Android Gems — AMS的Service生命周期管理

Service对于Android开发来说再熟悉不过了，不过大部分人对Service的了解也仅限于api，这篇文章，我们通过分析AMS的源码，从一个更高的高度来了解一下Service的整个生命周期。

Service的生命周期接口：

1. startService

2. bindService

3. stopService

4. unbindService

这几个接口在apk进程里调用，通过ActivityManagerNative这个Binder最后调用到ActivityManagerService里，而AMS管理Service的类是ActiveService，这个类接管了所有Service生命周期的函数，包括startServiceLocked、stopServiceLocked、bindServiceLocked、unbindServiceLocked等。

startServiceLocked：

该函数实现Service的启动，首先调用retrieveServiceLocked根据Intent查询ServiceLookupResult（主要字段ServiceRecord），查询是先在ServiceMap里找，没有就重新由PackageManager的resolveService来获得ResolveInfo，创建新的ServiceRecord。针对Service的case，startService分为下面三种case，1，caller app是前台应用或者Service所在的app的进程优先级较高（高于PROCESS_STATE_SERVICE）， 那么无限制的start。2，其他情况的Service作为background
service，会加入到mStartingBackground list里，如果starting  list的size没有达到上限，那么直接启动。3，此时starting list已到上限，那么此Service的start会推迟，Service会加到mDelayedStartList里。

ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
int callingPid, int callingUid, String callingPackage, int userId)
throws TransactionTooLargeException {
......
......
// 检查caller app是否是前台进程
final boolean callerFg;
if (caller != null) {
final ProcessRecord callerApp = mAm.getRecordForAppLocked(caller);
if (callerApp == null) {
throw new SecurityException(
"Unable to find app for caller " + caller
+ " (pid=" + Binder.getCallingPid()
+ ") when starting service " + service);
}
callerFg = callerApp.setSchedGroup != Process.THREAD_GROUP_BG_NONINTERACTIVE;
} else {
callerFg = true;
}

// 查找ServiceRecord
ServiceLookupResult res =
retrieveServiceLocked(service, resolvedType, callingPackage,
callingPid, callingUid, userId, true, callerFg);

......
......
ServiceRecord r = res.record;
......
......
r.lastActivity = SystemClock.uptimeMillis();
r.startRequested = true;
r.delayedStop = false;
r.pendingStarts.add(new ServiceRecord.StartItem(r, false, r.makeNextStartId(),
service, neededGrants));

final ServiceMap smap = getServiceMap(r.userId);
boolean addToStarting = false;
if (!callerFg && r.app == null && mAm.mStartedUsers.get(r.userId) != null) {
ProcessRecord proc = mAm.getProcessRecordLocked(r.processName, r.appInfo.uid, false);
if (proc == null || proc.curProcState > ActivityManager.PROCESS_STATE_RECEIVER) {
// 这个分支表示Service所在的进程不存在，或者进程优先级小于PROCESS_STATE_RECEIVER，说明这个Service是background service
......

// 如果Service在delayed start list，则直接返回
if (r.delayed) {
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "Continuing to delay: " + r);
return r.name;
}
// 如果后starting background list超上限，则加到mDelayedStartList，暂时不startService，直接返回
if (smap.mStartingBackground.size() >= mMaxStartingBackground) {
// Something else is starting, delay!
Slog.i(TAG_SERVICE, "Delaying start of: " + r);
smap.mDelayedStartList.add(r);
r.delayed = true;
return r.name;
}
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "Not delaying: " + r);
addToStarting = true;
} else if (proc.curProcState >= ActivityManager.PROCESS_STATE_SERVICE) {
// 这个分支表示Service所在的进程优先级小于PROCESS_STATE_SERVICE，但又比PROCESS_STATE_RECEIVER大，加到starting list里，并startService
addToStarting = true;
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
"Not delaying, but counting as bg: " + r);
} else if (DEBUG_DELAYED_STARTS) {
StringBuilder sb = new StringBuilder(128);
sb.append("Not potential delay (state=").append(proc.curProcState)
.append(' ').append(proc.adjType);
String reason = proc.makeAdjReason();
if (reason != null) {
sb.append(' ');
sb.append(reason);
}
sb.append("): ");
sb.append(r.toString());
Slog.v(TAG_SERVICE, sb.toString());
}
}
......
......
// 分支走到这里等于startService会成功，addToStarting表示是否加到StartingBackground List
return startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
}

