Android Activity组件的启动过程

登山则情满于山，观海则意溢于海。这篇文章主要讲述Android Activity组件的启动过程相关的知识，希望能为你提供帮助。
0、总图

文章图片

1、总图中的第一步，Laucher主线程向ActivityManagerService进程发出START_ACTIVITY_TRANSACTION

文章图片

如图：第一步
~/android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

class ActivityManagerProxy implements IActivityManager {public int startActivity(IApplicationThread caller, Intent intent, String resolvedType, Uri[] grantedUriPermissions, int grantedMode, IBinder resultTo, String resultWho, int requestCode, boolean onlyIfNeeded, boolean debug) throws RemoteException { Parcel data = https://www.songbingjia.com/android/Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IActivityManager.descriptor); data.writeStrongBinder(caller != null ?
caller.asBinder() : null); intent.writeToParcel(data, 0); ......... data.writeStrongBinder(resultTo); mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0); }

当中caller为：

final ApplicationThread mAppThread = new ApplicationThread();

继承于ApplicationThreadNative，ApplicationThreadNative继承于Binder实现了IApplicationThread。

resultTo例如以下图所看到的：

java层的Parcel，writeStrongBinder方法，最后映射到C+ + 层。运行例如以下：
~/Android/frameworks/base/core/jni
----android_util_Binder.cpp

static void android_os_Parcel_writeStrongBinder(JNIEnv* env, jobject clazz, jobject object)//clazz为Parcel。object指向了在Java层中创建的硬件訪问服务FregService { Parcel* parcel = parcelForJavaObject(env, clazz); //获取java层Parcel对象data的引用 if (parcel != NULL) { const status_t err = parcel-> writeStrongBinder(ibinderForJavaObject(env, object)); if (err != NO_ERROR) { jniThrowException(env, " java/lang/OutOfMemoryError" , NULL); } } }

ibinderForjavaObject实现例如以下：
~/Android/frameworks/base/core/jni
----android_util_Binder.cpp

sp< IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj) { if (obj == NULL) return NULL; if (env-> IsInstanceOf(obj, gBinderOffsets.mClass)) { JavaBBinderHolder* jbh = (JavaBBinderHolder*) env-> GetIntField(obj, gBinderOffsets.mObject); //这里把obj对象的mObject成员变量强制转为JavaBBinderHolder对象 return jbh != NULL ? jbh-> get(env) : NULL; }if (env-> IsInstanceOf(obj, gBinderProxyOffsets.mClass)) { return (IBinder*) env-> GetIntField(obj, gBinderProxyOffsets.mObject); }LOGW(" ibinderForJavaObject: %p is not a Binder object" , obj); return NULL; }

（1）假设传入的是caller.asBinder()，那么首先生成一个JavaBBinder本地对象。

（2）假设传入的是resultTo，那么生成一个代理对象。

writeStrongBinder实现例如以下：
～/Android/frameworks/base/libs/binder
----Parcel.cpp

status_t Parcel::writeStrongBinder(const sp< IBinder> & val) { return flatten_binder(ProcessState::self(), val, this); }

status_t flatten_binder(const sp< ProcessState> & proc, const sp< IBinder> & binder, Parcel* out) { flat_binder_object obj; obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS; if (binder != NULL) { IBinder *local = binder-> localBinder(); if (!local) { BpBinder *proxy = binder-> remoteBinder(); if (proxy == NULL) { LOGE(" null proxy" ); } const int32_t handle = proxy ? proxy-> handle() : 0; obj.type = BINDER_TYPE_HANDLE; obj.handle = handle; obj.cookie = NULL; } else { obj.type = BINDER_TYPE_BINDER; obj.binder = local-> getWeakRefs(); obj.cookie = local; } } else { obj.type = BINDER_TYPE_BINDER; obj.binder = NULL; obj.cookie = NULL; }return finish_flatten_binder(binder, obj, out); }

