interface IActivityTaskManager {
    ...
    int startActivity(in IApplicationThread caller, in String callingPackage,
            in String callingFeatureId, in Intent intent, in String resolvedType,
            in IBinder resultTo, in String resultWho, int requestCode,
            int flags, in ProfilerInfo profilerInfo, in Bundle options);
    ...
}

system_server进程执行流程：

    --> ActivityTaskManagerService#startActivityAsUser(IApplicationThread caller, String callingPackage,
            String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
            String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
            Bundle bOptions, int userId)
    --> ActivityStarter#execute()
    --> ActivityStarter#executeRequest(Request request)
    --> ActivityStarter#startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            TaskFragment inTaskFragment, boolean restrictedBgActivity,
            NeededUriGrants intentGrants)
    --> ActivityStarter#startActivityInner()
        --> Task#startActivityLocked()
        --> RootWindowContainer#resumeFocusedTasksTopActivities(Task targetRootTask, ActivityRecord target, ActivityOptions targetOptions,
            boolean deferPause)
            --> Task#resumeTopActivityUncheckedLocked()
            --> Task#resumeTopActivityInnerLocked()
            --> TaskFragment#resumeTopActivity()
            --> ClientLifecycleManager#scheduleTransaction(ClientTransaction transaction)
            --> ClientTransaction#schedule()
            --> IApplicationThread.scheduleTransaction(ClientTransaction transaction);

ActivityStarter#startActivityInner()

核心方法：

• mTargetRootTask.startActivityLocked(mStartActivity, topRootTask, newTask, isTaskSwitch,
  mOptions, sourceRecord);

• mRootWindowContainer.resumeFocusedTasksTopActivities()
  该方法会调用TaskFragment#resumeTopActivity(ActivityRecord prev, ActivityOptions options, boolean deferPause)方法，

  --> ActivityTaskSupervisor#startSpecificActivity(startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig)
  --> ActivityTaskSupervisor#realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig
  --> ClientLifecycleManager#scheduleTransaction(ClientTransaction transaction)
  -->IApplicationThread.scheduleTransaction(ClientTransaction transaction)

ActivityRecord的创建

在ActivityStarter#executeRequest(Request request)方法中。

ClientTransaction的进程间传递：

public class ClientTransaction implements Parcelable, ObjectPoolItem {
        /** A list of individual callbacks to a client. */
    @UnsupportedAppUsage
    private List<ClientTransactionItem> mActivityCallbacks;

    /**
     * Final lifecycle state in which the client activity should be after the transaction is
     * executed.
     */
    private ActivityLifecycleItem mLifecycleStateRequest;

    /** Target client. */
    private IApplicationThread mClient;

    /** Target client activity. Might be null if the entire transaction is targeting an app. */
    private IBinder mActivityToken;

    /** Obtain an instance initialized with provided params. */
    public static ClientTransaction obtain(IApplicationThread client, IBinder activityToken) {
        ClientTransaction instance = ObjectPool.obtain(ClientTransaction.class);
        if (instance == null) {
            instance = new ClientTransaction();
        }
        instance.mClient = client;
        instance.mActivityToken = activityToken;

        return instance;
    }
}

App进程执行流程：

    --> ActivityThread$ApplicationThread#scheduleTransaction(ClientTransaction transaction)
    --> ClientTransactionHandler#scheduleTransaction(ClientTransaction transaction)
    --> mH.handleMessage(EXECUTE_TRANSACTION)
    --> TransactionExecutor#execute(ClientTransaction transaction)
    --> TransactionExecutor#executeCallbacks(ClientTransaction transaction)
    --> LaunchActivityItem#execute(ClientTransactionHandler client, IBinder token, PendingTransactionActions pendingActions)
    --> ClientTransactionHandler#handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, Intent customIntent)
    --> ActivityThread#handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, Intent customIntent)
    --> ActivityThread#performLaunchActivity(ActivityClientRecord r, Intent customIntent)
    --> Instrumentation#callActivityOnCreate(Activity activity, Bundle icicle)   
    --> Activity#performCreate(Bundle icicle)
    --> Activity#onCreate(Bundle savedInstanceState)

