前言
Activity可以算得上是Android開發(fā)中接觸最早和最多的一個(gè)類了，簡(jiǎn)單的使用相信大家都很熟悉了，本文主要分析一下Activity的啟動(dòng)流程，有助于加深我們對(duì)于Android知識(shí)體系的理解，拓寬我們的視野。

源碼分析

首先強(qiáng)調(diào)一下，本文的分析基于Android 9.0（API Level 28）的源碼，不同版本的源碼可能有些不同，大體流程還是差不多的。閱讀源碼沒什么可說的，只能一步一步去跟代碼，下面我們就直接開始吧。
通常我們?cè)趩?dòng)一個(gè)Activity時(shí)只需要調(diào)用如下代碼即可：

Intent intent = new Intent(this, XXActivity.class);
startActivity(intent);

從Activity的startActivity(intent)方法入手，方法的調(diào)用鏈如下：

@Override
public void startActivity(Intent intent) {
    this.startActivity(intent, null);
}

@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        // Note we want to go through this call for compatibility with
        // applications that may have overridden the method.
        startActivityForResult(intent, -1);
    }
}

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode) {
    startActivityForResult(intent, requestCode, null);
}

可以看出startActivity(intent)方法最終會(huì)走到startActivityForResult(Intent intent, int requestCode,Bundle options)方法，也省去了我們?cè)偃シ治?code>startActivityForResult()方法。
Activity的startActivityForResult方法

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
                                   @Nullable Bundle options) {
    if (mParent == null) {
        options = transferSpringboardActivityOptions(options);
        // 核心代碼
        Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity(
                        this, mMainThread.getApplicationThread(), mToken, this,
                        intent, requestCode, options);
        // ...
    } else {
        // ...
    }
}

這里我們只需要關(guān)注mParent == null這部分的邏輯，這里的核心代碼是調(diào)用mInstrumentation.execStartActivity()方法。mInstrumentation的類型是Instrumentation，它會(huì)在應(yīng)用程序的任何代碼運(yùn)行之前被實(shí)例化，能夠允許你監(jiān)視應(yīng)用程序和系統(tǒng)的所有交互，Application和Activity的創(chuàng)建以及生命周期都會(huì)經(jīng)過這個(gè)對(duì)象去執(zhí)行。mMainThread的類型是ActivityThread，應(yīng)用程序的入口就是該類中的main()方法，在該方法中會(huì)創(chuàng)建主線程Looper，開啟消息循環(huán)，處理任務(wù)。通過mMainThread.getApplicationThread()方法獲取到的是一個(gè)ApplicationThread對(duì)象，它是ActivityThread的內(nèi)部類，它的定義如下：

private class ApplicationThread extends IApplicationThread.Stub{
   // ... 
}

可以看出它繼承自IApplicationThread.Stub，如果了解一點(diǎn)Binder的話從名稱就能知道IApplicationThread繼承自IInterface接口，內(nèi)部定義了一些業(yè)務(wù)方法，IApplicationThread.Stub則是一個(gè)Binder對(duì)象。接下來我們來看一下Instrumentation的execStartActivity()方法。
Instrumentation的execStartActivity方法

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    // 將contextThread轉(zhuǎn)為IApplicationThread
    // 這里的contextThread是一個(gè)ApplicationThread對(duì)象，實(shí)現(xiàn)了IApplicationThread接口，因此可以這樣轉(zhuǎn)換
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    // ...
    try {
        // ...
        // 核心代碼
        int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
        // 檢查Activity啟動(dòng)結(jié)果
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

這里的核心代碼是ActivityManager.getService().startActivity()，ActivityManager.getService()方法獲取到的是一個(gè)ActivityManagerService對(duì)象，簡(jiǎn)稱AMS，為了簡(jiǎn)便，下文也都將其統(tǒng)稱為“AMS”。AMS可就厲害了，它是Android中的核心服務(wù)，負(fù)責(zé)調(diào)度各應(yīng)用的進(jìn)程，管理四大組件。AMS是一個(gè)Binder，實(shí)現(xiàn)了IActivityManager接口，因此應(yīng)用進(jìn)程能通過Binder機(jī)制調(diào)用系統(tǒng)服務(wù)。

public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                // 獲取服務(wù)Binder
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                // 獲取AMS實(shí)例對(duì)象
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

