Activity启动过程分析(从Launcher启动)

　　 概述：在Android系统中，Activity是应用程序的四大组件之一，在开发Android应用时无时无刻都在使用它们。但是它们的启动过程是怎么样的？Activity的什么周期方法到底是怎么被执行？本篇将结合源码（7.0.0_r1）进行分析。

先来看看启动调用的时序图

源码:packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

public class Launcher extends Activity
        implements View.OnClickListener, OnLongClickListener, LauncherModel.Callbacks,View.OnTouchListener, PageSwitchListener, LauncherProviderChangeListener {

    ...省略代码专用...

    /**
     * Launches the intent referred by the clicked shortcut.
     *
     * @param v The view representing the clicked shortcut.
     */
    public void onClick(View v) {

        ...省略代码专用...

        if (v instanceof Workspace) {
            if (mWorkspace.isInOverviewMode()) {
                showWorkspace(true);
            }
            return;
        }

        if (v instanceof CellLayout) {
            if (mWorkspace.isInOverviewMode()) {
                showWorkspace(mWorkspace.indexOfChild(v), true);
            }
        }

        Object tag = v.getTag();
        if (tag instanceof ShortcutInfo) {
            onClickAppShortcut(v);
        } else if (tag instanceof FolderInfo) {
            if (v instanceof FolderIcon) {
                onClickFolderIcon(v);
            }
        } else if (v == mAllAppsButton) {
            onClickAllAppsButton(v);
        } else if (tag instanceof AppInfo) {
            startAppShortcutOrInfoActivity(v);
        } else if (tag instanceof LauncherAppWidgetInfo) {
            if (v instanceof PendingAppWidgetHostView) {
                onClickPendingWidget((PendingAppWidgetHostView) v);
            }
        }
    }

    ...省略代码专用...

}

Android中桌面的应用程序都是由Launcher启动的，其中Launcher本身也是一个应用，当应用程序安装完成后都会在桌面创建相应的应用程序图标，点击这个图标，Launcher就会将其启动起来。桌面其实用了一个RecyclerView来构建，具体请看AllAppsContainerView源码。当我们点击图标的时候，则直接执行onClickAppShortcut方法，来看其代码

源码:packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

/**
 * Event handler for an app shortcut click.
 *
 * @param v The view that was clicked. Must be a tagged with a {@link ShortcutInfo}.
 */
protected void onClickAppShortcut(final View v) {

    ...省略代码专用...

    // Open shortcut
    final ShortcutInfo shortcut = (ShortcutInfo) tag;

    ...省略代码专用...

    // Check for abandoned promise
    if ((v instanceof BubbleTextView)
            && shortcut.isPromise()
            && !shortcut.hasStatusFlag(ShortcutInfo.FLAG_INSTALL_SESSION_ACTIVE)) {
        showBrokenAppInstallDialog(
                shortcut.getTargetComponent().getPackageName(),
                new DialogInterface.OnClickListener() {
                    public void onClick(DialogInterface dialog, int id) {
                        startAppShortcutOrInfoActivity(v);
                    }
                });
        return;
    }

    // Start activities
    startAppShortcutOrInfoActivity(v);

    if (mLauncherCallbacks != null) {
        mLauncherCallbacks.onClickAppShortcut(v);
    }
}

根据注释可以看到调用了startAppShortcutOrInfoActivity方法，继续来看

源码:packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

@Thunk void startAppShortcutOrInfoActivity(View v) {

    ...省略代码专用...

    boolean success = startActivitySafely(v, intent, tag);
    mStats.recordLaunch(v, intent, shortcut);

    ...省略代码专用...

