Android Activity 启动流程分析

Acitvity是Android中最基本的组件，大多数App中基本都是直接和Activity打交道，顺着startActivity(Intent intent)研究，看一个Activity是怎么启动的。

startActivity

	@Override
	public void startActivity(Intent intent) {
		this.startActivity(intent, null);
	}

	public void startActivityForResult(@RequiresPermission Intent intent, int requestCode) {
	    // 最终调用到startActivityForResult
	    startActivityForResult(intent, requestCode, null);
	}

    public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            // 调用Instrumentation#execStartActivity，生成一个ActivityResult对象实例。
            // mMainThread.getApplicationThread()，获取当前的Binder。
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                    this, mMainThread.getApplicationThread(), mToken, this,
                    intent, requestCode, options);
            // ...
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            }
        } else {
            // ...
            mParent.startActivityFromChild(this, intent, requestCode, options);
        }
    }

Instrumentation
who : MainActivity@4713
contextThread : ActivityThread$ApplicationThread@4717
token : BinderProxy$4718
target : MainActivity@4713
intent
requestCode
options
whoThread : ActivityThread$ApplicationThread@4717

startActivityForResult方法里面，调用Instrumentation#execStartActivity来开始创建并启动Activity。

Instrumentation

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    Uri referrer = target != null ? target.onProvideReferrer() : null;
    if (referrer != null) {
        intent.putExtra(Intent.EXTRA_REFERRER, referrer);
    }
    // ...
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess(who);
        //
        // ActivityManagerNative.getDefault()获取到ActivityManager代理对象。
        // 它是一个ActivityManagerProxy实例对象。
        int result = ActivityManagerNative.getDefault()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, options);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

通过调用ActivityManagerNative.getDefault()获取一个ActivityManager代理对象。它是一个ActivityManagerProxy实例对象。再通过该代理对象的相关方法，和Binder服务端进行通信。

ActivityManagerNative

public abstract class ActivityManagerNative extends Binder implements IActivityManager
{
    /**
     * Cast a Binder object into an activity manager interface, generating
     * a proxy if needed.
     */
    static public IActivityManager asInterface(IBinder obj) {
        if (obj == null) {
            return null;
        }
        IActivityManager in =
            (IActivityManager)obj.queryLocalInterface(descriptor);
        if (in != null) {
            return in;
        }

        return new ActivityManagerProxy(obj);
    }

    /**
     * Retrieve the system's default/global activity manager.
     */
    static public IActivityManager getDefault() {
        return gDefault.get();
    }

    @Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
        case START_ACTIVITY_TRANSACTION:
        {
            data.enforceInterface(IActivityManager.descriptor);
            IBinder b = data.readStrongBinder();
            IApplicationThread app = ApplicationThreadNative.asInterface(b);
            String callingPackage = data.readString();
            // 启动Activity
            int result = startActivity(app, callingPackage, intent, resolvedType,
                    resultTo, resultWho, requestCode, startFlags, profilerInfo, options);
            reply.writeNoException();
            reply.writeInt(result);
            return true;
        }
        
        case ACTIVITY_RESUMED_TRANSACTION: {
            data.enforceInterface(IActivityManager.descriptor);
            IBinder token = data.readStrongBinder();
            // resume
            activityResumed(token);
            reply.writeNoException();
            return true;
        }

        case ACTIVITY_PAUSED_TRANSACTION: {
            data.enforceInterface(IActivityManager.descriptor);
            IBinder token = data.readStrongBinder();
            // pause
            activityPaused(token);
            reply.writeNoException();
            return true;
        }

        case ACTIVITY_STOPPED_TRANSACTION: {
            data.enforceInterface(IActivityManager.descriptor);
            IBinder token = data.readStrongBinder();
            Bundle map = data.readBundle();
            PersistableBundle persistentState = data.readPersistableBundle();
            CharSequence description = TextUtils.CHAR_SEQUENCE_CREATOR.createFromParcel(data);
            // 停止Activity
            activityStopped(token, map, persistentState, description);
            reply.writeNoException();
            return true;
        }
        // ...

