOCKET_BUFFER_SIZE);
            final DataInputStream usapReader =
                    new DataInputStream(usapSessionSocket.getInputStream());
			// 通过LocalSocket发送启动指令
            usapWriter.write(msgStr);
            usapWriter.flush();

            Process.ProcessStartResult result = new Process.ProcessStartResult();
            result.pid = usapReader.readInt();
            // USAPs can't be used to spawn processes that need wrappers.
            result.usingWrapper = false;

            if (result.pid >= 0) {
                return result;
            } else {
                throw new ZygoteStartFailedEx("USAP specialization failed");
            }
        }
    }

那么发送指令后Zygote怎么接收到的呢？这又涉及到一个新的概念了：
zygote 进程是由 init 进程创建的，zygote 进程启动之后，会调用 ZygoteInit.main() 方法，经过创建 socket 管道，预加载资源后，便执行 runSelectLoop() 方法，进入无限循环状态
所以无限循环状态就是一个阻塞队列，等待消息发送过来，当这里接收到了指令后，就开始创建进程了。

ZygoteInit.java
public static void main(String[] argv) {
        ZygoteServer zygoteServer = null;
        //...
        Runnable caller;
        try {
            //...
            zygoteServer = new ZygoteServer(isPrimaryZygote);

            if (startSystemServer) {
                Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);

                // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
                // child (system_server) process.
                if (r != null) {
                    r.run();
                    return;
                }
            }
            //核心逻辑runSelectLoop，开始死循环
            // The select loop returns early in the child process after a fork and
            // loops forever in the zygote.
            caller = zygoteServer.runSelectLoop(abiList);
        } catch (Throwable ex) {
            //...
        } finally {
            if (zygoteServer != null) {
                zygoteServer.closeServerSocket();
            }
        }

        // We're in the child process and have exited the select loop. Proceed to execute the
        // command.
        if (caller != null) {
            caller.run();
        }
    }

那么这里就会收到指令，往下依次调用zygoteServer.runSelectLoop——>ZygoteConnection.processCommand——>
ZygoteConnection.handleChildProc——>ZygoteInit.zygoteInit——>RuntimeInit.applicationInit——>
RuntimeInit.findStaticMain，最终在这里反射调用ActivityThread.main主函数方法，

public static void main(String[] args) {
        //...
        //初始化userid啥的
        Environment.initForCurrentUser();
        //...
        //初始化一些主要模块，像蓝牙、电话、音视频框架、NFC等等
        initializeMainlineModules();
        //创建主线程的looper，也就是我们在应用层常用的handler(Looper.getMainlooper())就是这里初始化的
        Looper.prepareMainLooper();
        //初始化ActivityThread()
        ActivityThread thread = new ActivityThread();
        //activitythread赋值、application的oncreate回调、Instrumentation创建等等
        thread.attach(false, startSeq);

        if (sMainThreadHandler == null) {
            sMainThreadHandler = thread.getHandler();
        }
        //...
        //开始主线程消息队列循环
        Looper.loop();
        //...
    }

这里可以得到一个结论，每一个进程只对应一个activityThread——这也是主线程，主线程的looper消息队列也是在这里初始化的。
这个方法最终回调到ZygoteInit.java的（上文源码写了），然后执行caller.run()

caller = zygoteServer.runSelectLoop(abiList);
//...
caller.run();  //这个最终执行的就是ActivityThread.main()方法

再ActivityThread.main方法中，我们重点看一下thread.attach(false, startSeq)

private void attach(boolean system, long startSeq) {
        sCurrentActivityThread = this;
        mConfigurationController = new ConfigurationController(this);
        mSystemThread = system;
        mStartSeq = startSeq;

