-
概述
本文分析Activity在FrameWork层的启动流程,基于API29源码进行分析。
不管是在Launcher启动还是程序内自写代码的启动,最终都是通过startActivity方法开启Activty启动流程,startActivity方法又有通过ContextImpl和Activity两种方式实现,前者是通过ActivityThread的Instrumentation实现,后者是通过Activity的Instrumentation实现,其实都是同一个Instrumentation,只不过这个Instrumentation实例是在Activity的启动过程中创建的,如果我们要找一个开始,那就是系统启动Launcher的时候会创建一个Instrumentation,而一切都是从它的execStartActivity方法开始的。
-
Instrumentation的execStartActivity方法
Instrumentation的意思是仪表盘,意味着它是启动的外在控制接口。
public ActivityResult execStartActivity( Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode, Bundle options) { IApplicationThread whoThread = (IApplicationThread) contextThread; ... try { ... int result = ActivityTaskManager.getService() .startActivity(whoThread, who.getBasePackageName(), intent, intent.resolveTypeIfNeeded(who.getContentResolver()), token, target != null ? target.mEmbeddedID : null, requestCode, 0, null, options); //启动结果会以int的形式返回,这里检查各种异常 checkStartActivityResult(result, intent); } catch (RemoteException e) { throw new RuntimeException("Failure from system", e); } return null; }
这里调用了ActivityTaskManager.getService():
public static IActivityTaskManager getService() { return IActivityTaskManagerSingleton.get(); } @UnsupportedAppUsage(trackingBug = 129726065) private static final Singleton<IActivityTaskManager> IActivityTaskManagerSingleton = new Singleton<IActivityTaskManager>() { @Override protected IActivityTaskManager create() { final IBinder b = ServiceManager.getService(Context.ACTIVITY_TASK_SERVICE); return IActivityTaskManager.Stub.asInterface(b); } };
从这里通过Binder开始进入了进程间调用,获取的是IActivityTaskManager类型实例,它的实现类是ActivityTaskManagerService。
-
ActivityTaskManagerService的startActivityAsUser方法
int startActivityAsUser(IApplicationThread caller, String callingPackage, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) { enforceNotIsolatedCaller("startActivityAsUser"); userId = getActivityStartController().checkTargetUser(userId, validateIncomingUser, Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser"); // TODO: Switch to user app stacks here. return getActivityStartController().obtainStarter(intent, "startActivityAsUser") .setCaller(caller) .setCallingPackage(callingPackage) .setResolvedType(resolvedType) .setResultTo(resultTo) .setResultWho(resultWho) .setRequestCode(requestCode) .setStartFlags(startFlags) .setProfilerInfo(profilerInfo) .setActivityOptions(bOptions) .setMayWait(userId) .execute(); }
startActivity最终会调用到startActivityAsUser方法,getActivityStartController方法获取一个ActivityStartController对象,它在ActivityTaskManagerService初始化(initialize方法)的时候创建,它的obtainStarter方法如下:
ActivityStarter obtainStarter(Intent intent, String reason) { return mFactory.obtain().setIntent(intent).setReason(reason); }
这个mFactory是在构造时传入的ActivityStarter.DefaultFactory:
@Override public ActivityStarter obtain() { ActivityStarter starter = mStarterPool.acquire(); if (starter == null) { starter = new ActivityStarter(mController, mService, mSupervisor, mInterceptor); } return starter; }
可见obtainStarter返回的就是ActivityStarter。
-
ActivityStarter
ActivityStarter对象进行的一系列的set调用把信息都封装到了一个ActivityStarter.Request对象中,然后调用execute方法:
int execute() { try { // TODO(b/64750076): Look into passing request directly to these methods to allow // for transactional diffs and preprocessing. if (mRequest.mayWait) { return startActivityMayWait(mRequest.caller, mRequest.callingUid, mRequest.callingPackage, mRequest.realCallingPid, mRequest.realCallingUid, mRequest.intent, mRequest.resolvedType, mRequest.voiceSession, mRequest.voiceInteractor, mRequest.resultTo, mRequest.resultWho, mRequest.requestCode, mRequest.startFlags, mRequest.profilerInfo, mRequest.waitResult, mRequest.globalConfig, mRequest.activityOptions, mRequest.ignoreTargetSecurity, mRequest.userId, mRequest.inTask, mRequest.reason, mRequest.allowPendingRemoteAnimationRegistryLookup, mRequest.originatingPendingIntent, mRequest.allowBackgroundActivityStart); } else { return startActivity(mRequest.caller, ...); } } finally { onExecutionComplete(); } }
因为调用了setMayWait方法,这个方法里会设置mRequest.mayWait为true,表示是否等待Activity的启动结果,因此这里会走到startActivityMayWait方法,其内部又调用了:
int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options, ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason, allowPendingRemoteAnimationRegistryLookup, originatingPendingIntent, allowBackgroundActivityStart);