Service的start是由函数startServiceInnerLocked完成，而startServiceInnerLocked则是调用bringUpServiceLocked完成Service的start，每次startService都会往ServiceRecord的pendingStarts里填加一项StartItem，即使是被放入Delayed List的Service启动。bringUpServiceLocked做的事就是拉起Service。

一，如果进程r.app和r.app.thread已经初始化（代表着Service之前已经Create过），那么bringUpServiceLocked只需要执行onStartCommand，这是通过调用sendServiceArgsLocked来实现，sendServiceArgsLocked就遍历之前pendingStarts的所有StartItem（每个startService都会对应一个StartItem），逐个调用app.thread.scheduleServiceArgs。app.thread是Service所在进程的IApplicationThread
Binder对象，用于AMS的SystemServer进程到Client App端的跨进程调用，IApplicationThread的实现是在ActivityThread的内部类ApplicationThread，AMS ->  ActivityThread的调用通过IApplicationThread，ActivityThread -> AMS的调用就是ActivityManagerNative，这样就打通了一条从AMS到ActivityThread的跨进程调用之路。scheduleServiceArgs在ActivityThread里的对应就是ActivityThread.handleServiceArgs，这就执行到了我们所熟悉的onStartCommand。至此可以解释两个我们对于Service的认知：1，每次startService，都会对应一次onStartCommand，就算Service已经onCreate成功。2，Service的回调函数都是在主线程，这个和ApplicationThread这个Binder
Client的执行线程一致。sendServiceArgsLocked之后，pendingStarts里的StartItem就被加入到了deliveredStarts里，等待后续stopService或者Service restart的时候用。

二，如果Service所在的进程已经创建（ProcessRecord不空），那么会调用realStartServiceLocked来启动Service，这时的Service是还没有调用过onCreate。realStartServiceLocked会调用app.thread.scheduleCreateService来完成Service的启动，scheduleCreateService同scheduleServiceArgs一样，会调用到ActivityThread里，最终会执行Service的onCreate。之后同样执行sendServiceArgsLocked回调到onStartCommand。

三，如果Service所在的进程还未创建，那么bringUpServiceLocked做的事就是调用AMS的startProcessLocked创建进程，并将Service放进mPendingServices，等待进程创建成功，调用attachApplicationLocked的时候，会遍历所有的mPendingServices，继续调用realStartServiceLocked来完成Service的启动。

最后再看看bringUpServiceLocked的代码来加深一下印象

private final String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
boolean whileRestarting) throws TransactionTooLargeException {

// Service已经启动过了，直接调用sendServiceArgsLocked来执行onStartCommand
if (r.app != null && r.app.thread != null) {
sendServiceArgsLocked(r, execInFg, false);
return null;
}
// Service正在restart，啥都不做，等restart定时器触发以后再start
if (!whileRestarting && r.restartDelay > 0) {
// If waiting for a restart, then do nothing.
return null;
}

if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Bringing up " + r + " " + r.intent);

// 从正在重启的Service列表里删除
if (mRestartingServices.remove(r)) {
r.resetRestartCounter();
clearRestartingIfNeededLocked(r);
}

// 已经start了，从mDelayedStartList里删除
if (r.delayed) {
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "REM FR DELAY LIST (bring up): " + r);
getServiceMap(r.userId).mDelayedStartList.remove(r);
r.delayed = false;
}

......
......

final boolean isolated = (r.serviceInfo.flags&ServiceInfo.FLAG_ISOLATED_PROCESS) != 0;
final String procName = r.processName;
ProcessRecord app;

if (!isolated) {
app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
if (DEBUG_MU) Slog.v(TAG_MU, "bringUpServiceLocked: appInfo.uid=" + r.appInfo.uid
+ " app=" + app);
// 如果进程已经创建，那么可以执行startService了，先执行Service的onCreate，再执行onStartCommand
if (app != null && app.thread != null) {
try {
app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
realStartServiceLocked(r, app, execInFg);
return null;
} catch (TransactionTooLargeException e) {
throw e;
} catch (RemoteException e) {
Slog.w(TAG, "Exception when starting service " + r.shortName, e);
}