        if (!system) {   //默认走这里
            android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                    UserHandle.myUserId());
            RuntimeInit.setApplicationObject(mAppThread.asBinder());
            final IActivityManager mgr = ActivityManager.getService();
            try {
                // 通过 Binder 调用 AMS 的 attachApplication 方法
                mgr.attachApplication(mAppThread, startSeq);
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }
            // Watch for getting close to heap limit.
            BinderInternal.addGcWatcher(new Runnable() {
                @Override public void run() {
                    if (!mSomeActivitiesChanged) {
                        return;
                    }
                    Runtime runtime = Runtime.getRuntime();
                    long dalvikMax = runtime.maxMemory();
                    long dalvikUsed = runtime.totalMemory() - runtime.freeMemory();
                    if (dalvikUsed > ((3*dalvikMax)/4)) {
                        if (DEBUG_MEMORY_TRIM) Slog.d(TAG, "Dalvik max=" + (dalvikMax/1024)
                                + " total=" + (runtime.totalMemory()/1024)
                                + " used=" + (dalvikUsed/1024));
                        mSomeActivitiesChanged = false;
                        try {
                            ActivityTaskManager.getService().releaseSomeActivities(mAppThread);
                        } catch (RemoteException e) {
                            throw e.rethrowFromSystemServer();
                        }
                    }
                }
            });
        } else {
            //....
        }

        // 为 ViewRootImpl 设置全局配置变化回调， 当系统资源配置（如：系统字体）发生变化时，通知系统配置发生变化
        ViewRootImpl.ConfigChangedCallback configChangedCallback = (Configuration globalConfig) -> {
            synchronized (mResourcesManager) {
                // We need to apply this change to the resources immediately, because upon returning
                // the view hierarchy will be informed about it.
                if (mResourcesManager.applyConfigurationToResources(globalConfig,
                        null /* compat */)) {
                    mConfigurationController.updateLocaleListFromAppContext(
                            mInitialApplication.getApplicationContext());

                    // This actually changed the resources! Tell everyone about it.
                    final Configuration updatedConfig =
                            mConfigurationController.updatePendingConfiguration(globalConfig);
                    if (updatedConfig != null) {
                        sendMessage(H.CONFIGURATION_CHANGED, globalConfig);
                        mPendingConfiguration = updatedConfig;
                    }
                }
            }
        };
        ViewRootImpl.addConfigCallback(configChangedCallback);
    }

来看attachApplication，其中参数thread不是ActivityThread，而是ApplicationThread()，这个类是ActivityThread的一个内部类，继承了IApplicationThread.Stub，本质上就是一个binder

ActivityManagerService.java
public final void attachApplication(IApplicationThread thread, long startSeq) {
        //...
        synchronized (this) {
            int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            attachApplicationLocked(thread, callingPid, callingUid, startSeq);
            Binder.restoreCallingIdentity(origId);
        }
    }

所以好理解这个thread通过aidl的方式，交给了ams，基本就是用于观察者模式回调用的，我们在下面的源码也能看到此逻辑。
下一步看attachApplicationLocked，源码非常长

ActivityManagerService.java
private void attachApplicationLocked(@NonNull IApplicationThread thread,
            int pid, int callingUid, long startSeq) {
            //...
            //回调到客户端的Application中的bindApplication
            thread.bindApplication(
                        processName,
                        appInfo,
                        app.sdkSandboxClientAppVolumeUuid,
                        app.sdkSandboxClientAppPackage,
                        isSdkInSandbox,
                        providerList,
                        instrumentationName,
                        profilerInfo,
                        instrumentationArgs,
                        instrumentationWatcher,
                        instrumentationUiConnection,
                        testMode,
                        mBinderTransactionTrackingEnabled,
                        enableTrackAllocation,
                        isRestrictedBackupMode || !normalMode,
                        app.isPersistent(),
                        preBindInfo.configuration,
                        app.getCompat(),
                        getCommonServicesLocked(app.isolated),
                        mCoreSettingsObserver.getCoreSettingsLocked(),
                        buildSerial,
                        autofillOptions,
                        contentCaptureOptions,
                        app.getDisabledCompatChanges(),
                        app.getLoggableCompatChanges(),
                        serializedSystemFontMap,
                        mApplicationSharedMemoryReadOnlyFd,
                        app.getStartElapsedTime(),
                        app.getStartUptime());
            }
            //...
            mAtmInternal.attachApplication(app.getWindowProcessController());
            //...