值得一提的是ServiceManager管理著所有的系統(tǒng)服務(wù)，可以將其類比于DNS域名服務(wù)器，通過服務(wù)名稱可以從ServiceManager中獲取到相應(yīng)的服務(wù)Binder對(duì)象。checkStartActivityResult()方法的作用是檢查Activity的啟動(dòng)結(jié)果，參數(shù)傳入了startActivity()方法的返回值，根據(jù)返回值判斷Activity是否啟動(dòng)成功，如果啟動(dòng)失敗會(huì)拋出異常，常見的Unable to find explicit activity class; have you declared this activity in your AndroidManifest.xml異常就是這里拋出的。
接下來我們來看AMS對(duì)象的startActivity()方法：
ActivityManagerService的startActivity方法

@Override
public final int startActivity(IApplicationThread caller, String callingPackage,
                               Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
                               int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
    return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
            resultWho, requestCode, startFlags, profilerInfo, bOptions,
            UserHandle.getCallingUserId());
}

@Override
public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
                                     Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
                                     int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
    return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
            resultWho, requestCode, startFlags, profilerInfo, bOptions, userId,
            true /*validateIncomingUser*/);
}

public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
                                     Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
                                     int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,
                                     boolean validateIncomingUser) {
    enforceNotIsolatedCaller("startActivity");

    userId = mActivityStartController.checkTargetUser(userId, validateIncomingUser,
            Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");

    return mActivityStartController.obtainStarter(intent, "startActivityAsUser")
            .setCaller(caller)
            .setCallingPackage(callingPackage)
            .setResolvedType(resolvedType)
            .setResultTo(resultTo)
            .setResultWho(resultWho)
            .setRequestCode(requestCode)
            .setStartFlags(startFlags)
            .setProfilerInfo(profilerInfo)
            .setActivityOptions(bOptions)
            .setMayWait(userId)
            .execute();

}

可以看出AMS的startActivity()方法最終會(huì)走到startActivityAsUser()方法中，方法內(nèi)部是一個(gè)挺長(zhǎng)的鏈?zhǔn)秸{(diào)用，第一行的mActivityStartController.obtainStarter()返回的是一個(gè)ActivityStarter對(duì)象，之后的一系列調(diào)用可以看做是對(duì)ActivityStarter的配置，我們直接來看最后調(diào)用的execute()方法。
ActivityStarter的execute方法

int execute() {
    try {
        // for transactional diffs and preprocessing.
        if (mRequest.mayWait) {
            return startActivityMayWait(mRequest.caller, mRequest.callingUid,
                    mRequest.callingPackage, mRequest.intent, mRequest.resolvedType,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.startFlags,
                    mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig,
                    mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId,
                    mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        } else {
            return startActivity(mRequest.caller, mRequest.intent, mRequest.ephemeralIntent,
                    mRequest.resolvedType, mRequest.activityInfo, mRequest.resolveInfo,
                    mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo,
                    mRequest.resultWho, mRequest.requestCode, mRequest.callingPid,
                    mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid,
                    mRequest.realCallingUid, mRequest.startFlags, mRequest.activityOptions,
                    mRequest.ignoreTargetSecurity, mRequest.componentSpecified,
                    mRequest.outActivity, mRequest.inTask, mRequest.reason,
                    mRequest.allowPendingRemoteAnimationRegistryLookup);
        }
    } finally {
        onExecutionComplete();
    }
}

這里有一個(gè)判斷，我們可以不用去了解它的意義，直接來看startActivityMayWait()方法：

private int startActivityMayWait(IApplicationThread caller, int callingUid,
                                 String callingPackage, Intent intent, String resolvedType,
                                 IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                                 IBinder resultTo, String resultWho, int requestCode, int startFlags,
                                 ProfilerInfo profilerInfo, WaitResult outResult,
                                 Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,
                                 int userId, TaskRecord inTask, String reason,
                                 boolean allowPendingRemoteAnimationRegistryLookup) {
    // ...
    // 調(diào)用startActivity方法
    int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,
            voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,
            callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,
            ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,
            allowPendingRemoteAnimationRegistryLookup);
    // ...
    return res;
}

這里省略了大量代碼，可以看到startActivityMayWait()方法最終也是調(diào)用了startActivity()方法，因此我們不需要搞清楚上面判斷的意義，因?yàn)樽罱K執(zhí)行的方法是一樣的。接下來來看ActivityStarter的startActivity()方法：

