public class ActivityStackSupervisor extends ConfigurationContainer implements DisplayListener,
        RecentTasks.Callbacks {
    /** The stack containing the launcher app. Assumed to always be attached to
     * Display.DEFAULT_DISPLAY. */
    ActivityStack mHomeStack;

    /** The stack currently receiving input or launching the next activity. */
    ActivityStack mFocusedStack;
}

源码地址 : frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

2、任务栈 ActivityStack

ActivityStack ( 任务栈 ) 中存在两个集合 :

ArrayList<TaskRecord> mTaskHistory : 之前运行的 ( 可能仍在运行 ) 的 Activity 的历史记录 , 每个 TaskRecord 都包含了

个 ActivityRecord 集合 ;

ArrayList<ActivityRecord> mLRUActivities : 当前正在运行的 Activity 列表 , 按照最近最少使用算法 LRU 机制进行排序 , 列表中第一个 Activity 是最近最少使用的 ;

ActivityRecord 就是 Activity 的信息 , 注意不是 Activity 的实例对象 , 是历史任务栈中的一个条目 , 可以代表一个 Activity ;

TaskRecord 中维护了

个 ArrayList<ActivityRecord> , 用于保存 ActivityRecord ;

class ActivityStack<T extends StackWindowController> extends ConfigurationContainer
        implements StackWindowListener {
    /**
     * The back history of all previous (and possibly still
     * running) activities.  It contains #TaskRecord objects.
     */
    private final ArrayList<TaskRecord> mTaskHistory = new ArrayList<>();

    /**
     * List of running activities, sorted by recent usage.
     * The first entry in the list is the least recently used.
     * It contains HistoryRecord objects.
     */
    final ArrayList<ActivityRecord> mLRUActivities = new ArrayList<>();
}

3、Activity 启动涉及到的组件

ActivityThread : 应用主线程 , 每个应用都是从该主线程的 main 函数开始的 ;

/frameworks/base/core/java/android/app/ActivityThread.java

Instrumentation : 每个 Activity 都持有该类对象 , 档调用 startActivity 启动其它 Activity 时 , 就会调用 Instrumentation 进行先关操作 ; ActivityThread 控制 Activity 也是通过该类进行 ; 一个应用中只有一个 Instrumentation 实例对象 ;

/frameworks/base/core/java/android/app/Instrumentation.java

二、Activity 进程相关源码

1、Instrumentation 源码分析

在上一篇博客【Android 插件化】Hook 插件化框架 ( Hook Activity 启动过程 | 静态代理 ) 一、分析 Activity 启动源码章节中分析到 , 在 Activity 中调用 startActivity , 最终调用的是 Instrumentation 的 execStartActivity 方法 ;

在 Instrumentation 中的 newActivity(Class<?> clazz, Context context, IBinder token, Application application, Intent intent, ActivityInfo info, CharSequence title, Activity parent, String id, Object lastNonConfigurationInstance) 方法 , 用于创建 Activity 实例 , 其中使用了 (Activity)clazz.newInstance() 创建 Activity 示例 ,

    public Activity newActivity(Class<?> clazz, Context context, 
            IBinder token, Application application, Intent intent, ActivityInfo info, 
            CharSequence title, Activity parent, String id,
            Object lastNonConfigurationInstance) throws InstantiationException, 
            IllegalAccessException {
        Activity activity = (Activity)clazz.newInstance();
        ActivityThread aThread = null;
        // Activity.attach expects a non-null Application Object.
        if (application == null) {
            application = new Application();
        }
        activity.attach(context, aThread, this, token, 0 /* ident */, application, intent,
                info, title, parent, id,
                (Activity.NonConfigurationInstances)lastNonConfigurationInstance,
                new Configuration(), null /* referrer */, null /* voiceInteractor */,
                null /* window */, null /* activityConfigCallback */);
        return activity;
    }

在另外一个重载的 Activity newActivity(ClassLoader cl, String className, Intent intent) 方法中 , 通过指定类加载器 ClassLoader , Activity 的全类名 , 也可以创建 Activity 实例对象 ;

Hook 劫持 Activity newActivity(ClassLoader cl, String className, Intent intent) 方法 , 传入插件包的类加载器 , 和插件包的类名 , 此时就可以初始化带上下文的 Activity ,

    public Activity newActivity(ClassLoader cl, String className,
            Intent intent)
            throws InstantiationException, IllegalAccessException,
            ClassNotFoundException {
        String pkg = intent != null && intent.getComponent() != null
                ? intent.getComponent().getPackageName() : null;
        return getFactory(pkg).instantiateActivity(cl, className, intent);
    }

public class Instrumentation {

    public Activity newActivity(Class<?> clazz, Context context, 
            IBinder token, Application application, Intent intent, ActivityInfo info, 
            CharSequence title, Activity parent, String id,
            Object lastNonConfigurationInstance) throws InstantiationException, 
            IllegalAccessException {
        Activity activity = (Activity)clazz.newInstance();
        ActivityThread aThread = null;
        // Activity.attach expects a non-null Application Object.
        if (application == null) {
            application = new Application();
        }
        activity.attach(context, aThread, this, token, 0 /* ident */, application, intent,
                info, title, parent, id,
                (Activity.NonConfigurationInstances)lastNonConfigurationInstance,
                new Configuration(), null /* referrer */, null /* voiceInteractor */,
                null /* window */, null /* activityConfigCallback */);
        return activity;
    }

    public Activity newActivity(ClassLoader cl, String className,
            Intent intent)
            throws InstantiationException, IllegalAccessException,
            ClassNotFoundException {
        String pkg = intent != null && intent.getComponent() != null
                ? intent.getComponent().getPackageName() : null;
        return getFactory(pkg).instantiateActivity(cl, className, intent);
    }

    public ActivityResult execStartActivity(
            Context who, IBinder contextThread, IBinder token, Activity target,
            Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        Uri referrer = target != null ? target.onProvideReferrer() : null;
        if (referrer != null) {
            intent.putExtra(Intent.EXTRA_REFERRER, referrer);
        }
        if (mActivityMonitors != null) {
            synchronized (mSync) {
                final int N = mActivityMonitors.size();
                for (int i=0; i<N; i++) {
                    final ActivityMonitor am = mActivityMonitors.get(i);
                    ActivityResult result = null;
                    if (am.ignoreMatchingSpecificIntents()) {
                        result = am.onStartActivity(intent);
                    }
                    if (result != null) {
                        am.mHits++;
                        return result;
                    } else if (am.match(who, null, intent)) {
                        am.mHits++;
                        if (am.isBlocking()) {
                            return requestCode >= 0 ? am.getResult() : null;
                        }
                        break;
                    }
                }
            }
        }
        try {
            intent.migrateExtraStreamToClipData();
            intent.prepareToLeaveProcess(who);
            int result = ActivityManager.getService()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target != null ? target.mEmbeddedID : null,
                        requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }
}