上面onTransact方法中对startActivity等方法的调用，将最终调用到ActivityManagerService中。

ActivityManagerProxy

class ActivityManagerProxy implements IActivityManager
{
    public ActivityManagerProxy(IBinder remote)
    {
        mRemote = remote;
    }

    public IBinder asBinder()
    {
        return mRemote;
    }

    // 启动Activity
    public int startActivity(IApplicationThread caller, String callingPackage, Intent intent,
            String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle options) throws RemoteException {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        // 向服务端发送消息
        mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0);
        reply.readException();
        int result = reply.readInt();
        reply.recycle();
        data.recycle();
        return result;
    }
    
    public void activityResumed(IBinder token) throws RemoteException
    {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        // ... 发送消息
        mRemote.transact(ACTIVITY_RESUMED_TRANSACTION, data, reply, 0);
    }
    
    public void activityPaused(IBinder token) throws RemoteException
    {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        // ... 发送消息
        mRemote.transact(ACTIVITY_PAUSED_TRANSACTION, data, reply, 0);
    }
    
    public void activityStopped(IBinder token, Bundle state,
            PersistableBundle persistentState, CharSequence description){}    
}

通过mRemote.transact方法，将最终调用到远程ActivityManagerNative#onTransact方法，再根据不同的标识，调用具体的方法。比如startActivity，activityResumed等方法，而ActivityManagerNative方法发起的调用，将最终调用到ActivityManagerService，这样就完成了一次调用过程。

ActivityManagerService中实现了具体的Activity相应的操作，可以看到它继承了ActivityManagerNative类。

public final class ActivityManagerService extends ActivityManagerNative
        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {
    // ...
}

ActivityThread

ActivithThread(Android6.0版本)

根据ActivityThread中的方法，我们通过倒推去寻找调用途径。

/** 
 * ActivityThread 管理一个应用程序进程中的主线程的执行，调度和执行
 * Activity，BroadCast，或者其它的的操作请求
 */
public final class ActivityThread {
    private ContextImpl mSystemContext;

    static volatile IPackageManager sPackageManager;

    final ApplicationThread mAppThread = new ApplicationThread();
    final Looper mLooper = Looper.myLooper();
    // 内部类H
    final H mH = new H();
    // Activity实例集合
    final ArrayMap<IBinder, ActivityClientRecord> mActivities = new ArrayMap<>();
    
    final ArrayMap<IBinder, Service> mServices = new ArrayMap<>();
    // ...
    
	handleLaunchActivity(...) { // onCreate
		performLaunchActivity();
	}
	
	performLaunchActivity(...) {
		mInstrumentation.callActivityOnCreate(...);
	}
	
	handleStartActivity(...) {} // onStart
	
	handleResumeActivity(...) {} // onResume
	
	handlePauseActivity(...) {} // onPause
	
	handleStopActivity(...) {} // onStop
	
	handleDestoryActivity(...) {} // onDestory
	
	// ...

ActivityThread类中有一系列的handleXXActivity的方法，这些方法即对应了Activity的生命周期方法。handleXXActivity方法内部通常又调用performXXActivity；而performXXActivity方法又调用Instrumentation#callActivityOnXX方法，最终调用到了Activity的生命周期方法。

内部类 H 和 ApplicationThread

上面的一系列方法，它们又是在什么地方被调用的呢？ActivityThread有两个内部类H和ApplicationThread，ApplicationThread接收到Binder服务端传递来的消息后，通过发消息给内部类H，在H中调用了上述的一系列方法。

ApplicationThread

   // 内部类ApplicationThread
   private class ApplicationThread extends ApplicationThreadNative {

       // Pause
       public final void schedulePauseActivity(IBinder token, boolean finished,
               boolean userLeaving, int configChanges, boolean dontReport) {
           int seq = getLifecycleSeq();
           sendMessage(
                   finished ? H.PAUSE_ACTIVITY_FINISHING : H.PAUSE_ACTIVITY,
                   token,
                   (userLeaving ? USER_LEAVING : 0) | (dontReport ? DONT_REPORT : 0),
                   configChanges,
                   seq);
       }
       
       // Stop
       public final void scheduleStopActivity(IBinder token, boolean showWindow,
               int configChanges) {
           int seq = getLifecycleSeq();
           sendMessage(
               showWindow ? H.STOP_ACTIVITY_SHOW : H.STOP_ACTIVITY_HIDE,
               token, 0, configChanges, seq);
       }

       public final void scheduleWindowVisibility(IBinder token, boolean showWindow) {
           sendMessage(
               showWindow ? H.SHOW_WINDOW : H.HIDE_WINDOW,
               token);
       }