// If a dead object exception was thrown -- fall through to
// restart the application.
}
} else {
// If this service runs in an isolated process, then each time
// we call startProcessLocked() we will get a new isolated
// process, starting another process if we are currently waiting
// for a previous process to come up.  To deal with this, we store
// in the service any current isolated process it is running in or
// waiting to have come up.
app = r.isolatedProc;
}

// 如果进程还没创建，调用startProcessLocked来创建进程，并加入到mPendingServices，等待attachApplicationLocked后再startService
if (app == null) {
if (app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
"service", r.name, false, isolated, false)) == null) {
String msg = "Unable to launch app "
+ r.appInfo.packageName + "/"
+ r.appInfo.uid + " for service "
+ r.intent.getIntent() + ": process is bad";
Slog.w(TAG, msg);
bringDownServiceLocked(r);
return msg;
}
if (isolated) {
r.isolatedProc = app;
}
}

if (!mPendingServices.contains(r)) {
mPendingServices.add(r);
}

if (r.delayedStop) {
// Oh and hey we've already been asked to stop!
r.delayedStop = false;
if (r.startRequested) {
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
"Applying delayed stop (in bring up): " + r);
stopServiceLocked(r);
}
}

return null;
}

bindServiceLocked ：

bindServiceLocked比startService要复杂很多，主要是其多了Service和App之间的绑定关系：

1，AppBindRecord

retrieveServiceLocked查找到ServiceRecord之后，生成Service和Client（callerApp）之间的绑定关系AppBindRecord，AppBindRecord的字段包括service，client，intent，确定了他们之间的绑定关系。

final class AppBindRecord {
final ServiceRecord service;    // The running service.
final IntentBindRecord intent;  // The intent we are bound to.
final ProcessRecord client;     // Who has started/bound the service.
}

2，ConnectionRecord

Service和Client之间一个绑定关系就会对应一个ConnectionRecord，ConnectionRecord字段里除了绑定关系等对象之外，还有一个比较重要的对象就是IServiceConnection，这是一个binder对象，用做Client端和Server端的桥接，IServiceConnection的定义在LoadedApk里，处理ServiceConnection的connected状态，并由ServiceDispatcher统一做Service连接分发，如果connected函数的第二个参数IBinder是空，那么就是调用回调函数onServiceDisconnected，不空则表示连接建立成功，调用onServiceConnected。在ServiceConnection创建成功时，ServiceDispatcher会注册这个Service的死亡通知，如果Service
crash，也会马上调用onServiceDisconnected。

private static class InnerConnection extends IServiceConnect.Stub {
final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;

InnerConnection(LoadedApk.ServiceDispatcher sd) {
this.mDispatcher = new WeakReference(sd);
}

public void connected(ComponentName name, IBinder service) throws RemoteException {
LoadedApk.ServiceDispatcher sd = (LoadedApk.ServiceDispatcher)this.mDispatcher.get();
if(sd != null) {
sd.connected(name, service);
}

}
}

static final class ServiceDispatcher {

public void connected(ComponentName name, IBinder service) {
if(this.mActivityThread != null) {
this.mActivityThread.post(new LoadedApk.ServiceDispatcher.RunConnection(name, service, 0));
} else {
this.doConnected(name, service);
}
}

public void death(ComponentName name, IBinder service) {
synchronized(this) {
this.mDied = true;
LoadedApk.ServiceDispatcher.ConnectionInfo old = (LoadedApk.ServiceDispatcher.ConnectionInfo)this.mActiveConnections.remove(name);
if(old == null || old.binder != service) {
return;
}

old.binder.unlinkToDeath(old.deathMonitor, 0);
}

if(this.mActivityThread != null) {
this.mActivityThread.post(new LoadedApk.ServiceDispatcher.RunConnection(name, service, 1));
} else {
this.doDeath(name, service);
}