}

我们主要看此函数中回调了ActivityThread.ApplicationThread.bindApplication

ActivityThread$ApplicationThread.java
public final void bindApplication(String processName, ApplicationInfo appInfo,
                String sdkSandboxClientAppVolumeUuid, String sdkSandboxClientAppPackage,
                ProviderInfoList providerList, ComponentName instrumentationName,
                ProfilerInfo profilerInfo, Bundle instrumentationArgs,
                IInstrumentationWatcher instrumentationWatcher,
                IUiAutomationConnection instrumentationUiConnection, int debugMode,
                boolean enableBinderTracking, boolean trackAllocation,
                boolean isRestrictedBackupMode, boolean persistent, Configuration config,
                CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
                String buildSerial, AutofillOptions autofillOptions,
                ContentCaptureOptions contentCaptureOptions, long[] disabledCompatChanges,
                SharedMemory serializedSystemFontMap,
                long startRequestedElapsedTime, long startRequestedUptime) {
            if (services != null) {
                if (false) {
                    // Test code to make sure the app could see the passed-in services.
                    for (Object oname : services.keySet()) {
                        if (services.get(oname) == null) {
                            continue; // AM just passed in a null service.
                        }
                        String name = (String) oname;
                        //....
                    }
                }

                // Setup the service cache in the ServiceManager
                ServiceManager.initServiceCache(services);
            }

            setCoreSettings(coreSettings);

            AppBindData data = new AppBindData();
            data.processName = processName;
            //..初始化
            CompatibilityInfo.applyOverrideScaleIfNeeded(config);
            sendMessage(H.BIND_APPLICATION, data);
        }

我们看到最后sendMessage(H.BIND_APPLICATION, data)，这个逻辑大家肯很清楚，走了handler消息队列机制

ActivityThread.java
public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                case BIND_APPLICATION:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                    AppBindData data = (AppBindData)msg.obj;
                    handleBindApplication(data);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
                case  xxxxx:
                /////
            }
            //...
        }
    }

我们看到了最终走了handleBindApplication()

ActivityThread.java
private void handleBindApplication(AppBindData data) {
    // 从 AppBindData 中取出 InstrumentationInfo 信息
    final InstrumentationInfo ii;
    if (data.instrumentationName != null) {
        ii = new ApplicationPackageManager(null, 
		        getPackageManager()).getInstrumentationInfo(data.instrumentationName, 0);
        mInstrumentationPackageName = ii.packageName;
        mInstrumentationAppDir = ii.sourceDir;
        mInstrumentationSplitAppDirs = ii.splitSourceDirs;
        mInstrumentationLibDir = getInstrumentationLibrary(data.appInfo, ii);
        mInstrumentedAppDir = data.info.getAppDir();
        mInstrumentedSplitAppDirs = data.info.getSplitAppDirs();
        mInstrumentedLibDir = data.info.getLibDir();
    } 
    // 创建 Context
    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info); 
	// InstrumentationInfo 对象非空
    if (ii != null) { // 从 InstrumentationInfo 中取出各参数, 基于此创建和初始化 Instrumentation
        ApplicationInfo instrApp = getPackageManager()
		        .getApplicationInfo(ii.packageName, 0, UserHandle.myUserId());
        if (instrApp == null) {
            instrApp = new ApplicationInfo();
        }
        // 将 InstrumentationInfo 里的参数拷贝到 ApplicationInfo 对象
        ii.copyTo(instrApp);
        instrApp.initForUser(UserHandle.myUserId());
        final LoadedApk pi = getPackageInfo(instrApp, data.compatInfo, 
		        appContext.getClassLoader(), false, true, false); 
        final ContextImpl instrContext = ContextImpl.createAppContext(this,
		        pi, appContext.getOpPackageName());
        final ClassLoader cl = instrContext.getClassLoader();
        mInstrumentation = (Instrumentation) cl
		        .loadClass(data.instrumentationName.getClassName()).newInstance();
        final ComponentName component = new ComponentName(ii.packageName, ii.name);
        mInstrumentation.init(this, instrContext, appContext, component, 
		        data.instrumentationWatcher, data.instrumentationUiAutomationConnection);
    } else { // 初始化Instrumentation
        mInstrumentation = new Instrumentation();
        mInstrumentation.basicInit(this);
    }
    // 核心！创建 Application 对象
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    mInitialApplication = app; 
    mInstrumentation.onCreate(data.instrumentationArgs);     
    //核心！ 调用 Application.onCreate() 方法  
    mInstrumentation.callApplicationOnCreate(app); 
    ........
}