       // Resume
       public final void scheduleResumeActivity(IBinder token, int processState,
               boolean isForward, Bundle resumeArgs) {
           int seq = getLifecycleSeq();
           updateProcessState(processState, false);
           sendMessage(H.RESUME_ACTIVITY, token, isForward ? 1 : 0, 0, seq);
       }

       // we use token to identify this activity without having to send the
       // activity itself back to the activity manager. (matters more with ipc)
       @Override
       public final void scheduleLaunchActivity(...) {

           updateProcessState(procState, false);

           ActivityClientRecord r = new ActivityClientRecord();
           // ...
           updatePendingConfiguration(curConfig);
           // 内部类H，发送LAUNCH_ACTIVITY消息，将会调用到H类里面的handleMessage，
           // 最终将调用到 handleLaunchActivity
           sendMessage(H.LAUNCH_ACTIVITY, r);
       }
       
       //
       public final void scheduleRelaunchActivity(...) {}
       
       public final void scheduleNewIntent(...) {}
       
       public final void scheduleDestroyActivity(...) {}
}

可以看到实际上scheduleXXActivity的方法，最终都是通过sendMessage，发送一条消息给内部类H去处理。

除了上述的和Activity生命周期相关的方法外，ApplicationThread还有一系列的和Service相关的方法。

那么scheduleXXActivity这样的方法，又是在什么地方被调用的呢？试着猜想一下，应该是在父类里面。具体后面会分析。

内部类H

private class H extends Handler {
       public void handleMessage(Message msg) {
           switch (msg.what) {
               case LAUNCH_ACTIVITY: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
                   final ActivityClientRecord r = (ActivityClientRecord) msg.obj;

                   r.packageInfo = getPackageInfoNoCheck(
                           r.activityInfo.applicationInfo, r.compatInfo);
                   // handleLaunchActivity，启动Activity；
                   handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case RELAUNCH_ACTIVITY: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityRestart");
                   ActivityClientRecord r = (ActivityClientRecord)msg.obj;
                   handleRelaunchActivity(r);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case PAUSE_ACTIVITY: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityPause");
                   SomeArgs args = (SomeArgs) msg.obj;
                   // 暂停Activity
                   handlePauseActivity((IBinder) args.arg1, false,
                           (args.argi1 & USER_LEAVING) != 0, args.argi2,
                           (args.argi1 & DONT_REPORT) != 0, args.argi3);
                   maybeSnapshot();
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case PAUSE_ACTIVITY_FINISHING: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityPause");
                   SomeArgs args = (SomeArgs) msg.obj;
                   handlePauseActivity((IBinder) args.arg1, true, (args.argi1 & USER_LEAVING) != 0,
                           args.argi2, (args.argi1 & DONT_REPORT) != 0, args.argi3);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case STOP_ACTIVITY_SHOW: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStop");
                   SomeArgs args = (SomeArgs) msg.obj;
                   handleStopActivity((IBinder) args.arg1, true, args.argi2, args.argi3);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case STOP_ACTIVITY_HIDE: {
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStop");
                   SomeArgs args = (SomeArgs) msg.obj;
                   handleStopActivity((IBinder) args.arg1, false, args.argi2, args.argi3);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               } break;
               case SHOW_WINDOW:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityShowWindow");
                   handleWindowVisibility((IBinder)msg.obj, true);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case HIDE_WINDOW:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityHideWindow");
                   handleWindowVisibility((IBinder)msg.obj, false);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case RESUME_ACTIVITY:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
                   SomeArgs args = (SomeArgs) msg.obj;
                   handleResumeActivity((IBinder) args.arg1, true, args.argi1 != 0, true,
                           args.argi3, "RESUME_ACTIVITY");
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case DESTROY_ACTIVITY:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityDestroy");
                   handleDestroyActivity((IBinder)msg.obj, msg.arg1 != 0,
                           msg.arg2, false);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case BIND_APPLICATION:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                   AppBindData data = (AppBindData)msg.obj;
                   handleBindApplication(data);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case EXIT_APPLICATION:
                   if (mInitialApplication != null) {
                       mInitialApplication.onTerminate();
                   }
                   Looper.myLooper().quit();
                   break;
               case NEW_INTENT:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityNewIntent");
                   handleNewIntent((NewIntentData)msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case RECEIVER:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "broadcastReceiveComp");
                   handleReceiver((ReceiverData)msg.obj);
                   maybeSnapshot();
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case CREATE_SERVICE:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, ("serviceCreate: " + String.valueOf(msg.obj)));
                   handleCreateService((CreateServiceData)msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case BIND_SERVICE:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");
                   handleBindService((BindServiceData)msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case UNBIND_SERVICE:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceUnbind");
                   handleUnbindService((BindServiceData)msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case SERVICE_ARGS:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, ("serviceStart: " + String.valueOf(msg.obj)));
                   handleServiceArgs((ServiceArgsData)msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case STOP_SERVICE:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceStop");
                   handleStopService((IBinder)msg.obj);
                   maybeSnapshot();
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               case DISPATCH_PACKAGE_BROADCAST:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "broadcastPackage");
                   handleDispatchPackageBroadcast(msg.arg1, (String[])msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
               // ...
           }
       }
}