}

public void doConnected(ComponentName name, IBinder service) {
LoadedApk.ServiceDispatcher.ConnectionInfo old;
synchronized(this) {
if(this.mForgotten) {
return;
}

old = (LoadedApk.ServiceDispatcher.ConnectionInfo)this.mActiveConnections.get(name);
if(old != null && old.binder == service) {
return;
}

if(service != null) {
this.mDied = false;
LoadedApk.ServiceDispatcher.ConnectionInfo info = new LoadedApk.ServiceDispatcher.ConnectionInfo();
info.binder = service;
info.deathMonitor = new LoadedApk.ServiceDispatcher.DeathMonitor(name, service);

try {
service.linkToDeath(info.deathMonitor, 0);
this.mActiveConnections.put(name, info);
} catch (RemoteException var8) {
this.mActiveConnections.remove(name);
return;
}
} else {
this.mActiveConnections.remove(name);
}

if(old != null) {
old.binder.unlinkToDeath(old.deathMonitor, 0);
}
}

if(old != null) {
this.mConnection.onServiceDisconnected(name);
}

if(service != null) {
this.mConnection.onServiceConnected(name, service);
}

}

public void doDeath(ComponentName name, IBinder service) {
this.mConnection.onServiceDisconnected(name);
}

private final class DeathMonitor implements DeathRecipient {
final ComponentName mName;
final IBinder mService;

DeathMonitor(ComponentName name, IBinder service) {
this.mName = name;
this.mService = service;
}

public void binderDied() {
ServiceDispatcher.this.death(this.mName, this.mService);
}
}

3，connections

AppBindRecord的connections字段则保存了这个client的所有ServiceConnection连接ConnectionRecord，ConnectionRecord和IServiceConnection对象是对应的。ServiceRecord也有个connections列表，但ServiceRecord的connections列表存储的是这个Service相关的所有ConnectionRecord，Service和Client之间是多对多的关系，所以其各自维护了一个connections。
ConnectionRecord和AppBindRecord初始化完之后，就进入Service的主题，如果bindService的flag加上了BIND_AUTO_CREATE，那么将马上调用bringUpServiceLocked来启动Service，否则不会主动startService，这种情况如果之前Service并没有启动过，那么bind操作就会失败。之后检查Service是否绑定过，没有绑定过或者需要重新绑定的时候，由requestServiceBindingLocked来实际bindService，最后通过app.thread.scheduleBindService完成Service的绑定。并通过c.conn.connected调用，通知Client的IServiceConnection.onServiceConnected。从而完成Service和Client之间的Bind。

stopServiceLocked：

private void stopServiceLocked(ServiceRecord service) {
// 如果Service还未start，那么置delayedStop为true，等startService结束以后调用stopServiceLocked
if (service.delayed) {
// If service isn't actually running, but is is being held in the
// delayed list, then we need to keep it started but note that it
// should be stopped once no longer delayed.
if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "Delaying stop of pending: " + service);
service.delayedStop = true;
return;
}
synchronized (service.stats.getBatteryStats()) {
service.stats.stopRunningLocked();
}
service.startRequested = false;
if (service.tracker != null) {
service.tracker.setStarted(false, mAm.mProcessStats.getMemFactorLocked(),
SystemClock.uptimeMillis());
}
service.callStart = false;
bringDownServiceIfNeededLocked(service, false, false);
}

stopServiceLocked是调用bringDownServiceLocked来停止Service。首先对这个Service的所有bind连接，都通知回调onServiceDisconnected，之后通过调用r.app.thread.scheduleStopService，通知Service进程stopService，Service的onDestroy会被调用。

private final void bringDownServiceLocked(ServiceRecord r) {
// 对这个Service的每个绑定连接都通知client端回调onServiceDisconnected
for (int conni=r.connections.size()-1; conni>=0; conni--) {
ArrayList<ConnectionRecord> c = r.connections.valueAt(conni);
for (int i=0; i<c.size(); i++) {
ConnectionRecord cr = c.get(i);
// There is still a connection to the service that is
// being brought down.  Mark it as dead.
cr.serviceDead = true;
try {
cr.conn.connected(r.name, null);
} catch (Exception e) {
Slog.w(TAG, "Failure disconnecting service " + r.name +
" to connection " + c.get(i).conn.asBinder() +
" (in " + c.get(i).binding.client.processName + ")", e);
}
}
}

// 通过scheduleUnbindService，通知Service进程回调onBind
if (r.app != null && r.app.thread != null) {
for (int i=r.bindings.size()-1; i>=0; i--) {
IntentBindRecord ibr = r.bindings.valueAt(i);
if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Bringing down binding " + ibr
+ ": hasBound=" + ibr.hasBound);
if (ibr.hasBound) {
try {
bumpServiceExecutingLocked(r, false, "bring down unbind");
mAm.updateOomAdjLocked(r.app);
ibr.hasBound = false;
r.app.thread.scheduleUnbindService(r,
ibr.intent.getIntent());
} catch (Exception e) {
Slog.w(TAG, "Exception when unbinding service "
+ r.shortName, e);
serviceProcessGoneLocked(r);
}
}
}
}