// 1
private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
                          String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
                          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                          IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
                          String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
                          SafeActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
                          ActivityRecord[] outActivity, TaskRecord inTask, String reason,
                          boolean allowPendingRemoteAnimationRegistryLookup) {

    // ...
    mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,
            aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,
            callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
            options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,
            inTask, allowPendingRemoteAnimationRegistryLookup);
    // ...
    return getExternalResult(mLastStartActivityResult);
}

// 2
private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
                          String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
                          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                          IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
                          String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
                          SafeActivityOptions options,
                          boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity,
                          TaskRecord inTask, boolean allowPendingRemoteAnimationRegistryLookup) {
    // ...
    return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags,
            true /* doResume */, checkedOptions, inTask, outActivity);
}

// 3
private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
                          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                          int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
                          ActivityRecord[] outActivity) {

    // ...
    result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, outActivity);
    // ...
    return result;
}

// 4
private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
                          IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                          int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
                          ActivityRecord[] outActivity) {
    // ...
    mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack,mStartActivity,
            mOptions);
    // ...
    return START_SUCCESS;
}

可以看到經(jīng)過一系列調(diào)用（省略了大量代碼）最終走到了mSupervisor.resumeFocusedStackTopActivityLocked()方法，mSupervisor的類型是ActivityStackSupervisor，我們接著來看ActivityStackSupervisor的resumeFocusedStackTopActivityLocked()方法：
ActivityStackSupervisor的resumeFocusedStackTopActivityLocked方法

boolean resumeFocusedStackTopActivityLocked(
        ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
    // ...
    return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
    // ...
}

方法內(nèi)部調(diào)用了targetStack.resumeTopActivityUncheckedLocked()方法，targetStack的類型是ActivityStack，我們來看它的resumeTopActivityUncheckedLocked()方法：
ActivityStack的resumeTopActivityUncheckedLocked方法

boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
    // ...
    result = resumeTopActivityInnerLocked(prev, options);
    // ...
    return result;
}

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
    // ...
    mStackSupervisor.startSpecificActivityLocked(next, true, false);
    // ...
    return true;
}

最后又回到了ActivityStackSupervisor的startSpecificActivityLocked()方法。
ActivityStackSupervisor的startSpecificActivityLocked方法

void startSpecificActivityLocked(ActivityRecord r,
                                 boolean andResume, boolean checkConfig) {
    // 獲取應(yīng)用進(jìn)程
    ProcessRecord app = mService.getProcessRecordLocked(r.processName,
            r.info.applicationInfo.uid, true);

    getLaunchTimeTracker().setLaunchTime(r);
    
    if (app != null && app.thread != null) {
         // 進(jìn)程已創(chuàng)建
        try {
            // ...
            // 核心代碼
            realStartActivityLocked(r, app, andResume, checkConfig);
            return;
        } catch (RemoteException e) {
            Slog.w(TAG, "Exception when starting activity "
                    + r.intent.getComponent().flattenToShortString(), e);
        }

        // If a dead object exception was thrown -- fall through to
        // restart the application.
    }
    
    // 進(jìn)程不存在則創(chuàng)建應(yīng)用進(jìn)程
    mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
            "activity", r.intent.getComponent(), false, false, true);
}

方法內(nèi)部首先判斷了應(yīng)用程序進(jìn)程是否存在，如果進(jìn)程已創(chuàng)建就調(diào)用realStartActivityLocked() 方法，否則執(zhí)行mService.startProcessLocked()方法常見應(yīng)用進(jìn)程，mService就是ActivityManagerService對(duì)象。本文只討論Activity的啟動(dòng)流程，因此默認(rèn)進(jìn)程已創(chuàng)建，關(guān)于進(jìn)程未創(chuàng)建的情況，對(duì)應(yīng)于點(diǎn)擊應(yīng)用圖標(biāo)啟動(dòng)App的過程，之后我會(huì)再利用一篇筆記進(jìn)行分析。接下來我們來看一下realStartActivityLocked()方法：

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
                                      boolean andResume, boolean checkConfig) throws RemoteException {

    // ...
    // 創(chuàng)建Activity啟動(dòng)事務(wù)
    final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,
            r.appToken);
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
            System.identityHashCode(r), r.info,
            mergedConfiguration.getGlobalConfiguration(),
            mergedConfiguration.getOverrideConfiguration(), r.compat,
            r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
            r.persistentState, results, newIntents, mService.isNextTransitionForward(),
            profilerInfo));