}

这里调用的是startActivitySafely方法。

源码:packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

public boolean startActivitySafely(View v, Intent intent, Object tag) {
    boolean success = false;

    ...省略代码专用...

    try {
        success = startActivity(v, intent, tag);
    } catch (ActivityNotFoundException e) {
        Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();
        Log.e(TAG, "Unable to launch. tag=" + tag + " intent=" + intent, e);
    }
    return success;
}

其内部调用的就是startActivity方法。

源码:packages/apps/Launcher3/src/com/android/launcher3/Launcher.java

private boolean startActivity(View v, Intent intent, Object tag) {
    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK); // ①
    try {
    
        ...省略代码专用...

        if (user == null || user.equals(UserHandleCompat.myUserHandle())) {
            StrictMode.VmPolicy oldPolicy = StrictMode.getVmPolicy();
            try {
                // Temporarily disable deathPenalty on all default checks. For eg, shortcuts
                // containing file Uris would cause a crash as penaltyDeathOnFileUriExposure
                // is enabled by default on NYC.
                StrictMode.setVmPolicy(new StrictMode.VmPolicy.Builder().detectAll()
                        .penaltyLog().build());
                // Could be launching some bookkeeping activity
                startActivity(intent, optsBundle); // ②
            } finally {
                StrictMode.setVmPolicy(oldPolicy);
            }
        } else {
            // TODO Component can be null when shortcuts are supported for secondary user
            launcherApps.startActivityForProfile(intent.getComponent(), user,
                    intent.getSourceBounds(), optsBundle);
        }
        return true;
    } catch (SecurityException e) {
        ...省略代码专用...
    }
    return false;
}

注释1处可以看出新开的Activity是在新的任务栈里面。注释2处调用Activity的startActivity方法

源码:frameworks/base/core/java/android/app/Activity.java

Override
public void startActivity(Intent intent, @Nullable Bundle options) {
    if (options != null) {
        startActivityForResult(intent, -1, options);
    } else {
        // Note we want to go through this call for compatibility with
        // applications that may have overridden the method.
        startActivityForResult(intent, -1);
    }
}

源码:frameworks/base/core/java/android/app/Activity.java

public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
        @Nullable Bundle options) {
    if (mParent == null) {
        Instrumentation.ActivityResult ar =
            mInstrumentation.execStartActivity(
                this, mMainThread.getApplicationThread(), mToken, this,
                intent, requestCode, options);
        ...省略代码专用...
    } else {
        ...省略代码专用...
    }
}

mParent是Activity类型的成员变量，表示当前Activity的父类。因为目前根Activity还没有创建出来，则mParent == null成立。接着调用Instrumentation的execStartActivity方法。execStartActivity方法的代码如下所示。

源码:frameworks/base/core/java/android/app/Instrumentation.java

public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    Uri referrer = target != null ? target.onProvideReferrer() : null;
    if (referrer != null) {
        intent.putExtra(Intent.EXTRA_REFERRER, referrer);
    }
    
    ...省略代码专用...
    
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess(who);
        int result = ActivityManagerNative.getDefault()
            .startActivity(whoThread, who.getBasePackageName(), intent,
                    intent.resolveTypeIfNeeded(who.getContentResolver()),
                    token, target != null ? target.mEmbeddedID : null,
                    requestCode, 0, null, options);
        checkStartActivityResult(result, intent);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

首先会调用ActivityManagerNative的getDefault来获取ActivityManageService（后续简称为AMS)的代理对象，接着调用它的startActivity方法。

源码:frameworks/base/core/java/android/app/ActivityManagerNative.java

/**
 * Retrieve the system's default/global activity manager.
 */
static public IActivityManager getDefault() {
    return gDefault.get();
}

private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
    protected IActivityManager create() {
        IBinder b = ServiceManager.getService("activity"); // ①
        if (false) {
            Log.v("ActivityManager", "default service binder = " + b);
        }
        IActivityManager am = asInterface(b); // ②
        if (false) {
            Log.v("ActivityManager", "default service = " + am);
        }
        return am;
    }
};

getDefault方法调用了gDefault的get方法，我们接着往下看，gDefault是一个单例Singleton。注释1处得到名为”activity”的Service代理对象，实质就是ActivityManagerService的代理对象。接着在注释2处将它封装成ActivityManagerProxy(以后简称为AMP)类型对象，并将它保存到gDefault中，此后调用ActivityManagerNative的getDefault方法就会直接获得AMS的代理AMP对象。
回到Instrumentation类的execStartActivity方法中，从上面得知就是调用AMP的startActivity，其中AMP是ActivityManagerNative的内部类，代码如下所示。

