前沿
我们在oc层面调用对象方法实质是向某对象发送消息也就是objc_msgSend，objc_msgSend需要找到对应方法的实现也就是函数指针IMP,查找IMP首先在缓存中查找也就是快速查找,然后慢速查找也就是在类的方法类表中查找,如果这两种方法都找不到IMP，则在源码中有lookUpImpOrForward，可以看到会走resolveMethod_locked函数也就是动态方法决议
动态方法决议
在NSObject头文件中有两个方法去实现动态方法决议
//类方法动态决议
+ (BOOL)resolveClassMethod:(SEL)sel ;
//对象方法动态决议
+ (BOOL)resolveInstanceMethod:(SEL)sel;
我们看一下在OC底层是怎么调用动态决议方法的
对象方法动态决议resolveInstanceMethod
static void resolveInstanceMethod(id inst, SEL sel, Class cls)
{
runtimeLock.assertUnlocked();
ASSERT(cls->isRealized());
SEL resolve_sel = @selector(resolveInstanceMethod:);
// lookup resolveInstanceMethod
if (!lookUpImpOrNil(cls, resolve_sel, cls->ISA())) {
// Resolver not implemented.
return;
}
BOOL (*msg)(Class, SEL, SEL) = (typeof(msg))objc_msgSend;
bool resolved = msg(cls, resolve_sel, sel);
// Cache the result (good or bad) so the resolver doesn't fire next time.
// +resolveInstanceMethod adds to self a.k.a. cls
IMP imp = lookUpImpOrNil(inst, sel, cls);
}
1.先慢速查询resolveInstanceMethod的IMP,如果查到进行下一步，如果查不到能返回
2.调用resolveInstanceMethod方法
- resolveInstanceMethod之后重新查询方法的IMP,并返回
类方法动态决议resolveClassMethod
我们需要注意一点，在调用resolveClassMethod代码
resolveClassMethod(inst, sel, cls);
if (!lookUpImpOrNil(inst, sel, cls)) { // 为什么要有这行代码
resolveInstanceMethod(inst, sel, cls);
}
通过继承树我们知道类方法的最后继承自NSObject,会最终调用NSObject的实例方法(对象方法)
动态方法决议使用
我们可以在resolveInstanceMethod或resolveClassMethod方法中添加对应方法的实现，在慢速查询方法中，调用resolveInstanceMethod方法之后查询sel的IMP,如果我们在resolveInstanceMethod方法中添加方法，所以在查询IMP时就能找到，程序就能正常运行。
动态方法决议项目中的运行
我们可以在NSObject 的resolveInstanceMethod收集信息，如果类方法和对象方法都过继承树都要走到NSObject的resolveInstanceMethod，我们可以添加NSObject的Category在来实现resolveInstanceMethod。我们可以在resolveInstanceMethod中收集崩溃信息，我们也可以添加一个静态IMP,来防止程序崩溃。
如果动态方法决议不能解决方法未找到的情况就要走消息转发了
示例如下
LGPerson *person = [LGPerson alloc];
[person sayNB];
//sayNB只声明不实现打印日志如下
-[LGPerson sayNB]: unrecognized selector sent to instance 0x1018560a0
//实现resolveInstanceMethod
void sayNB(){
NSLog(@"12345");
}
+ (BOOL)resolveInstanceMethod:(SEL)sel {
if (sel == @selector(sayNB)) {
return class_addMethod([self class], sel, sayNB, nil);
}
return [super resolveInstanceMethod:sel];
}
//打印结果如下
//2020-09-25 17:15:38.507991+0800 KCObjc[61134:553937] 12345
消息转发
消息转发分快速转发和慢速转发
快速转发forwardingTargetForSelector:
如果动态方法决议中没有给对应方法加IMP,则会走快速转发流程
快速转发就是让这个消息让其他对象去接收
-(id)forwardingTargetForSelector:(SEL)aSelector {
if (aSelector == @selector(sayNB)) {
return [LGTeacher new];
}
return [super forwardingTargetForSelector:aSelector];
}
//LGTeacher实现sayNB方法
//打印日志
//我是老师，我当然牛逼
如果返回的对象时nil则[LGPerson sayNB]: unrecognized selector sent to instance
慢速转发
当在快速转返回nil时，则进入最后的一次挽救机会，重写methodSignatureForSelector，
-(NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
NSLog(@"%s",__func__);
NSMethodSignature *signature = [NSMethodSignature signatureWithObjCTypes:"v@:"];
return signature;
}
-(void)forwardInvocation:(NSInvocation *)anInvocation {