    // Set desired final state.
    final ActivityLifecycleItem lifecycleItem;
    if (andResume) {
        lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());
    } else {
        lifecycleItem = PauseActivityItem.obtain();
    }
    clientTransaction.setLifecycleStateRequest(lifecycleItem);
  
    // 執(zhí)行事務(wù)
    mService.getLifecycleManager().scheduleTransaction(clientTransaction);
    // ...
}

mService.getLifecycleManager()方法獲取到的是一個(gè)ClientLifecycleManager對(duì)象，用來管理Activity的生命周期，可以看到realStartActivityLocked()方法內(nèi)創(chuàng)建了一個(gè)ClientTransaction，表示Activity的啟動(dòng)事務(wù)，最后調(diào)用ClientLifecycleManager的scheduleTransaction()方法執(zhí)行該事務(wù)。接下來我們來看ClientLifecycleManager的scheduleTransaction()方法：
ClientLifecycleManager的scheduleTransaction方法

void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    final IApplicationThread client = transaction.getClient();
    transaction.schedule();
    if (!(client instanceof Binder)) {
        // If client is not an instance of Binder - it's a remote call and at this point it is
        // safe to recycle the object. All objects used for local calls will be recycled after
        // the transaction is executed on client in ActivityThread.
        transaction.recycle();
    }
}

接著調(diào)用了ClientTransaction的schedule()方法：

ClientTransaction的schedule方法

public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this);
}

mClient的類型是IApplicationThread，最開始也提到過，ApplicationThread實(shí)現(xiàn)了IApplicationThread接口，再回過頭看上面的逐級(jí)調(diào)用，不難發(fā)現(xiàn)這里的mClient就是最開始傳入的ApplicationThread對(duì)象，因此我們直接來看ApplicationThread的scheduleTransaction()方法：
ApplicationThread的scheduleTransaction方法

@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    ActivityThread.this.scheduleTransaction(transaction);
}

這里又調(diào)用了ActivityThread的scheduleTransaction()方法，ActivityThread中沒有定義這個(gè)方法，它定義在ActivityThread的父類ClientTransactionHandler中。
ClientTransactionHandler的scheduleTransaction方法

void scheduleTransaction(ClientTransaction transaction) {
    transaction.preExecute(this);
    sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

方法內(nèi)部調(diào)用了sendMessage()方法，該方法是一個(gè)抽象方法，它的實(shí)現(xiàn)在ActivityThread中。
ActivityThread的sendMessage方法

void sendMessage(int what, Object obj) {
    sendMessage(what, obj, 0, 0, false);
}

private void sendMessage(int what, Object obj, int arg1) {
    sendMessage(what, obj, arg1, 0, false);
}

private void sendMessage(int what, Object obj, int arg1, int arg2) {
    sendMessage(what, obj, arg1, arg2, false);
}

private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
    if (DEBUG_MESSAGES) Slog.v(
            TAG, "SCHEDULE " + what + " " + mH.codeToString(what)
                    + ": " + arg1 + " / " + obj);
    Message msg = Message.obtain();
    msg.what = what;
    msg.obj = obj;
    msg.arg1 = arg1;
    msg.arg2 = arg2;
    if (async) {
        msg.setAsynchronous(true);
    }
    mH.sendMessage(msg);
}

mH的類型是H，是ActivityThread內(nèi)部定義的一個(gè)Handler類，sendMessage()方法所做的就是創(chuàng)建并向Handler發(fā)送一個(gè)消息，這個(gè)消息的what值為EXECUTE_TRANSACTION。值得一提的是，在Android 9.0以下版本中，H中定義了LAUNCH_ACTIVITY、PAUSE_ACTIVITY、RESUME_ACTIVITY這些生命周期相關(guān)的消息，而在Android 9.0中已經(jīng)去掉了這些消息，取而代之的就是EXECUTE_TRANSACTION這個(gè)消息。下面我們就來看H的handleMessage()方法，找到對(duì)EXECUTE_TRANSACTION這個(gè)消息的處理。

public void handleMessage(Message msg) {
    // ...
    switch (msg.what) {
        // ...
        case EXECUTE_TRANSACTION:
            final ClientTransaction transaction = (ClientTransaction) msg.obj;
            // 核心代碼
            mTransactionExecutor.execute(transaction);
            if (isSystem()) {
                // Client transactions inside system process are recycled on the client side
                // instead of ClientLifecycleManager to avoid being cleared before this
                // message is handled.
                transaction.recycle();
            }
            // TODO(lifecycler): Recycle locally scheduled transactions.
            break;
        // ...
    }
    // ...
}