// 已经unbind了，mPendingServices的列表可以清空了
for (int i=mPendingServices.size()-1; i>=0; i--) {
if (mPendingServices.get(i) == r) {
mPendingServices.remove(i);
if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Removed pending: " + r);
}
}

r.cancelNotification();
r.isForeground = false;
r.foregroundId = 0;
r.foregroundNoti = null;

// Clear start entries.
r.clearDeliveredStartsLocked();
r.pendingStarts.clear();

if (r.app != null) {
// 调用r.app.thread.scheduleStopService，通知Service进程stopService，Service的onDestroy会被调用
r.app.services.remove(r);
if (r.app.thread != null) {
updateServiceForegroundLocked(r.app, false);
try {
bumpServiceExecutingLocked(r, false, "destroy");
mDestroyingServices.add(r);
r.destroying = true;
mAm.updateOomAdjLocked(r.app);
r.app.thread.scheduleStopService(r);
} catch (Exception e) {
Slog.w(TAG, "Exception when destroying service "
+ r.shortName, e);
serviceProcessGoneLocked(r);
}
} else {
if (DEBUG_SERVICE) Slog.v(
TAG_SERVICE, "Removed service that has no process: " + r);
}
} else {
if (DEBUG_SERVICE) Slog.v(
TAG_SERVICE, "Removed service that is not running: " + r);
}
......
......
}

unbindService：

unbindService就比较简单了，把参数IServiceConnection对应的ConnectionRecord列表，逐个调用removeConnectionLocked移除连接，而removeConnectionLocked其实就是之前bindService时初始化AppBindRecord相关对象的逆过程，把和这个需要unbind的IServiceConnection连接从各个数据结构里删掉。移除完之后，如果发现这个Service已经没有任何Client绑定在其上面，就会调用s.app.thread.scheduleUnbindService，通知Service的进程执行onUnbind。

boolean unbindServiceLocked(IServiceConnection connection) {
IBinder binder = connection.asBinder();
if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "unbindService: conn=" + binder);
ArrayList<ConnectionRecord> clist = mServiceConnections.get(binder);
if (clist == null) {
Slog.w(TAG, "Unbind failed: could not find connection for "
+ connection.asBinder());
return false;
}

final long origId = Binder.clearCallingIdentity();
try {
while (clist.size() > 0) {
ConnectionRecord r = clist.get(0);
// 移除ConnectionRecord
removeConnectionLocked(r, null, null);
if (clist.size() > 0 && clist.get(0) == r) {
// In case it didn't get removed above, do it now.
Slog.wtf(TAG, "Connection " + r + " not removed for binder " + binder);
clist.remove(0);
}

if (r.binding.service.app != null) {
// This could have made the service less important.
if ((r.flags&Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
r.binding.service.app.treatLikeActivity = true;
mAm.updateLruProcessLocked(r.binding.service.app,
r.binding.service.app.hasClientActivities
|| r.binding.service.app.treatLikeActivity, null);
}
// 重新更新各进程的oom_adj
mAm.updateOomAdjLocked(r.binding.service.app);
}
}
} finally {
Binder.restoreCallingIdentity(origId);
}

return true;
}

至此，我们介绍了AMS是怎么管理Service的整个生命周期，之前文章
Android的LowMemoryKiller杀进程策略 介绍LMK杀进程的时候，有个foreground的oom_adj级别对应的case就是executingServices的size大于0的情况，在Service的startService、stopService、bindService、unBindService的时候都会将Service加入到executingServices里，通过ServiceRecord.app.thread回调到Service的Client进程之后，都会调用ActivityManagerNative.getDefault().serviceDoneExecuting，执行到AMS进程里，再将这个Service从executingServices里删除。加到executingServices里之后，会有个超时时间（callerApp是前台的话是20秒，后台是200秒），超时则触发ANR。executingServices不空就表示，Service的生命周期还未走完，Service的Client进程还未收到回调，此时把其oom_adj下调到前台App的级别，以保证Service生命周期的完整性也是很合理的策略。