startActivity方法有一系列重载,在最后一个startActivity中:
private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask, ActivityRecord[] outActivity, boolean restrictedBgActivity) { int result = START_CANCELED; final ActivityStack startedActivityStack; try { mService.mWindowManager.deferSurfaceLayout(); result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor, startFlags, doResume, options, inTask, outActivity, restrictedBgActivity); } finally { ... if (ActivityManager.isStartResultSuccessful(result)) { if (startedActivityStack != null) { // we have to update the configuration for changing to different display. final ActivityRecord currentTop = startedActivityStack.topRunningActivityLocked(); if (currentTop != null && currentTop.shouldUpdateConfigForDisplayChanged()) { mRootActivityContainer.ensureVisibilityAndConfig( currentTop, currentTop.getDisplayId(), true /* markFrozenIfConfigChanged */, false /* deferResume */); } } } else{...} mService.mWindowManager.continueSurfaceLayout(); } postStartActivityProcessing(r, result, startedActivityStack); return result; }
可以看到,这里调用了startActivityUnchecked方法继续启动:
//创建或者获取要启动的Activity所附属的ActivityTask if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) { newTask = true; result = setTaskFromReuseOrCreateNewTask(taskToAffiliate); } else if (mSourceRecord != null) { result = setTaskFromSourceRecord(); } else if (mInTask != null) { result = setTaskFromInTask(); } else { result = setTaskToCurrentTopOrCreateNewTask(); } if (mDoResume) { if (!mTargetStack.isFocusable() || (topTaskActivity != null && topTaskActivity.mTaskOverlay && mStartActivity != topTaskActivity)) { if (mTargetStack.isFocusable() && !mRootActivityContainer.isTopDisplayFocusedStack(mTargetStack)) { mTargetStack.moveToFront("startActivityUnchecked"); } mRootActivityContainer.resumeFocusedStacksTopActivities( mTargetStack, mStartActivity, mOptions); } }
mDoResume在前面startActivity方法入口时传入的是true,mTargetStack是前面获取的要启动的Activity所属的Task,如果不在前台则调用moveToFront方法将其移到前台,然后调用mRootActivityContainer的resumeFocusedStacksTopActivities方法:
boolean resumeFocusedStacksTopActivities( ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) { ... boolean result = false; if (targetStack != null && (targetStack.isTopStackOnDisplay() || getTopDisplayFocusedStack() == targetStack)) { result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions); } ... }
resumeTopActivityUncheckedLocked方法如下:
boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) { ... boolean result = false; try { // Protect against recursion. mInResumeTopActivity = true; result = resumeTopActivityInnerLocked(prev, options); ... }... return result; }
这里又调用了resumeTopActivityInnerLocked方法:
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) { ... ActivityRecord next = topRunningActivityLocked(true /* focusableOnly */); ... if (next.attachedToProcess()) { ... }else{ ... mStackSupervisor.startSpecificActivityLocked(next, true, true); } return true; }
此时的attachedToProcess会返回false,因为此时还没和process绑定,所以会走到ActivityStackSupervisor的startSpecificActivityLocked方法:
void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) { // Is this activity's application already running? final WindowProcessController wpc = mService.getProcessController(r.processName, r.info.applicationInfo.uid); ... //如果Activity所需的进程已启动 if (wpc != null && wpc.hasThread()) { try { realStartActivityLocked(r, wpc, andResume, checkConfig); return; } ... ... try { ... //如果是需要启动新进程 final Message msg = PooledLambda.obtainMessage( ActivityManagerInternal::startProcess, mService.mAmInternal, r.processName, r.info.applicationInfo, knownToBeDead, "activity", r.intent.getComponent()); mService.mH.sendMessage(msg); }... }
这里会根据mService.getProcessController是否能取到WindowProcessController来判断是否需要新建进程启动,getProcessController方法内是根据ActivityInfo的processName保存的WindowProcessController,因此我们回到创建ActivityInfo的地方看看这个processName是什么。
ActivityInfo在ActivityStackSupervisor的resolveIntent方法中通过mService.getPackageManagerInternalLocked().resolveIntent方法生成的:
PackageManagerInternal getPackageManagerInternalLocked() { if (mPmInternal == null) { mPmInternal = LocalServices.getService(PackageManagerInternal.class); } return mPmInternal; }