這里的核心代碼是mTransactionExecutor.execute(transaction)，mTransactionExecutor的類型是TransactionExecutor，我們來看TransactionExecutor的execute()方法：
TransactionExecutor的execute方法

public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();
    log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

public void executeCallbacks(ClientTransaction transaction) {
    // 這里的callbacks是上面調(diào)用ActivityStackSupervisor中realStartActivityLocked方法時(shí)賦值的
    // ClientTransactionItem的實(shí)際類型為L(zhǎng)aunchActivityItem
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();

    // ...
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        final int postExecutionState = item.getPostExecutionState();
        final int closestPreExecutionState = mHelper.getClosestPreExecutionState(r,
                item.getPostExecutionState());
        // ...
        // 核心代碼
        item.execute(mTransactionHandler, token, mPendingActions);
        item.postExecute(mTransactionHandler, token, mPendingActions);
        // ...
    }
}

execute()方法中調(diào)用了兩個(gè)方法：executeCallbacks(transaction)和executeLifecycleState(transaction)。我們先不去管executeLifecycleState()方法，直接來看executeCallbacks()方法，方法內(nèi)部首先獲取了ClientTransaction中的callbacks，這里的callbacks是上面調(diào)用ActivityStackSupervisor中realStartActivityLocked()方法時(shí)賦值的，類型為LaunchActivityItem，之后會(huì)調(diào)用LaunchActivityItem的execute()方法。
LaunchActivityItem的execute方法

public void execute(ClientTransactionHandler client, IBinder token,
                    PendingTransactionActions pendingActions) {
    // ...
    // 核心代碼
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    // ...
}

方法內(nèi)部調(diào)用了ClientTransactionHandler的handleLaunchActivity()方法，前面也提到過ActivityThread繼承自ClientTransactionHandler，因次這里實(shí)際上調(diào)用的是ActivityThread的handleLaunchActivity()方法，終于回到了我們熟悉的類中。
ActivityThread的handleLaunchActivity方法

public Activity handleLaunchActivity(ActivityClientRecord r,
                                     PendingTransactionActions pendingActions, Intent customIntent) {
    // ...
    // 核心代碼
    final Activity a = performLaunchActivity(r, customIntent);
    // ...
    return a;
}

handleLaunchActivity()方法中又調(diào)用了performLaunchActivity()方法：

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    // ...
  
    java.lang.ClassLoader cl = appContext.getClassLoader();
    // 1.創(chuàng)建Activity對(duì)象
    activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
    // ...
  
    // 2.創(chuàng)建Application對(duì)象，如果已經(jīng)創(chuàng)建則不會(huì)重復(fù)創(chuàng)建
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    // ...
  
    if (activity != null) {
        // ...
        Window window = null;
        if (r.mPendingRemoveWindow != null && r.mPreserveWindow) {
            window = r.mPendingRemoveWindow;
            r.mPendingRemoveWindow = null;
            r.mPendingRemoveWindowManager = null;
        }
        appContext.setOuterContext(activity);
        // 3.創(chuàng)建PhoneWindow
        activity.attach(appContext, this, getInstrumentation(), r.token,
                r.ident, app, r.intent, r.activityInfo, title, r.parent,
                r.embeddedID, r.lastNonConfigurationInstances, config,
                r.referrer, r.voiceInteractor, window, r.configCallback);

        // ...
        // 4.調(diào)用onCreate()方法
        if (r.isPersistable()) {
            mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
        } else {
            mInstrumentation.callActivityOnCreate(activity, r.state);
        }
        // ...
        r.activity = activity;
    }
    // ...
    return activity;
}

performLaunchActivity()方法內(nèi)部主要做了一下幾件事：

• 調(diào)用Instrumentation的newActivity方法創(chuàng)建Activity對(duì)象

public Activity newActivity(ClassLoader cl, String className,
                            Intent intent)
        throws InstantiationException, IllegalAccessException,
        ClassNotFoundException {
    String pkg = intent != null && intent.getComponent() != null
            ? intent.getComponent().getPackageName() : null;
    return getFactory(pkg).instantiateActivity(cl, className, intent);
}