（1）假设是本地对象，obj.cookie为本地对象IBinder地址。
（2）假设是代理对象。obj.handle为代理对象的句柄值。

如图：第二步
Binder Driver：调用binder_transaction:
～/Android//kernel/goldfish/drivers/staging/android
----binder.c

case BINDER_TYPE_BINDER: case BINDER_TYPE_WEAK_BINDER: { struct binder_ref *ref; struct binder_node *node = binder_get_node(proc, fp-> binder); if (node == NULL) { node = binder_new_node(proc, fp-> binder, fp-> cookie); ...... } ....... ref = binder_get_ref_for_node(target_proc, node); if (ref == NULL) { return_error = BR_FAILED_REPLY; goto err_binder_get_ref_for_node_failed; } if (fp-> type == BINDER_TYPE_BINDER) fp-> type = BINDER_TYPE_HANDLE; else fp-> type = BINDER_TYPE_WEAK_HANDLE; fp-> handle = ref-> desc; ...... } break; case BINDER_TYPE_HANDLE: case BINDER_TYPE_WEAK_HANDLE: { struct binder_ref *ref = binder_get_ref(proc, fp-> handle); ...... if (ref-> node-> proc == target_proc) { if (fp-> type == BINDER_TYPE_HANDLE) fp-> type = BINDER_TYPE_BINDER; else fp-> type = BINDER_TYPE_WEAK_BINDER; fp-> binder = ref-> node-> ptr; fp-> cookie = ref-> node-> cookie; binder_inc_node(ref-> node, fp-> type == BINDER_TYPE_BINDER, 0, NULL); if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) printk(KERN_INFO " ref %d desc %d -> node %d u%p\n" , ref-> debug_id, ref-> desc, ref-> node-> debug_id, ref-> node-> ptr); } else { ....... } } break;

（1）假设是BINDER_TYPE_BINDER，首先创建实体对象，再创建引用对象。handle为引用句柄值。

（2）假设是BINDER_TYPE_HANDLE，首先获取引用对象。再获取实体对象。cookie为本地对象IBinder的地址。

如图：第三步

~/Android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

public abstract class ActivityManagerNative extends Binder implements IActivityManager { ...... public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { case START_ACTIVITY_TRANSACTION: { data.enforceInterface(IActivityManager.descriptor); IBinder b = data.readStrongBinder(); < span style=" font-size:14px; " > IApplicationThread app = ApplicationThreadNative.asInterface(b); < /span> Intent intent = Intent.CREATOR.createFromParcel(data); String resolvedType = data.readString(); ...... IBinder resultTo = data.readStrongBinder(); ...... return true; }

Parcel类readStrongBinder映射到C+ + 层，运行例如以下：
～/Android/frameworks/base/core/jni
----android_util_Binder.cpp

static jobject android_os_Parcel_readStrongBinder(JNIEnv* env, jobject clazz) { Parcel* parcel = parcelForJavaObject(env, clazz); //获得Java层reply的引用 if (parcel != NULL) { return javaObjectForIBinder(env, parcel-> readStrongBinder()); } return NULL; }

~/Android/frameworks/base/libs/binder
----Parcel.cpp

sp< IBinder> Parcel::readStrongBinder() const { sp< IBinder> val; unflatten_binder(ProcessState::self(), *this, & val); return val; }

status_t unflatten_binder(const sp< ProcessState> & proc, const Parcel& in, sp< IBinder> * out) { const flat_binder_object* flat = in.readObject(false); if (flat) { switch (flat-> type) { case BINDER_TYPE_BINDER: *out = static_cast< IBinder*> (flat-> cookie); return finish_unflatten_binder(NULL, *flat, in); case BINDER_TYPE_HANDLE: *out = proc-> getStrongProxyForHandle(flat-> handle); return finish_unflatten_binder( static_cast< BpBinder*> (out-> get()), *flat, in); } } return BAD_TYPE; }

（1）假设是BINDER_TYPE_BINDER，返回本地对象。
（2）假设是BINDER_TYPE_HANDLE。依据句柄值，返回代理对象。

然后运行javaObjectForIBinder。
~/Android/frameworks/base/core/jni ----android_util_Binder.cpp