可以看到,这里是通过LocalServices保存和获取对应的Internal的,前面的ActivityTaskManagerService也是通过它保存的ActivityTaskManagerInternal,那么这里的PackageManagerInternal实际上是什么呢?看名字我们分析这应该是和包管理相关的,顺着这个思路我们在PackageManagerService中找到了:
LocalServices.addService( PackageManagerInternal.class, new PackageManagerInternalImpl());
再往下就走到Package解析里去了,只需要知道这里的processName是根据包名生成的。
startSpecificActivityLocked分了两个逻辑,一个是需要创建新进程的,一个是不需要的。
-
依附于当前进程的Activity启动:realStartActivityLocked
如果Activity所附属的进程已启动,则会直接进入realStartActivityLocked逻辑分支。
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc, boolean andResume, boolean checkConfig) throws RemoteException { ... r.setProcess(proc); ... ... // Create activity launch transaction. final ClientTransaction clientTransaction = ClientTransaction.obtain( proc.getThread(), r.appToken); final DisplayContent dc = r.getDisplay().mDisplayContent; clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),...)); // Set desired final state. final ActivityLifecycleItem lifecycleItem; if (andResume) { lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward()); } else { lifecycleItem = PauseActivityItem.obtain(); } clientTransaction.setLifecycleStateRequest(lifecycleItem); // Schedule transaction. mService.getLifecycleManager().scheduleTransaction(clientTransaction); ... // Perform OOM scoring after the activity state is set, so the process can be updated with the latest state. proc.onStartActivity(mService.mTopProcessState, r.info); ... return true; }
scheduleTransaction来自于ClientLifecycleManager:
void scheduleTransaction(ClientTransaction transaction) throws RemoteException { final IApplicationThread client = transaction.getClient(); transaction.schedule(); if (!(client instanceof Binder)) { transaction.recycle(); } }
这里调用了ClientTransaction的schedule方法:
public void schedule() throws RemoteException { mClient.scheduleTransaction(this); }
mClient是一个IApplicationThread对象,通过ClientTransaction.obtain方法构造时传入:
public static ClientTransaction obtain(IApplicationThread client, IBinder activityToken) { ClientTransaction instance = ObjectPool.obtain(ClientTransaction.class); if (instance == null) { instance = new ClientTransaction(); } instance.mClient = client; instance.mActivityToken = activityToken; return instance; }
可见,这个IApplicationThread是proc.getThread(),proc来自于startSpecificActivityLocked方法中的wpc,它通过mService.getProcessController(r.processName, r.info.applicationInfo.uid)获取的,在进程创建的时候ActivityTaskManagerService会保存一个属于这个进程的WindowProcessController,它的Thread就是ApplicationThread(IApplicationThread实现类),ApplicationThread是ActivityThread的内部私有类,因此我们推测它的实例化都是在ActivityThread中完成的(也只能是这样),mService.getProcessController获取的ApplicationThread是怎么来的我们后面再看,现在先看一下它的scheduleTransaction方法:
@Override public void scheduleTransaction(ClientTransaction transaction) throws RemoteException { ActivityThread.this.scheduleTransaction(transaction); }
可见,就是调用的ActvityThread的scheduleTransaction方法,ActvityThread继承自ClientTransactionHandler,scheduleTransaction方法是在ClientTransactionHandler中定义并实现的:
void scheduleTransaction(ClientTransaction transaction) { transaction.preExecute(this); sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction); }
preExecute我们不用管,只是一些预处理操作回调,我们看见这里调用了sendMessage方法,它在ActivityThread中实现,最终是调用了mH.sendMessage方法,我们看一下mH的msg处理逻辑:
class H extends Handler { ... public void handleMessage(Message msg) { ... case EXECUTE_TRANSACTION: final ClientTransaction transaction = (ClientTransaction) msg.obj; mTransactionExecutor.execute(transaction); ... break; ... } }
这里调用了TransactionExecutor的execute方法来处理ClientTransaction:
public void execute(ClientTransaction transaction) { ... executeCallbacks(transaction); executeLifecycleState(transaction); ... }
这里的核心就是调用了两个方法,先看executeCallbacks:
public void executeCallbacks(ClientTransaction transaction) { final List<ClientTransactionItem> callbacks = transaction.getCallbacks(); ... final int size = callbacks.size(); for (int i = 0; i < size; ++i) { final ClientTransactionItem item = callbacks.get(i); ... item.execute(mTransactionHandler, token, mPendingActions); item.postExecute(mTransactionHandler, token, mPendingActions); ... } }
这里会通过ClientTransaction的getCallbacks方法获取mActivityCallbacks,它是一个ClientTransactionItem集合,然后调用每一个ClientTransactionItem的execute方法,ClientTransactionItem是什么呢?还记得我们前面在realStartActivityLocked方法中调用ClientTransaction的addCallback方法添加的LaunchActivityItem.obtain()实例吗:
public static LaunchActivityItem obtain(Intent intent, int ident, ActivityInfo info, Configuration curConfig, Configuration overrideConfig, CompatibilityInfo compatInfo, String referrer, IVoiceInteractor voiceInteractor, int procState, Bundle state, PersistableBundle persistentState, List<ResultInfo> pendingResults, List<ReferrerIntent> pendingNewIntents, boolean isForward, ProfilerInfo profilerInfo, IBinder assistToken) { LaunchActivityItem instance = ObjectPool.obtain(LaunchActivityItem.class); if (instance == null) { instance = new LaunchActivityItem(); } setValues(instance, intent, ident, info, curConfig, overrideConfig, compatInfo, referrer, voiceInteractor, procState, state, persistentState, pendingResults, pendingNewIntents, isForward, profilerInfo, assistToken); return instance; }
所以只针对启动而言,会有一个LaunchActivityItem实例存在于mActivityCallbacks中,因此这里也会调用它的execute方法:
public void execute(ClientTransactionHandler client, IBinder token, PendingTransactionActions pendingActions) { Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart"); ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo, mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState, mPendingResults, mPendingNewIntents, mIsForward, mProfilerInfo, client, mAssistToken); client.handleLaunchActivity(r, pendingActions, null /* customIntent */); Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER); }
client是前面的mTransactionHandler,在构造TransactionExecutor时传入:
public final class ActivityThread extends ClientTransactionHandler { ... private final TransactionExecutor mTransactionExecutor = new TransactionExecutor(this); ... }
因此client就是ActivityThread,它的handleLaunchActivity方法如下:
public Activity handleLaunchActivity(ActivityClientRecord r, PendingTransactionActions pendingActions, Intent customIntent) { ... final Activity a = performLaunchActivity(r, customIntent); ... return a; }
内部调用了performLaunchActivity方法创建Activity实例:
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) { ActivityInfo aInfo = r.activityInfo; ... ComponentName component = r.intent.getComponent(); ... //创建Activity的Context ContextImpl appContext = createBaseContextForActivity(r); Activity activity = null; try { //创建Activity java.lang.ClassLoader cl = appContext.getClassLoader(); activity = mInstrumentation.newActivity( cl, component.getClassName(), r.intent); ... } ... try { //创建Application Application app = r.packageInfo.makeApplication(false, mInstrumentation); ... if (activity != null) { ... Window window = null; ... appContext.setOuterContext(activity); activity.attach(appContext, this, getInstrumentation(), r.token, r.ident, app, r.intent, r.activityInfo, title, r.parent, r.embeddedID, r.lastNonConfigurationInstances, config, r.referrer, r.voiceInteractor, window, r.configCallback, r.assistToken); ... int theme = r.activityInfo.getThemeResource(); if (theme != 0) { activity.setTheme(theme); } ... //这里根据是否持久化调用onCreate的不同重载方法 if (r.isPersistable()) { mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState); } else { mInstrumentation.callActivityOnCreate(activity, r.state); } ... } ... } ... ... return activity; }
可以看到,原来是在这里创建了Context、Activity和Application,而且调用了我们熟悉的onCreate方法。
你可能会问,怎么没有调用onResume方法呢?还记得前面的TransactionExecutor的execute方法中调用executeCallbacks之后紧跟着还调用了executeLifecycleState方法吗。在executeLifecycleState方法中:
private void executeLifecycleState(ClientTransaction transaction) { final ActivityLifecycleItem lifecycleItem = transaction.getLifecycleStateRequest(); ... lifecycleItem.execute(mTransactionHandler, token, mPendingActions); lifecycleItem.postExecute(mTransactionHandler, token, mPendingActions); }
getLifecycleStateRequest获取的就是前面realStartActivityLocked方法中设置的:
final ActivityLifecycleItem lifecycleItem; if (andResume) { lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward()); } else { lifecycleItem = PauseActivityItem.obtain(); } clientTransaction.setLifecycleStateRequest(lifecycleItem);
在启动流程场景中andResume传入的是true,这里会根据是否需要显示设置不同的ActivityLifecycleItem,不管是ResumeActivityItem还是PauseActivityItem,其内部的execute逻辑和LaunchActivityItem都是一样的,最终都会通过mH调用到ActivityThread的相关方法里,在那些方法里会调用对应的Activity的生命周期方法,比如onResume或onPause,这个就不再看了。
到此为止,我们看到了进程已存在的时候Activity是如何启动的,前面我们使用的WindowProcessController的ApplicationThread是进程创建时已经创建好的,那么这个ApplicationThread是怎样创建的呢?