源码:frameworks/base/core/java/android/app/ActivityManagerNative.java$ActivityManagerProxy

public int startActivity(IApplicationThread caller, String callingPackage, Intent intent,
        String resolvedType, IBinder resultTo, String resultWho, int requestCode,
        int startFlags, ProfilerInfo profilerInfo, Bundle options) throws RemoteException {
    Parcel data = Parcel.obtain();
    Parcel reply = Parcel.obtain();
    data.writeInterfaceToken(IActivityManager.descriptor);
    data.writeStrongBinder(caller != null ? caller.asBinder() : null);
    data.writeString(callingPackage);
    intent.writeToParcel(data, 0);
    data.writeString(resolvedType);
    data.writeStrongBinder(resultTo);
    data.writeString(resultWho);
    data.writeInt(requestCode);
    data.writeInt(startFlags);
    if (profilerInfo != null) {
        data.writeInt(1);
        profilerInfo.writeToParcel(data, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
    } else {
        data.writeInt(0);
    }
    if (options != null) {
        data.writeInt(1);
        options.writeToParcel(data, 0);
    } else {
        data.writeInt(0);
    }
    mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0); // ①
    reply.readException();
    int result = reply.readInt();
    reply.recycle();
    data.recycle();
    return result;
}

首先会将传入的参数写入到Parcel类型的data中。在注释1处通过IBinder对象mRemote向AMS发送一个START_ACTIVITY_TRANSACTION类型的进程间通信请求。那么服务端AMS就会从Binder线程池中读取我们客户端发来的数据，最终会调用ActivityManagerNative的onTransact方法中执行，如下所示。

源码:frameworks/base/core/java/android/app/ActivityManagerNative.java

@Override
public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
        throws RemoteException {
    switch (code) {
    case START_ACTIVITY_TRANSACTION:
    {
        data.enforceInterface(IActivityManager.descriptor);
        IBinder b = data.readStrongBinder();
        IApplicationThread app = ApplicationThreadNative.asInterface(b);
        String callingPackage = data.readString();
        Intent intent = Intent.CREATOR.createFromParcel(data);
        String resolvedType = data.readString();
        IBinder resultTo = data.readStrongBinder();
        String resultWho = data.readString();
        int requestCode = data.readInt();
        int startFlags = data.readInt();
        ProfilerInfo profilerInfo = data.readInt() != 0
                ? ProfilerInfo.CREATOR.createFromParcel(data) : null;
        Bundle options = data.readInt() != 0
                ? Bundle.CREATOR.createFromParcel(data) : null;
        int result = startActivity(app, callingPackage, intent, resolvedType,
                resultTo, resultWho, requestCode, startFlags, profilerInfo, options);
        reply.writeNoException();
        reply.writeInt(result);
        return true;
    }
    
    ...省略代码专用...
    
    }
}

onTransact中会调用AMS的startActivity方法，代码如下所示。

源码:frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
 public final int startActivity(IApplicationThread caller, String callingPackage,
         Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
         int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
     return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
             resultWho, requestCode, startFlags, profilerInfo, bOptions,
             UserHandle.getCallingUserId());
 }

AMS的startActivity方法中直接返回了startActivityAsUser方法：

源码:frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
        Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
        int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
    enforceNotIsolatedCaller("startActivity");
    userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
            userId, false, ALLOW_FULL_ONLY, "startActivity", null);
    // TODO: Switch to user app stacks here.
    return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent,
            resolvedType, null, null, resultTo, resultWho, requestCode, startFlags,
            profilerInfo, null, null, bOptions, false, userId, null, null);
}

startActivityAsUser方法中又返回了mActivityStarter的startActivityMayWait方法，代码如下所示。

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

final int startActivityMayWait(IApplicationThread caller, int callingUid,
         String callingPackage, Intent intent, String resolvedType,
         IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
         IBinder resultTo, String resultWho, int requestCode, int startFlags,
         ProfilerInfo profilerInfo, IActivityManager.WaitResult outResult, Configuration config,
         Bundle bOptions, boolean ignoreTargetSecurity, int userId,
         IActivityContainer iContainer, TaskRecord inTask) {
         
     ...省略代码专用...
    
     int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType,
             aInfo, rInfo, voiceSession, voiceInteractor,
             resultTo, resultWho, requestCode, callingPid,
             callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
             options, ignoreTargetSecurity, componentSpecified, outRecord, container,
             inTask);
             