// AppComponentFactory的instantiateActivity方法
public Activity instantiateActivity(ClassLoader cl, String className,
                                    Intent intent)
        throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    return (Activity) cl.loadClass(className).newInstance();
}

可以看出Instrumentation的newActivity方法內(nèi)部就是通過類加載器來創(chuàng)建Activity對(duì)象。

• 調(diào)用r.packageInfo.makeApplication()方法創(chuàng)建Application對(duì)象

public Application makeApplication(boolean forceDefaultAppClass,
                                   Instrumentation instrumentation) {
  // 判斷Application對(duì)象是否已創(chuàng)建，如果已創(chuàng)建就直接返回
  if (mApplication != null) {
        return mApplication;
    }

    // ...

    Application app = null;

    String appClass = mApplicationInfo.className;
    if (forceDefaultAppClass || (appClass == null)) {
        appClass = "android.app.Application";
    }
    
    java.lang.ClassLoader cl = getClassLoader();
    if (!mPackageName.equals("android")) {
        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
                "initializeJavaContextClassLoader");
        initializeJavaContextClassLoader();
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    }
    ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
    // 核心代碼
    // 通過類加載器創(chuàng)建Application對(duì)象
    app = mActivityThread.mInstrumentation.newApplication(
            cl, appClass, appContext);
    appContext.setOuterContext(app);

    mActivityThread.mAllApplications.add(app);
    mApplication = app;

    // ...

    return app;
}

這里的r.packageInfo類型為LoadedApk。makeApplication()方法內(nèi)部首先判斷了Application對(duì)象是否已創(chuàng)建，保證了只有一個(gè)Application對(duì)象。Application對(duì)象是通過調(diào)用Instrumentation的newApplication()方法來創(chuàng)建的，方法內(nèi)部同樣使用了類加載器，這里就不展示了。

• 調(diào)用Activity的attach()方法

final void attach(Context context, ActivityThread aThread,
                  Instrumentation instr, IBinder token, int ident,
                  Application application, Intent intent, ActivityInfo info,
                  CharSequence title, Activity parent, String id,
                  NonConfigurationInstances lastNonConfigurationInstances,
                  Configuration config, String referrer, IVoiceInteractor voiceInteractor,
                  Window window, ActivityConfigCallback activityConfigCallback) {
    // ...

    // 創(chuàng)建PhoneWindow
    mWindow = new PhoneWindow(this, window, activityConfigCallback);

    // ...

    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
    if (mParent != null) {
        mWindow.setContainer(mParent.getWindow());
    }
    mWindowManager = mWindow.getWindowManager();
    // ...
}

attach()方法主要做了兩件事：創(chuàng)建Window對(duì)象，類型為PhotoWindow；為Window對(duì)象關(guān)聯(lián)WindowManager，這屬于View繪制的研究范疇，本文中就不具體研究了。

• 調(diào)用Instrumentation的callActivityOnCreate()方法

public void callActivityOnCreate(Activity activity, Bundle icicle) {
    prePerformCreate(activity);
    activity.performCreate(icicle);
    postPerformCreate(activity);
}

public void callActivityOnCreate(Activity activity, Bundle icicle,
                                 PersistableBundle persistentState) {
    prePerformCreate(activity);
    activity.performCreate(icicle, persistentState);
    postPerformCreate(activity);
}

方法內(nèi)部調(diào)用了Activity的performCreate()方法。
Activity的performCreate方法

final void performCreate(Bundle icicle) {
    performCreate(icicle, null);
}

final void performCreate(Bundle icicle, PersistableBundle persistentState) {
    // ...
    // 調(diào)用Activity的onCreate()方法
    if (persistentState != null) {
        onCreate(icicle, persistentState);
    } else {
        onCreate(icicle);
    }
    // ...
}

方法內(nèi)部調(diào)用了我們最熟悉的Activity生命周期onCreate()方法，到這里Activity的啟動(dòng)流程基本上就分析得差不多了。不過你可能還會(huì)有個(gè)疑惑，onCreate()之后的onStart()和onResume()是在哪里調(diào)用的呢，我在這里也是繞了好久，我看到網(wǎng)上的一些源碼分析中有一些是在performLaunchActivity()方法最后調(diào)用了Activity的performStart()方法，進(jìn)而回調(diào)了onStart()方法，可能是由于版本不同，我這里并沒有調(diào)用該方法。還記得上面的分析中在TransactionExecutor的execute()方法中調(diào)用的executeLifecycleState()嗎，是時(shí)候來看一下這個(gè)方法了。
TransactionExecutor的executeLifecycleState方法

private void executeLifecycleState(ClientTransaction transaction) {
    // lifecycleItem的類型為ResumeActivityItem
    final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest();
    if (lifecycleItem == null) {
        // No lifecycle request, return early.
        return;
    }

    // ...