好了，ApplicationThread.bindApplication完了，那么我们回到ActivityManagerService.java的下一步就是mAtmInternal.attachApplication(app.getWindowProcessController());

ActivityTaskManagerService.java
public boolean attachApplication(WindowProcessController wpc) throws RemoteException {
            synchronized (mGlobalLockWithoutBoost) {
                //...
                try {
                    return mRootWindowContainer.attachApplication(wpc);
                } finally {
                    Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
                }
            }
        }

来到了RootWindowContainer.attachApplication()

RootWindowContainer.java
boolean attachApplication(WindowProcessController app) throws RemoteException {
        app.mHasEverAttached = true;
        final ArrayList<ActivityRecord> activities = mService.mStartingProcessActivities;
        RemoteException remoteException = null;
        boolean hasActivityStarted = false;
        for (int i = activities.size() - 1; i >= 0; i--) {
            final ActivityRecord r = activities.get(i);
            if (app.mUid != r.info.applicationInfo.uid || !app.mName.equals(r.processName)) {
                // The attaching process does not match the starting activity.
                continue;
            }
            // Consume the pending record.
            activities.remove(i);
            final TaskFragment tf = r.getTaskFragment();
            if (tf == null || r.finishing || r.app != null
                    //...
                continue;
            }
            try {
                final boolean canResume = r.isFocusable() && r == tf.topRunningActivity();
                //核心：开始创建activity
                if (mTaskSupervisor.realStartActivityLocked(r, app, canResume,
                        true /* checkConfig */)) {
                    hasActivityStarted = true;
                }
            } catch (RemoteException e) {
               //..
            }
        }
        //...
        return hasActivityStarted;
    }

我们来看ActivityTaskSupervisor.realStartActivityLocked()

ActivityTaskSupervisor.java
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig) throws RemoteException {

        //...

        final Task task = r.getTask();
        if (andResume) {
            // 尝试pause前端的activity
            if (task.pauseActivityIfNeeded(r, "realStart")) {
                return false;
            }
            final TaskFragment taskFragment = r.getTaskFragment();
            if (taskFragment != null && taskFragment.getResumedActivity() != null) {
                if (taskFragment.startPausing(mUserLeaving, false /* uiSleeping */, r,
                        "realStart")) {
                    return false;
                }
            }
        }
        //...

        try { 
                //创建launchActivityItem
                final LaunchActivityItem launchActivityItem = new LaunchActivityItem(r.token,
                        r.intent, System.identityHashCode(r), r.info,
                        procConfig, overrideConfig, deviceId,
                        r.getFilteredReferrer(r.launchedFromPackage), task.voiceInteractor,
                        proc.getReportedProcState(), r.getSavedState(), r.getPersistentSavedState(),
                        results, newIntents, r.takeSceneTransitionInfo(), isTransitionForward,
                        proc.createProfilerInfoIfNeeded(), r.assistToken, activityClientController,
                        r.shareableActivityToken, r.getLaunchedFromBubble(), fragmentToken,
                        r.initialCallerInfoAccessToken, activityWindowInfo);

                // Set desired final state.
                final ActivityLifecycleItem lifecycleItem;
                if (andResume) {
                    //把resumeActivityItem也加入进
                    lifecycleItem = new ResumeActivityItem(r.token, isTransitionForward,
                            r.shouldSendCompatFakeFocus());
                } else if (r.isVisibleRequested()) {
                    lifecycleItem = new PauseActivityItem(r.token);
                } else {
                    lifecycleItem = new StopActivityItem(r.token);
                }

                // Schedule transaction.
                //...
                //核心逻辑！！！对launchActivityItem和lifecycleItem开始执行
                mService.getLifecycleManager().scheduleTransactionItems(
                        proc.getThread(),
                        // Immediately dispatch the transaction, so that if it fails, the server can
                        // restart the process and retry now.
                        true /* shouldDispatchImmediately */,
                        launchActivityItem, lifecycleItem);

                //...