     ...省略代码专用...
     
     return res;
   }
}

内部又调用了startActivityLocked方法，代码如下所示。

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

final int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
       String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
       IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
       IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
       String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
       ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
       ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container,
       TaskRecord inTask) {
       
    ...省略代码专用...
    
    doPendingActivityLaunchesLocked(false);
    
    ...省略代码专用...
    
    return err;
}

startActivityLocked函数代码非常多，我们只需要关注doPendingActivityLaunchesLocked方法，代码如下所示。

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

final void doPendingActivityLaunchesLocked(boolean doResume) {
   while (!mPendingActivityLaunches.isEmpty()) {
       final PendingActivityLaunch pal = mPendingActivityLaunches.remove(0);
       final boolean resume = doResume && mPendingActivityLaunches.isEmpty();
       try {
           final int result = startActivityUnchecked(
                   pal.r, pal.sourceRecord, null, null, pal.startFlags, resume, null, null);
           postStartActivityUncheckedProcessing(
                   pal.r, result, mSupervisor.mFocusedStack.mStackId, mSourceRecord,
                   mTargetStack);
       } catch (Exception e) {
           Slog.e(TAG, "Exception during pending activity launch pal=" + pal, e);
           pal.sendErrorResult(e.getMessage());
       }
   }
}

接着又调用startActivityUnchecked方法：

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
       IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
       int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask) {
       
   ...省略代码专用...  
 
   mSupervisor.resumeFocusedStackTopActivityLocked(); 
     
   ...省略代码专用... 
 
   return START_SUCCESS;
}

startActivityUnchecked方法中调用了ActivityStackSupervisor类型的mSupervisor的resumeFocusedStackTopActivityLocked方法，如下所示。
源码:frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

boolean resumeFocusedStackTopActivityLocked(
           ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
   if (targetStack != null && isFocusedStack(targetStack)) {
       return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
   }
   final ActivityRecord r = mFocusedStack.topRunningActivityLocked();
   if (r == null || r.state != RESUMED) {
       mFocusedStack.resumeTopActivityUncheckedLocked(null, null); // ①
   }
   return false;
}

在注释1处又调用了ActivityStack类型mFocusedStack的resumeTopActivityUncheckedLocked方法：

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStack.java

boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {

    ...省略代码专用...

    try {
    
        ...省略代码专用...
       
        result = resumeTopActivityInnerLocked(prev, options);
    } finally {
        mStackSupervisor.inResumeTopActivity = false;
    }
    return result;
}

紧接着查看ActivityStack的resumeTopActivityInnerLocked方法：

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStack.java

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {

	...省略代码专用...

    // Find the first activity that is not finishing.
    final ActivityRecord next = topRunningActivityLocked();
        
    ...省略代码专用...
    
    if (next.app != null && next.app.thread != null) {
       ...省略代码专用...
    } else {
   
       ...省略代码专用...
    	
       mStackSupervisor.startSpecificActivityLocked(next, true, true);
       
    }
       
    ...省略代码专用...
    
    if (DEBUG_STACK) mStackSupervisor.validateTopActivitiesLocked();
    return true;
}

resumeTopActivityInnerLocked方法代码非常多，我们只需要关注调用了ActivityStackSupervisor类型mStackSupervisor的startSpecificActivityLocked方法，代码如下所示。
源码:frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

void startSpecificActivityLocked(ActivityRecord r,
          boolean andResume, boolean checkConfig) {
  ProcessRecord app = mService.getProcessRecordLocked(r.processName,
          r.info.applicationInfo.uid, true);
  r.task.stack.setLaunchTime(r);
  if (app != null && app.thread != null) { // 1
      try {
          if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                  || !"android".equals(r.info.packageName)) {
              app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode,
                      mService.mProcessStats);
          }
          realStartActivityLocked(r, app, andResume, checkConfig);//2
          return;
      } catch (RemoteException e) {
          Slog.w(TAG, "Exception when starting activity "
                  + r.intent.getComponent().flattenToShortString(), e);
      }
  }
  mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
          "activity", r.intent.getComponent(), false, false, true);
}