-
进程不存在时的Activity启动
通过前面的分析,我们知道在ActivityStackSupervisor的startSpecificActivityLocked方法中,如果Activity需要依附的进程还未启动时会走另一个逻辑分支:
final Message msg = PooledLambda.obtainMessage( ActivityManagerInternal::startProcess, mService.mAmInternal, r.processName, r.info.applicationInfo, knownToBeDead, "activity", r.intent.getComponent()); mService.mH.sendMessage(msg);
这里看到,mService,也就是ActivityTaskManagerService中也有一个mH,这里会给他发送一个消息,经过代码发现PooledLambda.obtainMessage获取的是一个空的Message,并没有设置what属性,而mH的handleMessage方法中并没有处理这种Message的逻辑:
//ActivityTaskManagerService.H public void handleMessage(Message msg) { switch (msg.what) { case REPORT_TIME_TRACKER_MSG: { AppTimeTracker tracker = (AppTimeTracker) msg.obj; tracker.deliverResult(mContext); } break; } }
那么它是怎么继续工作的呢?
我们发现,这里使用Lambda语法传递了一个ActivityManagerInternal::startProcess函数,obtainMessage方法的其他参数是要传给startProcess的参数:
static <A, B, C, D, E, F> Message obtainMessage( HexConsumer<? super A, ? super B, ? super C, ? super D, ? super E, ? super F> function, A arg1, B arg2, C arg3, D arg4, E arg5, F arg6) { synchronized (Message.sPoolSync) { PooledRunnable callback = acquire(PooledLambdaImpl.sMessageCallbacksPool, function, 6, 0, ReturnType.VOID, arg1, arg2, arg3, arg4, arg5, arg6, null, null, null); return Message.obtain().setCallback(callback.recycleOnUse()); } }
acquire会创建或者复用一个PooledLambdaImpl对象,它持有一个mFunc字段,指向的是一个由编译器根据Lambda规则生成的Consumer实现类对象,内部持有了ActivityManagerInternal::startProcess函数,mArgs数组持有该函数需要的参数。
mH调用sendMessage的时候内部会设置该msg的target为mH本身,然后根据Looper原理,sendMessage方法会走到msg.target的dispatchMessage方法(在Handler中定义并实现的):
public void dispatchMessage(@NonNull Message msg) { if (msg.callback != null) { handleCallback(msg); } else { if (mCallback != null) { if (mCallback.handleMessage(msg)) { return; } } handleMessage(msg); } }
可以看到,因为我们前面给Message设置了callback,所以这里不会走Handler的handleMessage方法,而是走了handleCallback方法:
private static void handleCallback(Message message) { message.callback.run(); }
可见在这里调用了callback的run方法,根据前面的分析,callback就是PooledLambdaImpl,它的run方法在其父类OmniFunction中实现:
@Override public void run() { invoke(null, null, null, null, null, null, null, null, null); }
invoke方法是在PooledLambdaImpl中实现:
@Override R invoke(Object a1, Object a2, Object a3, Object a4, Object a5, Object a6, Object a7, Object a8, Object a9) { ... try { return doInvoke(); } finally { if (isRecycleOnUse()) doRecycle(); if (!isRecycled()) { int argsSize = ArrayUtils.size(mArgs); for (int i = 0; i < argsSize; i++) { popArg(i); } } } }
这里又会调用doInvoke方法:
private R doInvoke() { final int funcType = getFlags(MASK_FUNC_TYPE); final int argCount = LambdaType.decodeArgCount(funcType); final int returnType = LambdaType.decodeReturnType(funcType); switch (argCount) { ... case 6: { switch (returnType) { case LambdaType.ReturnType.VOID: { ((HexConsumer) mFunc).accept(popArg(0), popArg(1), popArg(2), popArg(3), popArg(4), popArg(5)); return null; } case LambdaType.ReturnType.BOOLEAN: { return (R) (Object) ((HexPredicate) mFunc).test(popArg(0), popArg(1), popArg(2), popArg(3), popArg(4), popArg(5)); } case LambdaType.ReturnType.OBJECT: { return (R) ((HexFunction) mFunc).apply(popArg(0), popArg(1), popArg(2), popArg(3), popArg(4), popArg(5)); } } } break; ... } ... }
这里会根据参数的个数选择对应的执行分支,我们这里用的是6个参数函数,因此这里会走到6这个分支,再根据返回类型决定执行mFunc的哪个方法,这里因为传入的是VOID类型,所以会执行accept方法,jdk1.8编译器会根据Lambda规则生成Consumer实现代码,在accept中调用真正的函数,也就是ActivityManagerInternal::startProcess函数。
