前言
- 发布此文章主要是对自己所学知识的总结
- 通过文章的方式可以让自己对所学知识加深印象
- 方便日后需要的时候查看,如果有不对的地方欢迎指出
- 文笔不行,多多见谅
更详细一点可以去看看霜神的神经病院Objective-C Runtime住院第二天——消息发送与转发
整个方法调用流程共分为3个阶段:
- 消息发送
- 动态方法解析
- 消息转发
objc_msgSend()
要说对象,我相信世界上没有比程序员的对象多的了,因为我们每天都会newN个对象,而且想让它干什么它就干什么,不用给它买车买房,偶尔有时候发个小脾气(bug),敲会键盘就收拾他们了,根本就不用哄,最主要的是我可以指挥它
怎么指挥它的呢?发送消息呗!
MyGirlFriend *girlFriend = [[MyGirlFriend alloc]init];
[girlFriend goCooking];
编译成c++代码
((void (*)(id, SEL))(void *)objc_msgSend)((id)girlFriend, sel_registerName("goCooking"));
调用了objc_msgSend(id self, SEL op, ...)函数,去源码中看看这货到底干了写啥,在objc-msg-arm64.s中查找ENTRY _objc_msgSend
ENTRY _objc_msgSend
UNWIND _objc_msgSend, NoFrame
MESSENGER_START
cmp x0, #0 // nil check and tagged pointer check
b.le LNilOrTagged // (MSB tagged pointer looks negative)
ldr x13, [x0] // x13 = isa
and x16, x13, #ISA_MASK // x16 = class
LGetIsaDone:
CacheLookup NORMAL // calls imp or objc_msgSend_uncached
LNilOrTagged:
b.eq LReturnZero // nil check
// tagged
mov x10, #0xf000000000000000
cmp x0, x10
b.hs LExtTag
adrp x10, _objc_debug_taggedpointer_classes@PAGE
add x10, x10, _objc_debug_taggedpointer_classes@PAGEOFF
ubfx x11, x0, #60, #4
ldr x16, [x10, x11, LSL #3]
b LGetIsaDone
LExtTag:
// ext tagged
adrp x10, _objc_debug_taggedpointer_ext_classes@PAGE
add x10, x10, _objc_debug_taggedpointer_ext_classes@PAGEOFF
ubfx x11, x0, #52, #8
ldr x16, [x10, x11, LSL #3]
b LGetIsaDone
LReturnZero:
// x0 is already zero
mov x1, #0
movi d0, #0
movi d1, #0
movi d2, #0
movi d3, #0
MESSENGER_END_NIL
ret
END_ENTRY _objc_msgSend
cmp x0,检查消息接收者是否为空
b.eq LReturnZero: 如果为空就跳转到LReturnZero
LReturnZero: ret 返回
如果消息接收者不为nil
CacheLookup:在缓存中查找SEL
.macro CacheLookup
// x1 = SEL, x16 = isa
ldp x10, x11, [x16, #CACHE] // x10 = buckets, x11 = occupied|mask
and w12, w1, w11 // x12 = _cmd & mask
add x12, x10, x12, LSL #4 // x12 = buckets + ((_cmd & mask)<<4)
ldp x9, x17, [x12] // {x9, x17} = *bucket
1: cmp x9, x1 // if (bucket->sel != _cmd)
b.ne 2f // scan more
CacheHit $0 // call or return imp
2: // not hit: x12 = not-hit bucket
CheckMiss $0 // miss if bucket->sel == 0
cmp x12, x10 // wrap if bucket == buckets
b.eq 3f
ldp x9, x17, [x12, #-16]! // {x9, x17} = *--bucket
b 1b // loop
3: // wrap: x12 = first bucket, w11 = mask
add x12, x12, w11, UXTW #4 // x12 = buckets+(mask<<4)
// Clone scanning loop to miss instead of hang when cache is corrupt.
// The slow path may detect any corruption and halt later.