在注释1处如果当前Activity所在的Application运行的话，会执行注释2处的代码。realStartActivityLocked方法的代码如下所示。

源码:frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
          boolean andResume, boolean checkConfig) throws RemoteException {
          
   ...省略代码专用...
   
      app.thread.scheduleLaunchActivity(new Intent(r.intent), r.appToken,
              System.identityHashCode(r), r.info, new Configuration(mService.mConfiguration),
              new Configuration(task.mOverrideConfig), r.compat, r.launchedFromPackage,
              task.voiceInteractor, app.repProcState, r.icicle, r.persistentState, results,
              newIntents, !andResume, mService.isNextTransitionForward(), profilerInfo);
              
  ...省略代码专用...      
  
  return true;
}

这里的app.thread指的是IApplicationThread，它的实现是ActivityThread的内部类ApplicationThread，其中ApplicationThread继承了ApplicationThreadNative，而ApplicationThreadNative继承了Binder并实现了IApplicationThread接口。在应用程序进程启动时会创建ActivityThread实例。ActivityThread作为应用程序进程的核心类，它是如何启动应用程序Activity的呢？接着往下看。接着查看ApplicationThread的scheduleLaunchActivity方法，代码如下所示。

源码:frameworks/base/core/java/android/app/ActivityThread.java

@Override
public final void scheduleLaunchActivity(Intent intent, IBinder token, int ident,
        ActivityInfo info, Configuration curConfig, Configuration overrideConfig,
        CompatibilityInfo compatInfo, String referrer, IVoiceInteractor voiceInteractor,
        int procState, Bundle state, PersistableBundle persistentState,
        List<ResultInfo> pendingResults, List<ReferrerIntent> pendingNewIntents,
        boolean notResumed, boolean isForward, ProfilerInfo profilerInfo) {
 updateProcessState(procState, false);
    ActivityClientRecord r = new ActivityClientRecord();
    r.token = token;
    r.ident = ident;
    r.intent = intent;
    r.referrer = referrer;
    r.voiceInteractor = voiceInteractor;
    r.activityInfo = info;
    r.compatInfo = compatInfo;
    r.state = state;
    r.persistentState = persistentState;
    r.pendingResults = pendingResults;
    r.pendingIntents = pendingNewIntents;
    r.startsNotResumed = notResumed;
    r.isForward = isForward;
    r.profilerInfo = profilerInfo;
    r.overrideConfig = overrideConfig;
    updatePendingConfiguration(curConfig);
    sendMessage(H.LAUNCH_ACTIVITY, r);
}

scheduleLaunchActivity方法会将启动Activity的参数封装成ActivityClientRecord，再将ActivityClientRecord通过sendMessage方法向应用进程的主线程发送类型为LAUNCH_ACTIVITY的消息，sendMessage方法的代码如下所示。

源码:frameworks/base/core/java/android/app/ActivityThread.java

private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {

...省略代码专用...

  mH.sendMessage(msg);
}

这里mH指的是H，它是ActivityThread的内部类并继承Handler，H的代码如下所示。

源码:frameworks/base/core/java/android/app/ActivityThread.java

private class H extends Handler {
      public static final int LAUNCH_ACTIVITY         = 100;
      public static final int PAUSE_ACTIVITY          = 101;
      
...省略代码专用...

public void handleMessage(Message msg) {
          if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
          switch (msg.what) {
              case LAUNCH_ACTIVITY: {
                  Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
                  final ActivityClientRecord r = (ActivityClientRecord) msg.obj;//1
                  r.packageInfo = getPackageInfoNoCheck(
                          r.activityInfo.applicationInfo, r.compatInfo);//2
                  handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");//3
                  Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
              } break;
              case RELAUNCH_ACTIVITY: {
                  Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityRestart");
                  ActivityClientRecord r = (ActivityClientRecord)msg.obj;
                  handleRelaunchActivity(r);
                  Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
              } break;
              
            ...省略代码专用...
            