Service还有个特点是杀掉后是可以重启的，最后我们简单介绍一下这个重启策略。Service的死分为两种，一种是自己crash，一种是被LMK kill。Android进程刚创建的时候，ActivityManagerService在attachApplication方法里会注册该进程的死亡通知，所以不论那种死法，AMS都会通过死亡通知获得回调，从而根据一定的策略来重启进程。

private final boolean attachApplicationLocked(IApplicationThread thread,
int pid) {
......
......
try {
AppDeathRecipient adr = new AppDeathRecipient(
app, pid, thread);
thread.asBinder().linkToDeath(adr, 0);
app.deathRecipient = adr;
} catch (RemoteException e) {
app.resetPackageList(mProcessStats);
startProcessLocked(app, "link fail", processName);
return false;
}
......
......
}

AMS的死亡通知类定义如下：

private final class AppDeathRecipient implements IBinder.DeathRecipient {
final ProcessRecord mApp;
final int mPid;
final IApplicationThread mAppThread;

AppDeathRecipient(ProcessRecord app, int pid,
IApplicationThread thread) {
if (DEBUG_ALL) Slog.v(
TAG, "New death recipient " + this
+ " for thread " + thread.asBinder());
mApp = app;
mPid = pid;
mAppThread = thread;
}

@Override
public void binderDied() {
if (DEBUG_ALL) Slog.v(
TAG, "Death received in " + this
+ " for thread " + mAppThread.asBinder());
synchronized(ActivityManagerService.this) {
appDiedLocked(mApp, mPid, mAppThread, true);
}
}
}

一旦进程死掉，就会调用appDiedLocked来处理，如果是Home App挂了的话，进程就会马上重启。

final void appDiedLocked(ProcessRecord app, int pid, IApplicationThread thread,
boolean fromBinderDied) {
// First check if this ProcessRecord is actually active for the pid.
synchronized (mPidsSelfLocked) {
ProcessRecord curProc = mPidsSelfLocked.get(pid);
if (curProc != app) {
Slog.w(TAG, "Spurious death for " + app + ", curProc for " + pid + ": " + curProc);
return;
}
}

BatteryStatsImpl stats = mBatteryStatsService.getActiveStatistics();
synchronized (stats) {
stats.noteProcessDiedLocked(app.info.uid, pid);
}

if (!app.killed) {
// 如果不是死亡通知调用的，那么就执行Process.killProcessQuiet杀死进程
if (!fromBinderDied) {
Process.killProcessQuiet(pid);
}
killProcessGroup(app.info.uid, pid);
app.killed = true;
}

// Clean up already done if the process has been re-started.
if (app.pid == pid && app.thread != null &&
app.thread.asBinder() == thread.asBinder()) {
boolean doLowMem = app.instrumentationClass == null;
boolean doOomAdj = doLowMem;
boolean homeRestart = false;
if (!app.killedByAm) {
// 桌面App死了，需马上重启
if (mHomeProcessName != null && app.processName.equals(mHomeProcessName)) {
mHomeKilled = true;
homeRestart = true;
}
Slog.i(TAG, "Process " + app.processName + " (pid " + pid
+ ") has died");
mAllowLowerMemLevel = true;
} else {
// Note that we always want to do oom adj to update our state with the
// new number of procs.
mAllowLowerMemLevel = false;
doLowMem = false;
}
EventLog.writeEvent(EventLogTags.AM_PROC_DIED, app.userId, app.pid, app.processName);
if (DEBUG_CLEANUP) Slog.v(TAG_CLEANUP,
"Dying app: " + app + ", pid: " + pid + ", thread: " + thread.asBinder());
handleAppDiedLocked(app, false, true);

if (doOomAdj) {
updateOomAdjLocked();
}
if (doLowMem) {
doLowMemReportIfNeededLocked(app);
}
if (mHomeKilled && homeRestart) {
// 立即重启Home App
Intent intent = getHomeIntent();
ActivityInfo aInfo = mStackSupervisor.resolveActivity(intent, null, 0, null, 0);
startProcessLocked(aInfo.processName, aInfo.applicationInfo, true, 0,
"activity", null, false, false, true);
homeRestart = false;
}
} else if (app.pid != pid) {
// A new process has already been started.
Slog.i(TAG, "Process " + app.processName + " (pid " + pid
+ ") has died and restarted (pid " + app.pid + ").");
EventLog.writeEvent(EventLogTags.AM_PROC_DIED, app.userId, app.pid, app.processName);
} else if (DEBUG_PROCESSES) {
Slog.d(TAG_PROCESSES, "Received spurious death notification for thread "
+ thread.asBinder());
}
}

