Android中启动一个Activity非常简单，可以在Activity、Fragment、Service和Application中通过startActivity去打开Activity。其中Activity的startActivity方法是自己实现的，Fragment.startActivity()则是会调用Activity.startActivity()，Service和Application则是通过ContextImpl实现。
先看下他们的继承关系：

Context.png

public void startActivityForResult(Intent intent, int requestCode, Bundle options) {
    ...
    options = transferSpringboardActivityOptions(options);
    Instrumentation.ActivityResult ar = mInstrumentation.execStartActivity(
            this, mMainThread.getApplicationThread(), mToken, this, intent, requestCode, options);
    if (ar != null) {
        mMainThread.sendActivityResult(mToken, mEmbeddedID, requestCode, ar.getResultCode(),ar.getResultData());
    }
    ...
}

ContextImpl.startActivity:

public void startActivity(Intent intent, Bundle options) {
    ...
    mMainThread.getInstrumentation().execStartActivity(getOuterContext(), mMainThread.getApplicationThread(), null,
        (Activity) null, intent, -1, options);
    ...
}

可以看到，最终都是通过Instrumentation.execStartActivity()方法：

public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target, 
        Intent intent, int requestCode, Bundle options) {
    ...
    int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
    ...
}

Instrumentation.execStartActivity()则通过IPC调用到ActivityManagerService.startActivity()，然后调用ActivityManagerService.startActivityAsUser()：

public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId,
            boolean validateIncomingUser) {
    ...
    return mActivityStartController.obtainStarter(intent, "startActivityAsUser")
                .setCaller(caller)
                .setCallingPackage(callingPackage)
                .setResolvedType(resolvedType)
                .setResultTo(resultTo)
                .setResultWho(resultWho)
                .setRequestCode(requestCode)
                .setStartFlags(startFlags)
                .setProfilerInfo(profilerInfo)
                .setActivityOptions(bOptions)
                .setMayWait(userId)
                .execute();
}

mActivityStartController.obtainStarter返回一个ActivityStarter，并调用ActivityStarter.startActivityMayWait()方法

private int startActivityMayWait(IApplicationThread caller, int callingUid,
            String callingPackage, Intent intent, String resolvedType,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, WaitResult outResult,
            Configuration globalConfig, SafeActivityOptions options, boolean ignoreTargetSecurity,
            int userId, TaskRecord inTask, String reason,
            boolean allowPendingRemoteAnimationRegistryLookup) {
    ...
    int res = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo,
                    voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid,
                    callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options,
                    ignoreTargetSecurity, componentSpecified, outRecord, inTask, reason,
                    allowPendingRemoteAnimationRegistryLookup);
    ...
}

private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
            SafeActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
            ActivityRecord[] outActivity, TaskRecord inTask, String reason,
            boolean allowPendingRemoteAnimationRegistryLookup) {
    ...
    mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType,
                aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode,
                callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
                options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord,
                inTask, allowPendingRemoteAnimationRegistryLookup);
    ...
}

private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
            SafeActivityOptions options,
            boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity,
            TaskRecord inTask, boolean allowPendingRemoteAnimationRegistryLookup) {
    ...
    return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags,
                true, checkedOptions, inTask, outActivity);
}

private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord,
                IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask,
                ActivityRecord[] outActivity) {
    ...
    result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor,
                    startFlags, doResume, options, inTask, outActivity);
    ...
}

startActivityUnchecked()经过一系列步骤后，会调用到resumeTopActivityInnerLocked()中，然后再调用ActivityStackSuppervistor.startSpecificActivityLocked()：

void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
    ...
    realStartActivityLocked(r, app, andResume, checkConfig);
    ...
}

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app, boolean andResume, 
            boolean checkConfig) throws RemoteException {
    ...
    final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread, r.appToken);
    clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent), 
             System.identityHashCode(r),
             r.info,
             // TODO: Have this take the merged configuration instead of separate global
             // and override configs.
             mergedConfiguration.getGlobalConfiguration(),
             mergedConfiguration.getOverrideConfiguration(), r.compat,
             r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
             r.persistentState, results, newIntents, mService.isNextTransitionForward(),
             profilerInfo));

             // Set desired final state.
             final ActivityLifecycleItem lifecycleItem;
             if (andResume) {
                 lifecycleItem = ResumeActivityItem.obtain(mService.isNextTransitionForward());
             } else {
                 lifecycleItem = PauseActivityItem.obtain();
             }
             clientTransaction.setLifecycleStateRequest(lifecycleItem);

             // Schedule transaction.
             mService.getLifecycleManager().scheduleTransaction(clientTransaction);

    ...
}

clientTransaction是Activity切换的过场动画，当clientTransaction执行结束后，会执行LaunchActivityItem.execute()方法。
LaunchActivityItem.java:

@Override
public void execute(ClientTransactionHandler client, IBinder token, PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
                mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
                mPendingResults, mPendingNewIntents, mIsForward,
                mProfilerInfo, client);
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

在LaunchActivityItem.execute()中会新建一个ActivityClientRecord对象，并执行ClientTransactionHandler.handleLaunchActivity()方法，而这个ClientTransactionHandler是ActivityThread，所以最终会调用到ActivityThread.handleLaunchActivity()方法。
现在回到ActivityStackSuppervistor.realStartActivityLocked()中的mService.getLifecycleManager().scheduleTransaction(clientTransaction);这行代码会执行clientTransaction.schedule()最终执行到ApplicationThread.scheduleTransaction()
ApplicationThread.scheduleTransaction：

@Override
 public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
     ActivityThread.this.scheduleTransaction(transaction);
 }

scheduleTransaction方法的实现在ActivityThread的父类ClientTransactionHandler中：

void scheduleTransaction(ClientTransaction transaction) {
    transaction.preExecute(this);
    sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

sendMessage会发送what=EXECUTE_TRANSACTION的Message到ActivityThread的内部handler去

class H extends Handler {
    handleMessage(Message msg) {
        ...
        switch(msg.what) {
            case EXECUTE_TRANSACTION:
                   final ClientTransaction transaction = (ClientTransaction) msg.obj;
                    mTransactionExecutor.execute(transaction);
                    if (isSystem()) {
                        // Client transactions inside system process are recycled on the client side
                        // instead of ClientLifecycleManager to avoid being cleared before this
                        // message is handled.
                        transaction.recycle();
                    }
                    // TODO(lifecycler): Recycle locally scheduled transactions.
                    break;
        }
        ...
    }
}

mTransactionExecutor会遍历transaction的callbacks，并执行callback的execute()

public void execute(ClientTransaction transaction) {
    ...
    executeCallbacks(transaction);
    ...
}

public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    if (callbacks == null) {
        // No callbacks to execute, return early.
        return;
    }
    ...
    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        item.execute(mTransactionHandler, token, mPendingActions);
        ...
    }
}

而在前面的ActivityStackSuppervistor.realStartActivityLocked()中，会向clientTransaction中添加一个LaunchActivityItem，所以最终会执行到LaunchActivityItem.execute()，前面有提到，LaunchActivityItem.execute()会执行client.handleLaunchActivity()，而这个client就是mTransactionHandler，mTransactionHandler就是我们ActivityThread，所以最终会调用到ActivityThread.handleLaunchActivity()