那么调用哪个实例的startProcess函数呢?前面的obtainMessage方法中第二个参数传入的mService.mAmInternal是一个ActivityManagerInternal实例:
mAmInternal = LocalServices.getService(ActivityManagerInternal.class);
我们找到LocalServices添加它的地方在ActivityManagerService的start方法中:
LocalServices.addService(ActivityManagerInternal.class, new LocalService());
所以真正调用的是LocalService的startProcess函数:
@Override public void startProcess(String processName, ApplicationInfo info, boolean knownToBeDead, String hostingType, ComponentName hostingName) { ... synchronized (ActivityManagerService.this) { startProcessLocked(processName, info, knownToBeDead, 0 /* intentFlags */, new HostingRecord(hostingType, hostingName), false /* allowWhileBooting */, false /* isolated */, true /* keepIfLarge */); } ... }
之后经过以下的几次调用:
//ActivityManagerService: final ProcessRecord startProcessLocked(String processName,ApplicationInfo info, ...) { return mProcessList.startProcessLocked(processName, info, ...); } //ProcessList: final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,...){ ... final boolean success = startProcessLocked(app, hostingRecord, abiOverride); ... return success ? app : null; } final boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord, String abiOverride) { return startProcessLocked(app, hostingRecord,...); } boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,...) { ... //调用重载方法 return startProcessLocked(hostingRecord, entryPoint, app, uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith,startTime); } boolean startProcessLocked(HostingRecord hostingRecord, String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith, long startTime) { ... final Process.ProcessStartResult startResult = startProcess(hostingRecord, entryPoint, app,uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet,invokeWith, startTime); handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,startSeq, false); ... }
最终来到了startProcess方法:
private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith, long startTime) { try { Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " + app.processName); checkSlow(startTime, "startProcess: asking zygote to start proc"); final Process.ProcessStartResult startResult; if (hostingRecord.usesWebviewZygote()) { startResult = startWebView(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, app.info.packageName, new String[] {PROC_START_SEQ_IDENT + app.startSeq}); } else if (hostingRecord.usesAppZygote()) { final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app); startResult = appZygote.getProcess().start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, app.info.packageName, /*useUsapPool=*/ false, new String[] {PROC_START_SEQ_IDENT + app.startSeq}); } else { startResult = Process.start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, invokeWith, app.info.packageName, new String[] {PROC_START_SEQ_IDENT + app.startSeq}); } checkSlow(startTime, "startProcess: returned from zygote!"); return startResult; } finally { Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER); } }
这里有三种启动方式,通过Process来创建进程:
public boolean usesAppZygote() { return mHostingZygote == APP_ZYGOTE; } public boolean usesWebviewZygote() { return mHostingZygote == WEBVIEW_ZYGOTE; }
因为mHostingZygote属性只能通过构造HostingRecord时传入,ActivityManagerservice的startProcess方法中传入的HostingRecord是两个参数的构造方法创建的:
public HostingRecord(String hostingType, ComponentName hostingName) { this(hostingType, hostingName, REGULAR_ZYGOTE); }