}}}

查看H的handleMessage方法中对LAUNCH_ACTIVITY的处理，在注释1处将传过来的msg的成员变量obj转换为ActivityClientRecord。
在注释2处通过getPackageInfoNoCheck方法获得LoadedApk类型的对象并赋值给ActivityClientRecord的成员变量packageInfo。应用程序进程要启动Activity时需要将该Activity所属的APK加载进来，而LoadedApk就是用来描述已加载的APK文件。
在注释3处调用handleLaunchActivity方法，代码如下所示。

源码:frameworks/base/core/java/android/app/ActivityThread.java

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent, String reason) {

    ...省略代码专用...
    
  Activity a = performLaunchActivity(r, customIntent);//1
  if (a != null) {
      r.createdConfig = new Configuration(mConfiguration);
      reportSizeConfigurations(r);
      Bundle oldState = r.state;
      handleResumeActivity(r.token, false, r.isForward,
              !r.activity.mFinished && !r.startsNotResumed, r.lastProcessedSeq, reason); // ①
      if (!r.activity.mFinished && r.startsNotResumed) {      
          performPauseActivityIfNeeded(r, reason);
          if (r.isPreHoneycomb()) {
              r.state = oldState;
          }
      }
  } else {
      try {
          ActivityManagerNative.getDefault()
              .finishActivity(r.token, Activity.RESULT_CANCELED, null,
                      Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
      } catch (RemoteException ex) {
          throw ex.rethrowFromSystemServer();
      }
  }
}

注释1处的performLaunchActivity方法用来启动Activity ，注释2处的代码用来将Activity的状态置为Resume。如果该Activity为null则会通知ActivityManager停止启动Activity。来查看performLaunchActivity方法做了什么：

源码:frameworks/base/core/java/android/app/ActivityThread.java

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {

  ...省略代码专用...
  
    ActivityInfo aInfo = r.activityInfo; // ①
    if (r.packageInfo == null) {
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                 Context.CONTEXT_INCLUDE_CODE); // ②
    }
    ComponentName component = r.intent.getComponent(); // ③
    
    ...省略代码专用...
    
    Activity activity = null;
    try {
        java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
        activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent); // ④
                
        ...省略代码专用...
        
        }
    } catch (Exception e) {
    
        ...省略代码专用...
        
    }
    try {
        Application app = r.packageInfo.makeApplication(false, mInstrumentation); // ⑤
        
        ...省略代码专用...
        
        if (activity != null) {
               Context appContext = createBaseContextForActivity(r, activity); // ⑥
               
        ...省略代码专用...
        
        }
               // ⑦
               activity.attach(appContext, this, getInstrumentation(), r.token,
                     r.ident, app, r.intent, r.activityInfo, title, r.parent,
                    r.embeddedID, r.lastNonConfigurationInstances, config,
                    r.referrer, r.voiceInteractor, window);
                    
          ...省略代码专用...
          
              if (r.isPersistable()) {
                  mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);//8
              } else {
                  mInstrumentation.callActivityOnCreate(activity, r.state);
              }
              
              ...省略代码专用...
              
    }
    return activity;
}

注释1处用来获取ActivityInfo，在注释2处获取APK文件的描述类LoadedApk。注释3处获取要启动的Activity的ComponentName类，ComponentName类中保存了该Activity的包名和类名。注释4处根据ComponentName中存储的Activity类名，用类加载器来创建该Activity的实例。注释5处用来创建Application，makeApplication方法内部会调用Application的onCreate方法。注释6处用来创建要启动Activity的上下文环境。注释7处调用Activity的attach方法初始化Activity，attach方法中会创建Window对象（PhoneWindow）并与Activity自身进行关联。注释8处会调用Instrumentation的callActivityOnCreate方法来启动Activity：

源码:frameworks/base/core/java/android/app/Instrumentation.java

public void callActivityOnCreate(Activity activity, Bundle icicle,
         PersistableBundle persistentState) {
    prePerformCreate(activity);
    activity.performCreate(icicle, persistentState); // ①
    postPerformCreate(activity);
}

注释1处调用了Activity的performCreate方法，代码如下所示。

源码:frameworks/base/core/java/android/app/Activity.java

final void performCreate(Bundle icicle) {
    restoreHasCurrentPermissionRequest(icicle);
    onCreate(icicle);
    mActivityTransitionState.readState(icicle);
    performCreateCommon();
}

performCreate方法中会调用Activity的onCreate方法，这样Activity就启动了，即应用程序就启动了。