H类里面，根据不同的MESSAGE标识，处理相应的事件。可以看到所有Activity生命周期的方法，都包括在里面，从这里开始调用。除了Activity外，也包括Service的生命周期方法在内。

ApplicationThreadNative

ApplicationThreadNative继承自Binder，它接收来自Binder服务端发来的消息，并根据不同的消息类型，做出相应的响应，参见onTransact方法。

public abstract class ApplicationThreadNative extends Binder
        implements IApplicationThread {
    /**
     * Cast a Binder object into an application thread interface, generating
     * a proxy if needed.
     */
    static public IApplicationThread asInterface(IBinder obj) {
        if (obj == null) {
            return null;
        }
        IApplicationThread in =
            (IApplicationThread)obj.queryLocalInterface(descriptor);
        if (in != null) {
            return in;
        }
        
        return new ApplicationThreadProxy(obj);
    }
    
    public ApplicationThreadNative() {
        attachInterface(this, descriptor);
    }
    
    @Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
        case SCHEDULE_PAUSE_ACTIVITY_TRANSACTION:
        {
            data.enforceInterface(IApplicationThread.descriptor);
            IBinder b = data.readStrongBinder();
            // ... 
            schedulePauseActivity(b, finished, userLeaving, configChanges, dontReport);
            return true;
        }

        case SCHEDULE_STOP_ACTIVITY_TRANSACTION:
        {
            data.enforceInterface(IApplicationThread.descriptor);
            // ...
            scheduleStopActivity(b, show, configChanges);
            return true;
        }
        
        case SCHEDULE_LAUNCH_ACTIVITY_TRANSACTION:
        {
            data.enforceInterface(IApplicationThread.descriptor);
            Intent intent = Intent.CREATOR.createFromParcel(data);
            IBinder b = data.readStrongBinder();
            int ident = data.readInt();
            ActivityInfo info = ActivityInfo.CREATOR.createFromParcel(data);
            // ...启动Activity
            scheduleLaunchActivity(intent, b, ident, info, curConfig, overrideConfig, compatInfo,
                    referrer, voiceInteractor, procState, state, persistentState, ri, pi,
                    notResumed, isForward, profilerInfo);
            return true;
        }
        // ...
    }

关键流程

AMS处理请求前:

1. Activity#startActivity()
2. Activity#startActivityForResult()
3. Instrumentation#execStartActivity()
4. ActivityManagerNative.getDefault().startActivity();
5. mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0);

注意在startActivity方法中，传了一个参数IApplicationThread caller，它就是应用程序Application的调度器，上面的生命周期相关方法，都由它管理。

在向AMS发起请求时，调用IActivityManager相关代理方法，但是后续的生命周期方法，却是在IApplicationThread相关类中，实际上就是ASM处理好请求之后，将回调生命周期方法交由IApplicationThread管理。

AMS处理请求后:

1. Binder#execTransact
2. ApplicationThreadNative#onTranscat
3. ApplicationThread#scheduleLaunchActivity

通过Binder#execTransact方法由Binder服务端传递到客户端。