            } catch (RemoteException e) {
               //....
            }
        } finally {
            endDeferResume();
            proc.resumeConfigurationDispatch();
        }

       //...

        return true;
    }

我们继续往下看

ClientLifecycleManager.java
void scheduleTransactionItems(@NonNull IApplicationThread client,
            boolean shouldDispatchImmediately,
            @NonNull ClientTransactionItem... items) throws RemoteException {
        // Wait until RootWindowContainer#performSurfacePlacementNoTrace to dispatch all pending
        // transactions at once.
        final ClientTransaction clientTransaction = getOrCreatePendingTransaction(client);

        final int size = items.length;
        for (int i = 0; i < size; i++) {
            clientTransaction.addTransactionItem(items[i]);
        }

        onClientTransactionItemScheduled(clientTransaction, shouldDispatchImmediately);
    }


private void onClientTransactionItemScheduled(
            @NonNull ClientTransaction clientTransaction,
            boolean shouldDispatchImmediately) throws RemoteException {
        if (shouldDispatchImmediately || shouldDispatchPendingTransactionsImmediately()) {
            // Dispatch the pending transaction immediately.
            mPendingTransactions.remove(clientTransaction.getClient().asBinder());
            scheduleTransaction(clientTransaction);
        }
    }

void scheduleTransaction(@NonNull ClientTransaction transaction) throws RemoteException {
        final IApplicationThread client = transaction.getClient();
        try {
            transaction.schedule();
        } catch (RemoteException e) {
            Slog.w(TAG, "Failed to deliver transaction for " + client
                            + "\ntransaction=" + transaction);
            throw e;
        }
    }

最终走到了transaction.schedule()方法，继续往下看源码

ClientTransaction.java
public void schedule() throws RemoteException {
        mClient.scheduleTransaction(this);
    }

这里的mClient实际上就是IApplicationThread.aidl，实际上是attachApplication中传过来的客户端的ApplicationThread对象，所以从下面开始，我们是在client端执行了！
所以这里就通过aidl方式回调了客户端ApplicationThread的scheduleTransaction方法，我们看源码

private class ApplicationThread extends IApplicationThread.Stub {
		@Override
        public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
            ActivityThread.this.scheduleTransaction(transaction);
        }
        //...
}

进一步执行ActivityThread自己的scheduleTransaction()，由于ActivityThread继承的ClientTransactionHandler，所以这里调用的是ClientTransactionHandler对象的方法

ClientTransactionHandler.java
void scheduleTransaction(ClientTransaction transaction) {
        transaction.preExecute(this);
        sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
    }

这里sendMessage，最终在ApplicationThread中收到

case EXECUTE_TRANSACTION:
                    final ClientTransaction transaction = (ClientTransaction) msg.obj;
                    mTransactionExecutor.execute(transaction);
                    if (isSystem()) {
                        // Client transactions inside system process are recycled on the client side
                        // instead of ClientLifecycleManager to avoid being cleared before this
                        // message is handled.
                        transaction.recycle();
                    }
                    // TODO(lifecycler): Recycle locally scheduled transactions.
                    break;

最终执行了TransactionExecutor中的方法， 同时transaction参数就是服务端传过来的AcivityLifecycleItem！

TransactionExecutor.java
public void execute(@NonNull ClientTransaction transaction) {
        if (DEBUG_RESOLVER) {
            Slog.d(TAG, tId(transaction) + "Start resolving transaction");
            Slog.d(TAG, transactionToString(transaction, mTransactionHandler));
        }