jobject javaObjectForIBinder(JNIEnv* env, const sp< IBinder> & val) { if (val == NULL) return NULL; if (val-> checkSubclass(& gBinderOffsets)) { // One of our own! jobject object = static_cast< JavaBBinder*> (val.get())-> object(); ........ return object; }// For the rest of the function we will hold this lock, to serialize // looking/creation of Java proxies for native Binder proxies. AutoMutex _l(mProxyLock); // Someone else' s...do we know about it? jobject object = (jobject)val-> findObject(& gBinderProxyOffsets); //检查当前进程之前是否已经为它创建过一个BinderProxy对象 if (object != NULL) {//假设有返回来的就是一个指向该BinderProxy对象的WeakReference对象object,即一个弱引用对象 jobject res = env-> CallObjectMethod(object, gWeakReferenceOffsets.mGet); //因为弱引用对象object所指向的BinderProxy对象可能已经失效。因此，须要检查它的有效性。方法是调用它的成员函数get来获得一个强引用对象。 if (res != NULL) {//假设不为NULL ...... return res; //直接返回 } ..... android_atomic_dec(& gNumProxyRefs); //假设为NULL val-> detachObject(& gBinderProxyOffsets); //解除它与一个无效的BinderProxy对象的相应关系 env-> DeleteGlobalRef(object); //删除弱引用对象的全局引用 }object = env-> NewObject(gBinderProxyOffsets.mClass, gBinderProxyOffsets.mConstructor); //创建一个BinderProxy对象 if (object != NULL) { ....... env-> SetIntField(object, gBinderProxyOffsets.mObject, (int)val.get()); //BinderProxy.mObject成员变量记录了这个BpBinder对象的地址 val-> incStrong(object); // The native object needs to hold a weak reference back to the // proxy, so we can retrieve the same proxy if it is still active. jobject refObject = env-> NewGlobalRef( env-> GetObjectField(object, gBinderProxyOffsets.mSelf)); //获取BinderProxy内部的成员变量mSelf(BinderProxy的弱引用对象)。接着再创建一个全局引用对象来引用它 val-> attachObject(& gBinderProxyOffsets, refObject, jnienv_to_javavm(env), proxy_cleanup); //把它放到BpBinder里面去，下次就要使用时，就能够在上一步调用BpBinder::findObj把它找回来了// Note that a new object reference has been created. android_atomic_inc(& gNumProxyRefs); incRefsCreated(env); }return object; }

（1）假设是本地对象。首先向下转型为JavaBBinder，然后取得ActivityRecord对象，它继承了IApplicationToken.Stub。
而IApplicationToken.Stub继承Binder。实现了IApplicationToken。
所以能够向上转型为IBinder。

IBinder resultTo = data.readStrongBinder();

（2）假设是代理对象。首先生成BinderProxy对象，里面的mObject指向代理对象，向上转型为IBinder。

IBinder b = data.readStrongBinder(); IApplicationThread app = ApplicationThreadNative.asInterface(b);

然后生成ActivityManagerProxy对象。里面mRemote指向BinderProxy对象。

如图：第四步
～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java

public final class ActivityManagerService extends ActivityManagerNative{public final int startActivity(IApplicationThread caller, Intent intent, String resolvedType, Uri[] grantedUriPermissions, int grantedMode, IBinder resultTo, String resultWho, int requestCode, boolean onlyIfNeeded, boolean debug) { return mMainStack.startActivityMayWait(caller, intent, resolvedType, grantedUriPermissions, grantedMode, resultTo, resultWho, requestCode, onlyIfNeeded, debug, null, null); } ..... }

主要干了下面几件事：
（1）依据resultTo在ActivityManagerService进程找到用来描写叙述Laucher组件的一个ActivityRecord对象。代码例如以下：
~/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java，final int startActivityLocked

ActivityRecord sourceRecord = null; if (resultTo != null) { int index = indexOfTokenLocked(resultTo); ......... if (index > = 0) { sourceRecord = (ActivityRecord)mHistory.get(index); ........ } }

（2）依据传递过来的intent创建了一个新的ActivityRecord对象，用来描写叙述即将启动的Activity组件，即MainActivity组件。代码例如以下：

~/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java，final int startActivityLocked

ActivityRecord r = new ActivityRecord(mService, this, callerApp, callingUid, intent, resolvedType, aInfo, mService.mConfiguration, resultRecord, resultWho, requestCode, componentSpecified);

（3）因为须要在新的任务栈中启动Activity，所以设置r.task属性。代码例如以下：

~/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java。startActivityUncheckedLocked

if (r.resultTo == null & & !addingToTask & & (launchFlags& Intent.FLAG_ACTIVITY_NEW_TASK) != 0) { // todo: should do better management of integers. ...... r.task = new TaskRecord(mService.mCurTask, r.info, intent, (r.info.flags& ActivityInfo.FLAG_CLEAR_TASK_ON_LAUNCH) != 0); ...... newTask = true; if (mMainStack) { mService.addRecentTaskLocked(r.task); }}

（4）mHistory加入用来描写叙述MainActivity组件的ActivityRecord对象。
代码例如以下：

~/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java。private final int startActivityLocked

final int NH = mHistory.size(); int addPos = -1; ....... if (addPos < 0) { addPos = NH; }....... mHistory.add(addPos, r);