handleAppDiedLocked会调用mServices.killServicesLocked，在killServicesLocked里会根据具体情况来实施重启策略，

final void killServicesLocked(ProcessRecord app, boolean allowRestart) {
// 清除进程的所有Service connection
for (int i = app.connections.size() - 1; i >= 0; i--) {
ConnectionRecord r = app.connections.valueAt(i);
removeConnectionLocked(r, app, null);
}
......
......

// Now do remaining service cleanup.
for (int i=app.services.size()-1; i>=0; i--) {
ServiceRecord sr = app.services.valueAt(i);

// 除了persistent进程，其他的Service都清除，persitent是个高优先级的进程，不管oom_adj很小，LMK不会杀，
//  而且PackageManagerService在installApk的时候也不会杀掉，这样就会导致persistent的进程升级不了，必须要重启系统
if (!app.persistent) {
app.services.removeAt(i);
}

// Sanity check: if the service listed for the app is not one
// we actually are maintaining, just let it drop.
final ServiceRecord curRec = smap.mServicesByName.get(sr.name);
if (curRec != sr) {
if (curRec != null) {
Slog.wtf(TAG, "Service " + sr + " in process " + app
+ " not same as in map: " + curRec);
}
continue;
}
// Service crash超过两次之后，Service被stop，不会再restart
if (allowRestart && sr.crashCount >= 2 && (sr.serviceInfo.applicationInfo.flags
&ApplicationInfo.FLAG_PERSISTENT) == 0) {
Slog.w(TAG, "Service crashed " + sr.crashCount
+ " times, stopping: " + sr);
EventLog.writeEvent(EventLogTags.AM_SERVICE_CRASHED_TOO_MUCH,
sr.userId, sr.crashCount, sr.shortName, app.pid);
bringDownServiceLocked(sr);
} else if (!allowRestart || !mAm.isUserRunningLocked(sr.userId, false)) {
bringDownServiceLocked(sr);
} else {
// 准备重启Service，重启的时间在scheduleServiceRestartLocked里设置
boolean canceled = scheduleServiceRestartLocked(sr, true);

// 如果stopIfKilled设为true，后续没有再调用startService的情况下，也不会再重启Service，调用bringDownServiceLocked停止Service
if (sr.startRequested && (sr.stopIfKilled || canceled)) {
if (sr.pendingStarts.size() == 0) {
sr.startRequested = false;
if (sr.tracker != null) {
sr.tracker.setStarted(false, mAm.mProcessStats.getMemFactorLocked(),
SystemClock.uptimeMillis());
}
if (!sr.hasAutoCreateConnections()) {
// Whoops, no reason to restart!
bringDownServiceLocked(sr);
}
}
}
}
}

......
......

// Make sure we have no more records on the stopping list.
int i = mDestroyingServices.size();
while (i > 0) {
i--;
ServiceRecord sr = mDestroyingServices.get(i);
if (sr.app == app) {
sr.forceClearTracker();
mDestroyingServices.remove(i);
if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "killServices remove destroying " + sr);
}
}

app.executingServices.clear();
}

如果crash次数超过2次，那么进程死掉的时候，Service就不会进入restart状态。scheduleServiceRestartLocked是处理service restart的函数，确定每个要重启的service准备restart的时间点。可以看到persitent的进程的优先级非常高，除了没有crash超过2次的限制外，restartDelay的值也会被设为0，也就是说马上restart，所以一旦persistent进入循环重启状态的时候，就出现无限重启，根本听不下来。

Service的生命周期管理就介绍到这儿，代码主要分布在ActivityManagerService、ActiveService、ActivityThread、LoadedApk等类中，看完之后，对Service的原理的了解就更加深刻了。

作者简介：

田力，网易彩票Android端创始人，小米视频创始人，现任roobo技术经理、视频云技术总监

欢迎关注微信公众号 磨剑石，定期推送技术心得以及源码分析等文章，谢谢