        Trace.traceBegin(Trace.TRACE_TAG_WINDOW_MANAGER, "clientTransactionExecuted");
        try {
            executeTransactionItems(transaction);
        } catch (Exception e) {
            Slog.e(TAG, "Failed to execute the transaction: "
                    + transactionToString(transaction, mTransactionHandler));
            throw e;
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);
        }

        mPendingActions.clear();
        if (DEBUG_RESOLVER) Slog.d(TAG, tId(transaction) + "End resolving transaction");
    }

public void executeTransactionItems(@NonNull ClientTransaction transaction) {
        final List<ClientTransactionItem> items = transaction.getTransactionItems();
        final int size = items.size();
        for (int i = 0; i < size; i++) {
            final ClientTransactionItem item = items.get(i);
            if (item.isActivityLifecycleItem()) {
                executeLifecycleItem(transaction, (ActivityLifecycleItem) item);
            } else {
                executeNonLifecycleItem(transaction, item,
                        shouldExcludeLastLifecycleState(items, i));
            }
        }
    }
private void executeLifecycleItem(@NonNull ClientTransaction transaction,
            @NonNull ActivityLifecycleItem lifecycleItem) {
        //...
        // Execute the final transition with proper parameters.
        lifecycleItem.execute(mTransactionHandler, mPendingActions);
        lifecycleItem.postExecute(mTransactionHandler, mPendingActions);
    }

看到了吗？最后执行到了lifecycleItem.execute，这个就是各个状态item

public class ResumeActivityItem extends ActivityLifecycleItem {
	public void execute(@NonNull ClientTransactionHandler client, @NonNull ActivityClientRecord r,
            @NonNull PendingTransactionActions pendingActions) {
        client.handleResumeActivity(r, true /* finalStateRequest */, mIsForward,
                mShouldSendCompatFakeFocus, "RESUME_ACTIVITY");
    }
}

public class LaunchActivityItem extends ClientTransactionItem {
	public void execute(@NonNull ClientTransactionHandler client,
            @NonNull PendingTransactionActions pendingActions) {
        final ActivityClientRecord r = new ActivityClientRecord(mActivityToken, mIntent, mIdent,
                mInfo, mOverrideConfig, mReferrer, mVoiceInteractor, mState, mPersistentState,
                mPendingResults, mPendingNewIntents, mSceneTransitionInfo, mIsForward,
                mProfilerInfo, client, mAssistToken, mShareableActivityToken, mLaunchedFromBubble,
                mTaskFragmentToken, mInitialCallerInfoAccessToken, mActivityWindowInfo);
        client.handleLaunchActivity(r, pendingActions, mDeviceId, null /* customIntent */);
    }
}
...等等item

上述源码的client就是ClientTransactionHandler类型，实际上就是ActivityThread。
各种lifecycle和各种transaction的关系类图如下：
以handleLaunchActivity为例，我们开始做执行启动activity的内部逻辑了！很激动，分析了这么久终于到handleLaunchActivity了！

ActivityThread.java
public Activity handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, int deviceId, Intent customIntent) {
        //...
        WindowManagerGlobal.initialize();

        //...
        final Activity a = performLaunchActivity(r, customIntent);
        //...

        return a;
    }

handleLaunchActivity的核心就是performLaunchActivity，继续往下看

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
        ActivityInfo aInfo = r.activityInfo;
        //...

        ContextImpl appContext = createBaseContextForActivity(r);
        Activity activity = null;
        //...

        try {
            Application app = r.packageInfo.makeApplicationInner(false, mInstrumentation);

            //...
            if (activity != null) {
                //...
                //核心逻辑，开始走activity初始化了，我们要attach一下，将所有信息赋值过去
                activity.attach(appContext, this, getInstrumentation(), r.token,
                        r.ident, app, r.intent, r.activityInfo, title, r.parent,
                        r.embeddedID, r.lastNonConfigurationInstances, config,
                        r.referrer, r.voiceInteractor, window, r.activityConfigCallback,
                        r.assistToken, r.shareableActivityToken);

                //...
                //回调activity的onCreate()
                if (r.isPersistable()) {
                    mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
                } else {
                    mInstrumentation.callActivityOnCreate(activity, r.state);
                }
            }
            r.setState(ON_CREATE);

        } catch (SuperNotCalledException e) {
            throw e;

        } catch (Exception e) {
            //...
        }
        return activity;
    }