此处传入的默认mHostingZygote是REGULAR_ZYGOTE,因此这里会走到Process.start启动逻辑:
public static ProcessStartResult start(@NonNull final String processClass,...) { return ZYGOTE_PROCESS.start(processClass, ...); }
再往下就是Process的启动逻辑了,又是另一个章节了,不是我们目前的目标。
到现在为止,我们看到了新进程创建完成了,但是没看见Activity启动。回到最后一级startProcessLocked方法,startProcess方法之后调用了handleProcessStartedLocked方法:
boolean handleProcessStartedLocked(ProcessRecord app, int pid, boolean usingWrapper, long expectedStartSeq, boolean procAttached) { ... mService.mPidsSelfLocked.put(app); ... return true; }
这里就是进程创建完需要逻辑回调的地方。mService是ActivityManagerService,mPidsSelfLocked是一个PidMap,它的put方法如下:
void put(ProcessRecord app) { synchronized (this) { mPidMap.put(app.pid, app); } mAtmInternal.onProcessMapped(app.pid, app.getWindowProcessController()); }
ActivityManagerService的mAtmInternal是通过key为ActivityTaskManagerInternal添加到LocalServices中的,它实际上是:
//ActivityManagerService的start方法中: LocalServices.addService(ActivityTaskManagerInternal.class, mInternal); //ActivityManagerService构造方法中: mInternal = new LocalService();
所以看LocalService的onProcessMapped方法:
@Override public void onProcessMapped(int pid, WindowProcessController proc) { synchronized (mGlobalLock) { mProcessMap.put(pid, proc); } }
还记得之前在startSpecificActivityLocked方法中分成两个逻辑时是根据什么判断的吗?正是ActivityTaskManagerService的getProcessController方法:
WindowProcessController getProcessController(int pid, int uid) { final WindowProcessController proc = mProcessMap.getProcess(pid); if (proc == null) return null; if (UserHandle.isApp(uid) && proc.mUid == uid) { return proc; } return null; }
因此进程创建完就会把新进程的WindowProcessController添加到mProcessMap中。但是现在添加太晚了啊,startSpecificActivityLocked的判断逻辑已经过去了呀,整个逻辑又怎么再次回到startSpecificActivityLocked中的呢?即现在无法再回到过去转而调用realStartActivityLocked了啊。
这里就需要熟悉Zygote的知识了,Zygote进行fork出子进程后会调用到ActivityThread的main方法,Zygote分析得另开一文,这里只需要先这么记住。
main方法里有这么两句:
ActivityThread thread = new ActivityThread(); thread.attach(false, startSeq);
ActivityThread的attach方法中有:
final IActivityManager mgr = ActivityManager.getService(); mgr.attachApplication(mAppThread, startSeq);
我们已经知道IActivityManager的实现类就是ActivityManagerService,它的attachApplication方法调用了attachApplicationLocked方法,这个方法内会调用mAtmInternal.attachApplication(app.getWindowProcessController())方法,前面我们知道mAtmInternal就是ActivityTaskManagerService.LocalService,它的attachApplication方法如下:
public boolean attachApplication(WindowProcessController wpc) throws RemoteException { synchronized (mGlobalLockWithoutBoost) { return mRootActivityContainer.attachApplication(wpc); } }
这里又会调用到RootActivityContainer的attachApplication方法:
boolean attachApplication(WindowProcessController app) throws RemoteException { final String processName = app.mName; boolean didSomething = false; for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) { final ActivityDisplay display = mActivityDisplays.get(displayNdx); final ActivityStack stack = display.getFocusedStack(); if (stack != null) { //获取目标栈中所有的需要显示的ActivityRecord stack.getAllRunningVisibleActivitiesLocked(mTmpActivityList); final ActivityRecord top = stack.topRunningActivityLocked(); final int size = mTmpActivityList.size(); for (int i = 0; i < size; i++) { final ActivityRecord activity = mTmpActivityList.get(i); if (activity.app == null && app.mUid == activity.info.applicationInfo.uid && processName.equals(activity.processName)) { try { if (mStackSupervisor.realStartActivityLocked(activity, app, top == activity /* andResume */, true /* checkConfig */)) { didSomething = true; } } catch (RemoteException e) { Slog.w(TAG, "Exception in new application when starting activity " + top.intent.getComponent().flattenToShortString(), e); throw e; } } } } } if (!didSomething) { ensureActivitiesVisible(null, 0, false /* preserve_windows */); } return didSomething; }