NSLog(@"%s",__func__);
}
打印结果
---+[LGPerson resolveInstanceMethod:]--sayNB
-[LGPerson methodSignatureForSelector:]
---+[LGPerson resolveInstanceMethod:]--_forwardStackInvocation:
-[LGPerson forwardInvocation:]
我们在forwardInvocation中只是简单的做一个NSLog，程序就不会崩溃。
我们也可以对invocation事务进行处理，修改invocation的target为[LGStudent alloc]，调用 [anInvocation invoke] 触发 即LGPerson类的say666实例方法的调用会调用LGStudent的say666方法。
动态方法决议和消息转发的流程图
从日志出发查看方法动态方法决议和消息转发的先后顺序
我们在lookUpImpOrForward发现一个函数log_and_fill_cache，我们知道fillCache是怎么回事，那log呢？我走进函数，看到打印日志的标记是objcMsgLogEnabled，而objcMsgLogEnabled是可以我们设置的通过instrumentObjcMessageSends
extern void instrumentObjcMessageSends(BOOL flag); //声明
LGPerson *person = [LGPerson alloc];
instrumentObjcMessageSends(YES);
[person sayHello];//只声明未实现
instrumentObjcMessageSends(NO);
在logMessageSend中我们看到日志是写到/tmp文件下，运行之后出现文件msgSends-38368
+ LGPerson NSObject resolveInstanceMethod:
+ LGPerson NSObject resolveInstanceMethod:
- LGPerson NSObject forwardingTargetForSelector:
- LGPerson NSObject forwardingTargetForSelector:
- LGPerson NSObject methodSignatureForSelector:
- LGPerson NSObject methodSignatureForSelector:
- LGPerson NSObject class
+ LGPerson NSObject resolveInstanceMethod:
+ LGPerson NSObject resolveInstanceMethod:
- LGPerson NSObject doesNotRecognizeSelector:
- LGPerson NSObject doesNotRecognizeSelector:
我们在源码中看到resolveInstanceMethod之后就没有forwardingTargetForSelector，methodSignatureForSelector方法的调用，bt打印堆栈信息，看到关于CoreFoundation，我们猜想动态方法决议之后CoreFoundation接下来处理，查看CoreFoundation之后没看到关于堆栈信息的forwarding_prep_0_ forwarding
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
frame #0: 0x00007fff2fdbb6e6 CoreFoundation`CFStringGetLength + 6
frame #1: 0x00007fff2fde5816 CoreFoundation`CFStringAppend + 229
frame #2: 0x00007fff2fe25e4b CoreFoundation`-[NSArray componentsJoinedByString:] + 309
frame #3: 0x00007fff2ff2b95f CoreFoundation`__handleUncaughtException + 761
frame #4: 0x00007fff68cfb5a3 libobjc.A.dylib`_objc_terminate() + 90
frame #5: 0x00007fff671ce887 libc++abi.dylib`std::__terminate(void (*)()) + 8
frame #6: 0x00007fff671d11a2 libc++abi.dylib`__cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) + 27
frame #7: 0x00007fff671d1169 libc++abi.dylib`__cxa_throw + 113
frame #8: 0x00007fff68cf96ed libobjc.A.dylib`objc_exception_throw + 350
frame #9: 0x00007fff2ff31be7 CoreFoundation`-[NSObject(NSObject) doesNotRecognizeSelector:] + 132
frame #10: 0x00007fff2fe173bb CoreFoundation`___forwarding___ + 1427
frame #11: 0x00007fff2fe16d98 CoreFoundation`__forwarding_prep_0___ + 120
* frame #12: 0x0000000100000e80 002-instrumentObjcMessageSends辅助分析`main(argc=1, argv=0x00007ffeefbff260) at main.m:19:9
frame #13: 0x00007fff69ea1cc9 libdyld.dylib`start + 1
反编译查看CoreFoundation image list查看工程中使用的库
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
前往该目录
使用反汇编工具 hopper Disassembler搜索forwarding_prep_0_ 或者forwarding查看消息转发流程