继续往下看activity的attach做了什么

Activity.java
final void attach(Context context, ActivityThread aThread,
            Instrumentation instr, IBinder token, int ident,
            Application application, Intent intent, ActivityInfo info,
            CharSequence title, Activity parent, String id,
            NonConfigurationInstances lastNonConfigurationInstances,
            Configuration config, String referrer, IVoiceInteractor voiceInteractor,
            Window window, ActivityConfigCallback activityConfigCallback, IBinder assistToken,
            IBinder shareableActivityToken) {
        attachBaseContext(context);

        mFragments.attachHost(null /*parent*/);
        mActivityInfo = info;

        //核心逻辑创建phoneWindow
        mWindow = new PhoneWindow(this, window, activityConfigCallback);
        mWindow.setWindowControllerCallback(mWindowControllerCallback);
        mWindow.setCallback(this);
        mWindow.setOnWindowDismissedCallback(this);
        mWindow.getLayoutInflater().setPrivateFactory(this);
        //...
        //设置主线程
        mUiThread = Thread.currentThread();

        mMainThread = aThread;
        mInstrumentation = instr;
        mToken = token;
        mAssistToken = assistToken;
        mShareableActivityToken = shareableActivityToken;
        mIdent = ident;
        mApplication = application;
        mIntent = intent;
        mReferrer = referrer;
        mComponent = intent.getComponent();
        mTitle = title;
        mParent = parent;
        mEmbeddedID = id;
        mLastNonConfigurationInstances = lastNonConfigurationInstances;
        if (voiceInteractor != null) {
            if (lastNonConfigurationInstances != null) {
                mVoiceInteractor = lastNonConfigurationInstances.voiceInteractor;
            } else {
                mVoiceInteractor = new VoiceInteractor(voiceInteractor, this, this,
                        Looper.myLooper());
            }
        }

       //绑定windowManager
        mWindow.setWindowManager(
                (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
                mToken, mComponent.flattenToString(),
                (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
        if (mParent != null) {
            mWindow.setContainer(mParent.getWindow());
        }
        //...
    }

我们一般会在onCreate里setContentView，我们来看一下这里会做些什么，setContentView一直往上回溯，可以看到调用的是

Activity.java
public void setContentView(@LayoutRes int layoutResID) {
        getWindow().setContentView(layoutResID);
        initWindowDecorActionBar();
    }

这里getwindow获取的是一个window对象，变量名是mWindow，实际上mWindow就是上面activity.attach()中设置的new PhoneWindow()，所以我们看下PhoneWindow的setContentView做了什么

PhoneWindow.java
public void setContentView(int layoutResID) {
        if (mContentParent == null) {
            installDecor();  //初始化decor
        } else if (!hasFeature(FEATURE_CONTENT_TRANSITIONS)) {
            mContentParent.removeAllViews();
        }

        if (hasFeature(FEATURE_CONTENT_TRANSITIONS)) {
            final Scene newScene = Scene.getSceneForLayout(mContentParent, layoutResID,
                    getContext());
            transitionTo(newScene);
        } else {
            //布局inflate加载
            mLayoutInflater.inflate(layoutResID, mContentParent);
        }
        //...
    }

查看installDecor逻辑

PhoneWindow.java
private void installDecor() {
        mForceDecorInstall = false;
        if (mDecor == null) {  //初始化mDecor，这是一个viewgroup继承了FrameLayout
            mDecor = generateDecor(-1);
            mDecor.setDescendantFocusability(ViewGroup.FOCUS_AFTER_DESCENDANTS);
            mDecor.setIsRootNamespace(true);
            if (!mInvalidatePanelMenuPosted && mInvalidatePanelMenuFeatures != 0) {
                mDecor.postOnAnimation(mInvalidatePanelMenuRunnable);
            }
        } else {
            mDecor.setWindow(this);
        }
        if (mContentParent == null) {  
            mContentParent = generateLayout(mDecor);//根据mDecor初始化mContentParent，此id就是我们熟知的R.id.content，就是页面熟知的内容布局了，注意区分mDecor，mDecor是根布局

            // Set up decor part of UI to ignore fitsSystemWindows if appropriate.
            mDecor.makeFrameworkOptionalFitsSystemWindows();

            //...
            