可以看到,这里会取到焦点Stack,然后遍历其所有的Activity,调用ActivityStackSupervisor的realStartActivityLocked方法把它们创建或者恢复到正常生命周期。
所以如果创建Activity之前需要启动新进程的情况的话,在进程启动完之后会直接调用realStartActivityLocked方法创建Activity,不再通过startSpecificActivityLocked方法的分支走了。
-
总结
我们根据API29的源码分析了整个Activity的启动过程,其中又分成新进程启动方式和当前进程内启动方式两种。分析过后,我认为在API29的源码逻辑下,整个Activity的启动逻辑分成4部分:
-
角色进场
-
首先,Instrumentation负责以Binder的方式引出ActivityTaskManagerService,调用它的startActivity方法开启创建。
-
启动之后,它会根据启动结果值判断是否启动成功,如果失败会由它来负责爆出对应错误。
-
-
Stack信息的创建和维护
-
进入到ActivityTaskManagerService的startActivity逻辑后,它会通过内部的ActivityStartController创建或获取一个ActivityStarter,然后通过它的一系列链式方法把启动信息封装到一个ActivityStarter.Request对象中,然后调用ActivityStarter的execute方法。
-
execute方法中会调用startActivityMayWait方法,它会通过一系列startActivity重载方法调用到startActivityUnchecked方法中,这个方法中会根据Activity的启动信息(ActivityRecord)找到所在的目标栈(mTargetStack),如果没找到则会创建一个,然后把这个栈对象设置成焦点栈并移到前台(如果Activity需要被显示的话)。
-
然后调用了RootActivityContainer的resumeFocusedStacksTopActivities方法。在这个方法中,会调用目标栈对象(ActivityStack)的resumeTopActivityUncheckedLocked方法,其内部又会调用resumeTopActivityInnerLocked方法,这个方法内部又会调用startSpecificActivityLocked方法,从这里开始分成上述的两种启动方式。
-
-
Activity创建逻辑
在不需要创建新进程时,也就是在当前进程下创建Activity时,这部分逻辑的入口在ActivityStackSupervisor的realStartActivityLocked方法。
- 这个方法中会获取一个ClientTransaction对象,然后给它添加一个叫LaunchActivityItem的callback,再设置一个叫做ActivityLifecycleItem,如果是需要显示的Activity则设置ResumeActivityItem,否则设置PauseActivityItem。然后获取ActivityTaskManagerService的mLifecycleManager(ClientLifecycleManager),调用它的scheduleTransaction方法,把ClientTransaction对象传进去。
- scheduleTransaction方法中会调用ClientTransaction对象的schedule方法。
- schedule方法中会调用ApplicationThread的scheduleTransaction方法,ApplicationThread是ActivityThread的内部类,它继承自IApplicationThread.Stub,它的scheduleTransaction方法中调用了ActivityThread.this.scheduleTransaction方法,ActivityThread的scheduleTransaction方法实现在其父类ClientTransactionHandler中,在这里调用sendMessage方法,这个方法在ActivityThread里实现,在这里调用了mH的sendMessage方法,mH是ActivityThread.H。
- ActivityThread.H的handleMessage方法里处理EXECUTE_TRANSACTION这个信息,会调用TransactionExecutor的execute方法,传入的是ClientTransaction,这个方法里会调用executeCallbacks和executeLifecycleState方法。
- executeCallbacks内部会获取ClientTransaction的所有callback(ClientTransactionItem),然后调用每一个ClientTransactionItem的execute方法,自然也包括前面设置的LaunchActivityItem,它的execute方法中会调用传入的参数—ClientTransactionHandler—的handleLaunchActivity方法,传入的这个ClientTransactionHandler就是构造TransactionExecutor时传入的ActivityThread,因此handleLaunchActivity方法位于ActivityThread中,这个方法中又会调用performLaunchActivity方法,在其中会创建Activity实例、调用activity的attach、onCreate方法。
- executeLifecycleState方法逻辑中会找到设置的ActivityLifecycleItem,也就是ResumeActivityItem或PauseActivityItem,和LaunchActivityItem的流程一样,最终会调用activity的onResume或onPause方法。
-
新进程启动方式中回调到Activity启动逻辑的流程
- 在新进程启动方式中需要Zygote的知识才能理解回到启动Activity的逻辑。只需要知道Zygote启动完成后会调用ActivityThread的main函数。
- 在main函数中会调用ActivityThread的attach方法,它会调用到ActivityManagerService的attachApplication方法,这个方法又会调用ActivityTaskManagerService.LocalService的attachApplication方法。
- 然后又调用RootActivityContainer的attachApplication方法,在这个方法中会把焦点Stack内部的Activity信息依次传入ActivityStackSupervisor的realStartActivityLocked方法,到这就进入了同样的Activity的创建逻辑。
-
网友评论