oneway interface IApplicationThread {
   ...
   void bindApplication(in String packageName, in ApplicationInfo info,
           in String sdkSandboxClientAppVolumeUuid, in String sdkSandboxClientAppPackage,
           in ProviderInfoList providerList, in ComponentName testName,
           in ProfilerInfo profilerInfo, in Bundle testArguments,
           IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,
           int debugMode, boolean enableBinderTracking, boolean trackAllocation,
           boolean restrictedBackupMode, boolean persistent, in Configuration config,
           in CompatibilityInfo compatInfo, in Map services,
           in Bundle coreSettings, in String buildSerial, in AutofillOptions autofillOptions,
           in ContentCaptureOptions contentCaptureOptions, in long[] disabledCompatChanges,
           in SharedMemory serializedSystemFontMap,
           long startRequestedElapsedTime, long startRequestedUptime);
   ...
}

Activity实例的创建

  --> ActivityThread#performLaunchActivity(ActivityClientRecord r, Intent customIntent)
  --> Instrumentation#newActivity(ClassLoader cl, String className,
            Intent intent)
    --> AppComponentFactory#instantiateActivity(ClassLoader cl, String className,
            Intent intent)

Activity对象
Activity对象在创建好以后，通过Activity#attach()方法进行赋值，Activity对象的mToken来自ActivityClientRecord中的token，ActivityClientRecord中的token来自ClientTransaction中的mActivityToken(通过getActivityToken()获取)。ClientTransaction通过 静态方法obtain(IApplicationThread client, IBinder activityToken)，其中activityToken来自ActivityRecord中的token成员。

public class Activity extends ContextThemeWrapper
        implements LayoutInflater.Factory2,
        Window.Callback, KeyEvent.Callback,
        OnCreateContextMenuListener, ComponentCallbacks2,
        Window.OnWindowDismissedCallback,
        ContentCaptureManager.ContentCaptureClient {

    private IBinder mToken;


    
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
    final void attach(Context context, ActivityThread aThread,
            Instrumentation instr, IBinder token, int ident,
            Application application, Intent intent, ActivityInfo info,
            CharSequence title, Activity parent, String id,
            NonConfigurationInstances lastNonConfigurationInstances,
            Configuration config, String referrer, IVoiceInteractor voiceInteractor,
            Window window, ActivityConfigCallback activityConfigCallback, IBinder assistToken,
            IBinder shareableActivityToken) {
        attachBaseContext(context);

        mFragments.attachHost(null /*parent*/);

        mWindow = new PhoneWindow(this, window, activityConfigCallback);
        mWindow.setWindowControllerCallback(mWindowControllerCallback);
        mWindow.setCallback(this);
        mWindow.setOnWindowDismissedCallback(this);
        mWindow.getLayoutInflater().setPrivateFactory(this);
        //...
        mUiThread = Thread.currentThread();

        mMainThread = aThread;
        mInstrumentation = instr;
        mToken = token;
        mAssistToken = assistToken;
        mShareableActivityToken = shareableActivityToken;
        mIdent = ident;
        mApplication = application;
        mIntent = intent;
        mReferrer = referrer;
        mComponent = intent.getComponent();
        mActivityInfo = info;
        mTitle = title;
        mParent = parent;
        mEmbeddedID = id;
        mLastNonConfigurationInstances = lastNonConfigurationInstances;
        //...

        mWindow.setWindowManager(
                (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
                mToken, mComponent.flattenToString(),
                (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
        if (mParent != null) {
            mWindow.setContainer(mParent.getWindow());
        }
        mWindowManager = mWindow.getWindowManager();
        mCurrentConfig = config;

        mWindow.setColorMode(info.colorMode);
        mWindow.setPreferMinimalPostProcessing(
                (info.flags & ActivityInfo.FLAG_PREFER_MINIMAL_POST_PROCESSING) != 0);

        getAutofillClientController().onActivityAttached(application);
        setContentCaptureOptions(application.getContentCaptureOptions());
    }
}

BIND_APPLICATION