        }
    }

嗯我们在生命周期的onCreate执行好了，其实发现就是初始化了一个mDecor，没有进行绘制，那么我们看onResume执行，onresume也是重点哈，因为onResume里也是开始做绘制的逻辑了！

public void handleResumeActivity(ActivityClientRecord r, boolean finalStateRequest,
            boolean isForward, boolean shouldSendCompatFakeFocus, String reason) {
        //...
        if (!performResumeActivity(r, finalStateRequest, reason)) {
            return;
        }
       //...
        final Activity a = r.activity;
        //...
        if (r.window == null && !a.mFinished && willBeVisible) {
            r.window = r.activity.getWindow();  //拿到attach时创建的phonewindow
            View decor = r.window.getDecorView();   //拿到onCreate创建的DecorView
            decor.setVisibility(View.INVISIBLE);
            ViewManager wm = a.getWindowManager();
            WindowManager.LayoutParams l = r.window.getAttributes();
            a.mDecor = decor;
            l.type = WindowManager.LayoutParams.TYPE_BASE_APPLICATION;
            l.softInputMode |= forwardBit;
            if (r.mPreserveWindow) {
                a.mWindowAdded = true;
                r.mPreserveWindow = false;
                // Normally the ViewRoot sets up callbacks with the Activity
                // in addView->ViewRootImpl#setView. If we are instead reusing
                // the decor view we have to notify the view root that the
                // callbacks may have changed.
                ViewRootImpl impl = decor.getViewRootImpl();
                if (impl != null) {
                    impl.notifyChildRebuilt();
                }
            }
            if (a.mVisibleFromClient) {
                if (!a.mWindowAdded) {
                    a.mWindowAdded = true;
                    wm.addView(decor, l);   //核心逻辑，加入decor这个view了
                } else {
                    //...
                }
            }
        } else if (!willBeVisible) {
            //...
        }
        //...
    }

我们来看performResumeActivity()，注意里面穿了一个参数r

public boolean performResumeActivity(ActivityClientRecord r, boolean finalStateRequest,
            String reason) {
        //当前状态已经是resume了，就返回false，不会执行后续的绘制逻辑
        if (r.getLifecycleState() == ON_RESUME) {
            //...
            return false;
        }
        //...
        try {
            //...
            //这里最终会回调到activity的onResume()方法
            r.activity.performResume(r.startsNotResumed, reason);
            //...
        } catch (Exception e) {
            //...
        }
        return true;
    }

我们继续看handleResumeActivity()，我们看到走到了windowManger.addView了

public void addView(View view, ViewGroup.LayoutParams params,
    Display display, Window parentWindow) {
    ......
    ViewRootImpl root;
    View panelParentView = null;

    synchronized (mLock) {
        ......
        root = new ViewRootImpl(view.getContext(), display);    // 创建ViewRootImpl对象

        view.setLayoutParams(wparams);
        mViews.add(view);
        mRoots.add(root);
        mParams.add(wparams);
    }
    try {
        root.setView(view, wparams, panelParentView); //重点！！最终  ViewRootImpl 的setView实际上是decorView
    } catch (RuntimeException e) {
              ......
    }
}

在addView里我们看到了将view set到了ViewRootImpl。下一步就是开始绘制了，代码调用如下：
ViewRootImpl.setView()->requestLayout()->scheduleTraversals()->mTraversalRunnable->doTraversal()-> performTraversals()

private void performTraversals() {
	int childWidthMeasureSpec = getRootMeasureSpec(desiredWindowWidth, lp.width);
	int childHeightMeasureSpec = getRootMeasureSpec(desiredWindowWidth, lp.height);
	//...
	performMeasure(childWidthMeasureSpec, childHeightMeasureSpec);
	//..
	performLayout(lp, mWidth, mHeight);
	//...
	performDraw();
}

后面就是view的绘制逻辑了，这里就不做过多展开了

二、通过startActivity启动activity（相同进程间拉组件）