（5）ActivityManagerService进程向Laucher子线程发送SCHEDULE_PAUSE_ACTIVITY_TRANSACTION。
代码例如以下：

~/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java，private final void startPausingLocked

if (prev.app != null & & prev.app.thread != null) { ........ try { ....... prev.app.thread.schedulePauseActivity(prev, prev.finishing, userLeaving, prev.configChangeFlags); ....... } catch (Exception e) { ....... } }

2、总图中的第二步，ActivityManagerService进程向Laucher子线程发送SCHEDULE_PAUSE_ACTIVITY_TRANSACTION

文章图片

如图：第一步
~/Android/frameworks/base/core/java/android/app
----ApplicationThreadNative.java，ApplicationThreadProxy类

public final void schedulePauseActivity(IBinder token, boolean finished, boolean userLeaving, int configChanges) throws RemoteException { Parcel data = https://www.songbingjia.com/android/Parcel.obtain(); data.writeInterfaceToken(IApplicationThread.descriptor); data.writeStrongBinder(token); data.writeInt(finished ? 1 : 0); data.writeInt(userLeaving ? 1 :0); data.writeInt(configChanges); mRemote.transact(SCHEDULE_PAUSE_ACTIVITY_TRANSACTION, data, null, IBinder.FLAG_ONEWAY); data.recycle(); }

当中token是ActivityServiceManager进程的ActivityRecord对象。用来表述Lancher组件。

如图：第二步，省略binder_transaction传输过程，由于上面已经分析过了。

如图：第三步

~/Android/frameworks/base/core/java/android/app
----ApplicationThreadNative.java

public abstract class ApplicationThreadNative extends Binder implements IApplicationThread { ........ public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { case SCHEDULE_PAUSE_ACTIVITY_TRANSACTION: { data.enforceInterface(IApplicationThread.descriptor); IBinder b = data.readStrongBinder(); boolean finished = data.readInt() != 0; boolean userLeaving = data.readInt() != 0; int configChanges = data.readInt(); schedulePauseActivity(b, finished, userLeaving, configChanges); return true; }

当中b为一个BinderProxy的Binder代理对象。指向了ActivityManagerService中与Laucher组件相应的一个AcitivityRecord对象。

如图：第四步

~/Android/frameworks/base/core/java/android/app

----ActivityThread.java

private final class ApplicationThread extends ApplicationThreadNative { .......public final void schedulePauseActivity(IBinder token, boolean finished, boolean userLeaving, int configChanges) { queueOrSendMessage( finished ? H.PAUSE_ACTIVITY_FINISHING : H.PAUSE_ACTIVITY, token, (userLeaving ? 1 : 0), configChanges); }

向Laucher主线程发送PAUSE_ACTIVITY_FINISHING命令。

~/Android/frameworks/base/core/java/android/app

----ActivityThread.java

private final class H extends Handler { ......... public void handleMessage(Message msg) { ....... switch (msg.what) { ........ case PAUSE_ACTIVITY: handlePauseActivity((IBinder)msg.obj, false, msg.arg1 != 0, msg.arg2); ....... break;

（1）获取了ActivityClientRecord对象，在Lancher进程启动的每个Activity组件都使用一个ActivityClientRecord对象来描写叙述。
（2）Laucher组件运行pause操作。
代码例如以下：

~/Android/frameworks/base/core/java/android/app

----ActivityThread.java

private final void handlePauseActivity(IBinder token, boolean finished, boolean userLeaving, int configChanges) { ActivityClientRecord r = mActivities.get(token); if (r != null) { //Slog.v(TAG, " userLeaving=" + userLeaving + " handling pause of " + r); if (userLeaving) { performUserLeavingActivity(r); }r.activity.mConfigChangeFlags |= configChanges; Bundle state = performPauseActivity(token, finished, true); // Make sure any pending writes are now committed. QueuedWork.waitToFinish(); // Tell the activity manager we have paused. try { ActivityManagerNative.getDefault().activityPaused(token, state); } catch (RemoteException ex) { } } }

（3）Laucher主线程向ActivityServiceManager进程发送ACTIVITY_PAUSED_TRANSACTION。

3、Laucher主线程向ActivityServiceManager进程发送ACTIVITY_PAUSED_TRANSACTION

文章图片

如图：第一步

~/Android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

public void activityPaused(IBinder token, Bundle state) throws RemoteException { Parcel data = https://www.songbingjia.com/android/Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IActivityManager.descriptor); data.writeStrongBinder(token); data.writeBundle(state); mRemote.transact(ACTIVITY_PAUSED_TRANSACTION, data, reply, 0); reply.readException(); data.recycle(); reply.recycle(); }

token为一个BinderProxy的Binder代理对象，指向了ActivityManagerService中与Laucher组件相应的一个AcitivityRecord对象。