    // Cycle to the state right before the final requested state.
    cycleToPath(r, lifecycleItem.getTargetState(), true /* excludeLastState */);

    // Execute the final transition with proper parameters.
    lifecycleItem.execute(mTransactionHandler, token, mPendingActions);
    lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions);
}

這里transaction.getLifecycleStateRequest()獲取到的ActivityLifecycleItem同樣是在之前調(diào)用ActivityStackSupervisor中的realStartActivityLocked()方法時(shí)賦值的，類型為ResumeActivityItem，之后調(diào)用了cycleToPath()方法。

private void cycleToPath(ActivityClientRecord r, int finish,
                         boolean excludeLastState) {
    final int start = r.getLifecycleState();
    log("Cycle from: " + start + " to: " + finish + " excludeLastState:" + excludeLastState);
    final IntArray path = mHelper.getLifecyclePath(start, finish, excludeLastState);
    performLifecycleSequence(r, path);
}

cycleToPath()方法內(nèi)部會(huì)調(diào)用TransactionExecutorHelper的getLifecyclePath()方法，該方法的作用是根據(jù)傳入的起始生命周期狀態(tài)和最終生命周期狀態(tài)生成一個(gè)數(shù)組，比如當(dāng)前生命周期狀態(tài)為為ON_CREATE，而finish狀態(tài)為lifecycleItem.getTargetState()，也就是ResumeActivityItem.getTargetState()即ON_RESUME，中間間隔了一個(gè)生命周期狀態(tài)ON_START，因此這里生成的數(shù)組包含一個(gè)元素ON_START。Activity生命周期對(duì)應(yīng)的狀態(tài)值如下：

public static final int ON_CREATE = 1;
public static final int ON_START = 2;
public static final int ON_RESUME = 3;
public static final int ON_PAUSE = 4;
public static final int ON_STOP = 5;
public static final int ON_DESTROY = 6;
public static final int ON_RESTART = 7;

接下來會(huì)調(diào)用performLifecycleSequence()方法：

private void performLifecycleSequence(ActivityClientRecord r, IntArray path) {
    final int size = path.size();
    for (int i = 0, state; i < size; i++) {
        state = path.get(i);
        log("Transitioning to state: " + state);
        switch (state) {
            case ON_CREATE:
                mTransactionHandler.handleLaunchActivity(r, mPendingActions,
                        null /* customIntent */);
                break;
            case ON_START:
                mTransactionHandler.handleStartActivity(r, mPendingActions);
                break;
            case ON_RESUME:
                mTransactionHandler.handleResumeActivity(r.token, false /* finalStateRequest */,
                        r.isForward, "LIFECYCLER_RESUME_ACTIVITY");
                break;
            case ON_PAUSE:
                mTransactionHandler.handlePauseActivity(r.token, false /* finished */,
                        false /* userLeaving */, 0 /* configChanges */, mPendingActions,
                        "LIFECYCLER_PAUSE_ACTIVITY");
                break;
            case ON_STOP:
                mTransactionHandler.handleStopActivity(r.token, false /* show */,
                        0 /* configChanges */, mPendingActions, false /* finalStateRequest */,
                        "LIFECYCLER_STOP_ACTIVITY");
                break;
            case ON_DESTROY:
                mTransactionHandler.handleDestroyActivity(r.token, false /* finishing */,
                        0 /* configChanges */, false /* getNonConfigInstance */,
                        "performLifecycleSequence. cycling to:" + path.get(size - 1));
                break;
            case ON_RESTART:
                mTransactionHandler.performRestartActivity(r.token, false /* start */);
                break;
            default:
                throw new IllegalArgumentException("Unexpected lifecycle state: " + state);
        }
    }
}

