前言

此文仅分析Applcation的创建过程。

正文

如果我们要启动App，系统会创建ZygoteInit进程启动整个应用，ZygoteInit.main是整个应用启动的入口，在main方法中，我们需要fork一份系统服务：

 if (startSystemServer) {
        Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
        // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
        // child (system_server) process.
        if (r != null) {
               r.run();
               return;
        }
}

具体的fork过程调用了native方法：nativeForkSystemServer。当系统服务fork完成后：

/* For child process */
if (pid == 0) {
       if (hasSecondZygote(abiList)) {
              waitForSecondaryZygote(socketName);
       }

       zygoteServer.closeServerSocket();
       return handleSystemServerProcess(parsedArgs);
 }

因为ZygoteInit是init进程的子进程，所以pid等于0，所以接下来就会执行handleSystemServerProcess方法，该方法中会继续完成fork系统服务的工作，最终执行到：

// 创建系统服务的ClassLoader
createSystemServerClassLoader();
ClassLoader cl = sCachedSystemServerClassLoader;
if (cl != null) {
      hread.currentThread().setContextClassLoader(cl);
}
// 初始化ZygoteInit子进程
return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                    parsedArgs.mRemainingArgs, cl);

在这里我们看到了熟悉的ClassLoader，紧接着初始化ZygoteInit子进程：

public static final Runnable zygoteInit(int targetSdkVersion, String[] argv,
            ClassLoader classLoader) {
        ...
        // 这里最重要的是设置了异常捕获的处理
        RuntimeInit.commonInit();
        // 调用native方法初始化
        ZygoteInit.nativeZygoteInit();
        // 开始初始化Application
        return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
    }

其中 RuntimeInit.commonInit()主要是设置了异常的捕获处理：

LoggingHandler loggingHandler = new LoggingHandler();
RuntimeHooks.setUncaughtExceptionPreHandler(loggingHandler);
Thread.setDefaultUncaughtExceptionHandler(new KillApplicationHandler(loggingHandler));

现在终于进入到Application的初始化阶段了：

protected static Runnable applicationInit(int targetSdkVersion, String[] argv,
            ClassLoader classLoader) {
        ...
        return findStaticMain(args.startClass, args.startArgs, classLoader);
}

protected static Runnable findStaticMain(String className, String[] argv,
            ClassLoader classLoader) {
        // 一系列的反射检查，可以猜测这里是验证ActivityThread的main方法是否合法
        Class<?> cl;
        // 是否有ActivityThread这个类
        try {
            cl = Class.forName(className, true, classLoader);
        } catch (ClassNotFoundException ex) {
            throw new RuntimeException(
                    "Missing class when invoking static main " + className,
                    ex);
        }
        // ActivityThread是否有main方法
        Method m;
        try {
            m = cl.getMethod("main", new Class[] { String[].class });
        } catch (NoSuchMethodException ex) {
            throw new RuntimeException(
                    "Missing static main on " + className, ex);
        } catch (SecurityException ex) {
            throw new RuntimeException(
                    "Problem getting static main on " + className, ex);
        }
        // 验证main方法的修饰符为static且public
        int modifiers = m.getModifiers();
        if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
            throw new RuntimeException(
                    "Main method is not public and static on " + className);
        }
        // 把反射的main方法作为参数出入
        return new MethodAndArgsCaller(m, argv);
    }

  static class MethodAndArgsCaller implements Runnable {
        ...
        public void run() {
            // 执行method方法
            mMethod.invoke(null, new Object[] { mArgs });
        }
    }

虽然我们不清楚args.startClass到底是什么类，但是我们可以猜测这应该是验证ActivityThread的main入口是否合法，然后执行MethodAndArgsCaller线程调用ActivityThread.main，说明距离创建Application已经很近了。

public static void main(String[] args) {
        ...
        ActivityThread thread = new ActivityThread();
        // 注意参数为false
        thread.attach(false, startSeq);
        ...
}

 private void attach(boolean system, long startSeq) {
        ...
        if (!system) {
            android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                    UserHandle.myUserId());
            RuntimeInit.setApplicationObject(mAppThread.asBinder());
            final IActivityManager mgr = ActivityManager.getService();
            try {
                // 这里实际上调用的是ActivityManagerService.attachApplication
                mgr.attachApplication(mAppThread, startSeq);
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }
       }
            ...
    }

# ActivityManagerService.attachApplication
thread.bindApplication(processName, appInfo, providerList, null, profilerInfo,
                        null, null, null, testMode,
                        mBinderTransactionTrackingEnabled, enableTrackAllocation,
                        isRestrictedBackupMode || !normalMode, app.isPersistent(),
                        new Configuration(app.getWindowProcessController().getConfiguration()),
                        app.compat, getCommonServicesLocked(app.isolated),
                        mCoreSettingsObserver.getCoreSettingsLocked(),
                        buildSerial, autofillOptions, contentCaptureOptions,
                        app.mDisabledCompatChanges);

# ApplicationThread.bindApplication()
AppBindData data = new AppBindData();
data.processName = processName;
data.appInfo = appInfo;
data.providers = providerList.getList();
data.instrumentationName = instrumentationName;
data.instrumentationArgs = instrumentationArgs;
data.instrumentationWatcher = instrumentationWatcher;
data.instrumentationUiAutomationConnection = instrumentationUiConnection;
data.debugMode = debugMode;
data.enableBinderTracking = enableBinderTracking;
data.trackAllocation = trackAllocation;
data.restrictedBackupMode = isRestrictedBackupMode;
data.persistent = persistent;
data.config = config;
data.compatInfo = compatInfo;
data.initProfilerInfo = profilerInfo;
data.buildSerial = buildSerial;
data.autofillOptions = autofillOptions;
data.contentCaptureOptions = contentCaptureOptions;
data.disabledCompatChanges = disabledCompatChanges;
sendMessage(H.BIND_APPLICATION, data);

在main方法的这一阶段中，最终要执行到ApplicationThread.bindApplication方法，然后ActivityThread.H发送了一条绑定Application的指令，接下来就是如何接收这条指令。

由于ApplicationThread.bindApplication方法实在是太长，我们就筛选出主要代码查看一下流程：

#ApplicationThread.bindApplication()
Application app;
...
// 创建Application
app = data.info.makeApplication(data.restrictedBackupMode, null);
// Propagate autofill compat state
app.setAutofillOptions(data.autofillOptions);
// Propagate Content Capture options
app.setContentCaptureOptions(data.contentCaptureOptions);
mInitialApplication = app;
...       
// 就是调用Application.oncreate()
mInstrumentation.callApplicationOnCreate(app);
...

经过上面的代码，我们的Application已经创建成功了，并调用了onCreate方法。如果我们需要配置自己的Application，需要在Manifest.xml中配置Applcation的全限定名，那么系统是怎么创建的呢？

public @NonNull Application instantiateApplication(@NonNull ClassLoader cl,
            @NonNull String className)
            throws InstantiationException, IllegalAccessException, ClassNotFoundException {
        return (Application) cl.loadClass(className).newInstance();
}

果然还是反射，到这里整个Application的创建过程就结束了。