如图：第二步，省略binder_transaction传输过程，由于上面已经分析过了。

如图：第三步

~/Android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

public abstract class ActivityManagerNative extends Binder implements IActivityManager { ...... public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { case ACTIVITY_PAUSED_TRANSACTION: { data.enforceInterface(IActivityManager.descriptor); IBinder token = data.readStrongBinder(); Bundle map = data.readBundle(); activityPaused(token, map); reply.writeNoException(); return true; } ....... }

当中token是ActivityServiceManager进程的ActivityRecord对象，用来表述Lancher组件。

如图：第四步

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java

public final class ActivityManagerService extends ActivityManagerNative{public final void activityPaused(IBinder token, Bundle icicle) { // Refuse possible leaked file descriptors if (icicle != null & & icicle.hasFileDescriptors()) { throw new IllegalArgumentException(" File descriptors passed in Bundle" ); }final long origId = Binder.clearCallingIdentity(); mMainStack.activityPaused(token, icicle, false); Binder.restoreCallingIdentity(origId); } ..... }

主要做了下面几件事：
（1）创建MainActivity进程。即ProcessRecord对象。
代码例如以下：

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java

final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting) { ProcessRecord app = getProcessRecordLocked(processName, info.uid); ....... if (app == null) { app = newProcessRecordLocked(null, info, processName); ....... } else { ...... } ...... }

（2）开启MainActivity子线程。

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java，startProcessLocked

int pid = Process.start(" android.app.ActivityThread" , mSimpleProcessManagement ?
app.processName : null, uid, uid, gids, debugFlags, null);

（3）MainActivity子线程向ActivityManagerService主进程发送ATTACH_APPLICATION_TRANSACTION。

~/Android/frameworks/base/core/java/android/app

----ActivityThread.java
【Android Activity组件的启动过程】

public static final void main(String[] args) { .....Looper.prepareMainLooper(); ...... ActivityThread thread = new ActivityThread(); thread.attach(false); ......Looper.loop(); ...... }

private final void attach(boolean system) { ..... mSystemThread = system; if (!system) { ...... IActivityManager mgr = ActivityManagerNative.getDefault(); try { mgr.attachApplication(mAppThread); } catch (RemoteException ex) { } } ..... }

4、MainActivity子线程向ActivityManagerService主进程发送ATTACH_APPLICATION_TRANSACTION

文章图片

如图：第一步
~/Android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

class ActivityManagerProxy implements IActivityManager {public void attachApplication(IApplicationThread app) throws RemoteException { Parcel data = https://www.songbingjia.com/android/Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IActivityManager.descriptor); data.writeStrongBinder(app.asBinder()); mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0); reply.readException(); data.recycle(); reply.recycle(); } ...... }

app为：

final ApplicationThread mAppThread = new ApplicationThread();

继承于ApplicationThreadNative，ApplicationThreadNative继承于Binder实现了IApplicationThread。

如图：第二步，省略binder_transaction传输过程。由于上面已经分析过了。

如图：第三步

~/Android/frameworks/base/core/java/android/app
----ActivityManagerNative.java

public abstract class ActivityManagerNative extends Binder implements IActivityManager { ...... public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { case ATTACH_APPLICATION_TRANSACTION: { data.enforceInterface(IActivityManager.descriptor); IApplicationThread app = ApplicationThreadNative.asInterface( data.readStrongBinder()); if (app != null) { attachApplication(app); } reply.writeNoException(); return true; } ....... }

首先生成BinderProxy对象，里面的mObject指向代理对象，向上转型为IBinder。
然后生成ApplicationThreadProxy对象，里面mRemote指向BinderProxy对象。

如图：第四步

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java

public final class ActivityManagerService extends ActivityManagerNative{public final void attachApplication(IApplicationThread thread) { synchronized (this) { int callingPid = Binder.getCallingPid(); final long origId = Binder.clearCallingIdentity(); attachApplicationLocked(thread, callingPid); Binder.restoreCallingIdentity(origId); } } ..... }

主要做下面几件事：
（1）前面得到的ProcessRecord对象app就是用来描写叙述MainActivity进程的。如今既然MainActivity进程已经启动起来了，那么就继续对ProcessRecord对象app进行初始化，当中最重要的是将它的成员变量thread设置为指向ApplicationThread代理对象。