可以看出這里會(huì)根據(jù)上一步生成的數(shù)組依次執(zhí)行相應(yīng)的生命周期相關(guān)方法，由于這里的數(shù)組只包含一個(gè)元素ON_START，因此會(huì)執(zhí)行mTransactionHandler.handleStartActivity()方法，之后的步驟就和onCreate()的執(zhí)行過程很相似了，即調(diào)用ActivityThread的handleStartActivity()方法，方法內(nèi)部調(diào)用Activity的performStart()方法，繼而回調(diào)生命周期onStart()方法，這里就不具體展示源碼分析了。
接下來我們回到executeLifecycleState()方法中，在執(zhí)行cycleToPath()方法后調(diào)用了lifecycleItem.execute()方法，由于這里的lifecycleItem是ResumeActivityItem，因此我們來看ResumeActivityItem的execute()方法：
ResumeActivityItem的execute方法

@Override
public void execute(ClientTransactionHandler client, IBinder token,
                    PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityResume");
    // 核心代碼
    client.handleResumeActivity(token, true /* finalStateRequest */, mIsForward,
            "RESUME_ACTIVITY");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

可以看到和此前的兩個(gè)生命周期方法調(diào)用類似，同樣是先調(diào)用了ActivityThread的handleResumeActivity()方法，之后調(diào)用performResumeActivity()，最后會(huì)調(diào)用onResume()生命周期方法。
上述的流程只是我的簡(jiǎn)單分析，實(shí)際過程肯定要更復(fù)雜，個(gè)人水平比較有限，因此只能這樣簡(jiǎn)單地分析一下（PS：加斷點(diǎn)調(diào)試把我搞得有點(diǎn)蒙，實(shí)際執(zhí)行的流程其實(shí)并不是像我分析得這樣，有的方法會(huì)執(zhí)行多次），不正確的地方歡迎指出。
到這里整個(gè)Activity的啟動(dòng)流程就分析得差不多了，實(shí)際的流程要比分析的復(fù)雜得多，也會(huì)涉及到很多其他的知識(shí)點(diǎn)，包括View的繪制和進(jìn)程的創(chuàng)建等等，由于水平有限很多地方只能淺嘗輒止，太過深入源碼容易迷失方向。上一張流程圖總結(jié)一下吧：

Activity啟動(dòng)流程

從分析和圖中我們也能發(fā)現(xiàn)在Activity的啟動(dòng)流程中有幾個(gè)類起到了至關(guān)重要的作用：

• Instrumentation

最開始調(diào)用AMS方法，最后創(chuàng)建Activity和Application對(duì)象都是通過它來實(shí)現(xiàn)的。

• ActivityManagerService

Android中的核心服務(wù)，應(yīng)用進(jìn)程通過Binder機(jī)制可以調(diào)用系統(tǒng)服務(wù)。

• ActivityThread

應(yīng)用程序的入口，Activity各個(gè)生命周期的調(diào)用都是通過ActivityThread內(nèi)部的Handler接收和處理消息來實(shí)現(xiàn)的。

上面的流程圖我已經(jīng)上傳到了github，如果不清晰的話可以查看原圖

總結(jié)

本文是針對(duì)Android 9.0（API Level 28）的源碼進(jìn)行分析的，與其他版本會(huì)有一些不同，但是大體流程不會(huì)差太多，主要差別就是在調(diào)用realStartActivityLocked()方法之后Handler的消息處理，有興趣的話可以自行查看源碼。由于個(gè)人水平不足，很多地方可能分析得不準(zhǔn)確，也不夠全面，希望大佬們可以指出。
最后總結(jié)一下我的一些心得，對(duì)于目前的我來說分析源碼實(shí)在是一件枯燥痛苦的事，需要了解的知識(shí)點(diǎn)有很多，文章前前后后寫了很久，中間中斷了好多次，也借鑒了很多大佬的成果，終于算是寫完了。但是拋開過程中的痛苦，當(dāng)真正把一個(gè)流程理順之后還是會(huì)覺得心情舒暢，雖然文章中的一些分析可能一段時(shí)間后還是會(huì)遺忘，但是我收獲更多的是源碼閱讀和分析能力的提高，而且自己真正從頭分析了一遍之后再?gòu)?fù)習(xí)起來就會(huì)容易的多。希望今后能夠更多地閱讀一些系統(tǒng)或者優(yōu)秀第三方庫的源碼，不斷提高自己。

參考資料

死磕Android_App 啟動(dòng)過程（含 Activity 啟動(dòng)過程）
Android9.0 Activity啟動(dòng)流程分析（三）
《Android開發(fā)藝術(shù)探索》