例如以下图：

代码例如以下：

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityManagerService.java

public final class ActivityManagerService extends ActivityManagerNative{ private final boolean attachApplicationLocked(IApplicationThread thread, int pid) {/.. ProcessRecord app; if (pid != MY_PID & & pid > = 0) { synchronized (mPidsSelfLocked) { app = mPidsSelfLocked.get(pid); } } else if (mStartingProcesses.size() > 0) { ..... } else { .... }..........app.thread = thread; ..... }

（2）r.app = app
代码例如以下：
～/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app, boolean andResume, boolean checkConfig) throws RemoteException {..... r.app = app; ..... }

（3）ActivityServiceManager进程向MainActivity子线程发送

～/Android/frameworks/base/services/java/com/android/server/am

----ActivityStack.java

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app, boolean andResume, boolean checkConfig) throws RemoteException {..... app.thread.scheduleLaunchActivity(new Intent(r.intent), r, System.identityHashCode(r), r.info, r.icicle, results, newIntents, !andResume, mService.isNextTransitionForward()); ..... }

5、ActivityServiceManager进程向MainActivity子线程发送SCHEDULE_LAUNCH_ACTIVITY_TRANSACTION

文章图片

如图：第一步
~/Android/frameworks/base/core/java/android/app
----ApplicationThreadNative.java，ApplicationThreadProxy类

public final void scheduleLaunchActivity(Intent intent, IBinder token, int ident, ActivityInfo info, Bundle state, List< ResultInfo> pendingResults, List< Intent> pendingNewIntents, boolean notResumed, boolean isForward) throws RemoteException { Parcel data = https://www.songbingjia.com/android/Parcel.obtain(); data.writeInterfaceToken(IApplicationThread.descriptor); intent.writeToParcel(data, 0); data.writeStrongBinder(token); data.writeInt(ident); info.writeToParcel(data, 0); data.writeBundle(state); data.writeTypedList(pendingResults); data.writeTypedList(pendingNewIntents); data.writeInt(notResumed ? 1 : 0); data.writeInt(isForward ?
1 : 0); mRemote.transact(SCHEDULE_LAUNCH_ACTIVITY_TRANSACTION, data, null, IBinder.FLAG_ONEWAY); data.recycle(); }

当中token是ActivityServiceManager进程的ActivityRecord对象，用来表述MainActivity组件。

如图：第二步。省略binder_transaction传输过程，由于上面已经分析过了。

如图：第三步

~/Android/frameworks/base/core/java/android/app
----ApplicationThreadNative.java

public abstract class ApplicationThreadNative extends Binder implements IApplicationThread { ........ public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { case SCHEDULE_LAUNCH_ACTIVITY_TRANSACTION: { data.enforceInterface(IApplicationThread.descriptor); Intent intent = Intent.CREATOR.createFromParcel(data); IBinder b = data.readStrongBinder(); int ident = data.readInt(); ActivityInfo info = ActivityInfo.CREATOR.createFromParcel(data); Bundle state = data.readBundle(); List< ResultInfo> ri = data.createTypedArrayList(ResultInfo.CREATOR); List< Intent> pi = data.createTypedArrayList(Intent.CREATOR); boolean notResumed = data.readInt() != 0; boolean isForward = data.readInt() != 0; scheduleLaunchActivity(intent, b, ident, info, state, ri, pi, notResumed, isForward); return true; } ..... }

当中b为一个BinderProxy的Binder代理对象。指向了ActivityManagerService中与MainActivity组件相应的一个AcitivityRecord对象。

接下来，主要做下面几件事：
（1）创建ActivityClientRecord对象。
代码例如以下：

~/Android/frameworks/base/core/java/android/app

----ActivityThread.java

public final void scheduleLaunchActivity(Intent intent, IBinder token, int ident, ActivityInfo info, Bundle state, List< ResultInfo> pendingResults, List< Intent> pendingNewIntents, boolean notResumed, boolean isForward) { ActivityClientRecord r = new ActivityClientRecord(); ... }

（2）通过Handler发送信息给MainActivity主线程
运行mActivity.put(r.token。r)，当中r.token为一个BinderProxy的Binder代理对象，指向了ActivityManagerService中与MainActivity组件相应的一个AcitivityRecord对象。
r为刚刚创建的ActivityClientRecord对象。
（3）MainActivity组件运行onCreate操作，最后会调用MainActivity的onCreate方法。