ldp x9, x17, [x12] // {x9, x17} = *bucket
1: cmp x9, x1 // if (bucket->sel != _cmd)
b.ne 2f // scan more
CacheHit $0 // call or return imp
2: // not hit: x12 = not-hit bucket
CheckMiss $0 // miss if bucket->sel == 0
cmp x12, x10 // wrap if bucket == buckets
b.eq 3f
ldp x9, x17, [x12, #-16]! // {x9, x17} = *--bucket
b 1b // loop
3: // double wrap
JumpMiss $0
.endmacro
看注释可以看出几个比较关键的buckets,_cmd & mask,可以大胆的猜一下,这是在从buckets这个散列数组中用 _cmd&mask找到对应的方法缓存,不了解这几个的可以去类的结构中的cache中查看哦
这段代码主要作用是:查缓存,在cache中查找_cmd对象的实现IMP
CacheHit $0 // call or return imp:命中调用或者返回IMP
CheckMiss $0 // miss if bucket->sel == 0:没有命中
.macro CheckMiss
// miss if bucket->sel == 0
.if $0 == GETIMP
cbz x9, LGetImpMiss
.elseif $0 == NORMAL
cbz x9, __objc_msgSend_uncached
.elseif $0 == LOOKUP
cbz x9, __objc_msgLookup_uncached
.else
.abort oops
.endif
.endmacro
传入的是NORMAL,会调用__objc_msgSend_uncached
STATIC_ENTRY __objc_msgSend_uncached
UNWIND __objc_msgSend_uncached, FrameWithNoSaves
// THIS IS NOT A CALLABLE C FUNCTION
// Out-of-band x16 is the class to search
MethodTableLookup
br x17
END_ENTRY __objc_msgSend_uncached
调用MethodTableLookup,
.macro MethodTableLookup
bl __class_lookupMethodAndLoadCache3
.endmacro
去掉一个_搜索一下_class_lookupMethodAndLoadCache3;
IMP _class_lookupMethodAndLoadCache3(id obj, SEL sel, Class cls)
{
return lookUpImpOrForward(cls, sel, obj,
YES/*initialize*/, NO/*cache*/, YES/*resolver*/);
}
在runtime-new.mm中找到,后面的下面再说,先小节一下
通过上面的混编代码,总结如下:在调用objc_msgSend时,会先判断消息接收者是不是nil,如果是nil直接返回,如果有在方法缓存中查找SEL,如果缓存可以找到就直接返回活调用IMP,如果没有找到,就去类对象或者元类对象的方法列表中查找;
一 : 消息发送
依然还是从源码中着手,接着上面的看吧
// Try this class's cache.试着在类的缓存中查找
imp = cache_getImp(cls, sel);
if (imp) goto done;
// Try this class's method lists. 试着在类的方法列表中查找
{
Method meth = getMethodNoSuper_nolock(cls, sel);
if (meth) {
log_and_fill_cache(cls, meth->imp, sel, inst, cls);
imp = meth->imp;
goto done;
}
}
// Try superclass caches and method lists.在这个类的父类的方法列表中查找
{
unsigned attempts = unreasonableClassCount();
for (Class curClass = cls->superclass;
curClass != nil;
curClass = curClass->superclass)
{
// Halt if there is a cycle in the superclass chain.
if (--attempts == 0) {
_objc_fatal("Memory corruption in class list.");
}
// Superclass cache.
imp = cache_getImp(curClass, sel);
if (imp) {
if (imp != (IMP)_objc_msgForward_impcache) {
// Found the method in a superclass. Cache it in this class.
log_and_fill_cache(cls, imp, sel, inst, curClass);
goto done;
}
else {
break;
}
}
// Superclass method list.
Method meth = getMethodNoSuper_nolock(curClass, sel);
if (meth) {
log_and_fill_cache(cls, meth->imp, sel, inst, curClass);
imp = meth->imp;
goto done;
}
}
}
- 在本类的方法缓存中查找,如果找到就返回
- 上面没有找到就到类的方法列表中查找
- 在父类的缓存和方法列表中查找
先看看怎么在方法列表中查找的?
getMethodNoSuper_nolock(Class cls, SEL sel)
{
for (auto mlists = cls->data()->methods.beginLists(),
end = cls->data()->methods.endLists();
mlists != end;
++mlists)
{
method_t *m = search_method_list(*mlists, sel);
if (m) return m;
}
return nil;
}
static method_t *search_method_list(const method_list_t *mlist, SEL sel)
{
int methodListIsFixedUp = mlist->isFixedUp();
int methodListHasExpectedSize = mlist->entsize() == sizeof(method_t);
if (__builtin_expect(methodListIsFixedUp && methodListHasExpectedSize, 1)) {
return findMethodInSortedMethodList(sel, mlist);
} else {
// Linear search of unsorted method list
for (auto& meth : *mlist) {
if (meth.name == sel) return &meth;
}
}
return nil;
}
static method_t *findMethodInSortedMethodList(SEL key, const method_list_t *list)
{
assert(list);
const method_t * const first = &list->first;
const method_t *base = first;
const method_t *probe;
uintptr_t keyValue = (uintptr_t)key;
uint32_t count;
//count>>=1也就是count = count>>1;右移一位比如10,右移一位就是5了,大家可以试试1010右移一位等于0101
for (count = list->count; count != 0; count >>= 1) {
probe = base + (count >> 1);
uintptr_t probeValue = (uintptr_t)probe->name;
if (keyValue == probeValue) {
while (probe > first && keyValue == (uintptr_t)probe[-1].name) {
probe--;
}
return (method_t *)probe;
}
if (keyValue > probeValue) {
base = probe + 1;
count--;
}
}
return nil;
}
- 循环遍历class_rw_t里面的methods,获取到method_list_t
- 通过
search_method_list函数遍历出method_t(方法的结构体),如果有序就进行二分查找,如果无序就常规循环遍历 - 最终如果IMP有值就直接返回method_t结构体指针
if (meth) {
log_and_fill_cache(cls, meth->imp, sel, inst, cls);//打印并缓存imp
imp = meth->imp;//获取method_t里的imp并返回
goto done;
}
如果找到IMP就对IMP进行缓存,并返回,没有找到就去父类中查找
首先查看缓存cache_getImp找到就缓存在本类的缓存中,并返回IMP
缓存中没有继续在方法列表中查找,步骤和在类中查找一样
如果还没有查找到就开始进行动态方法解析
消息发送
二: 动态方法解析
通过上面一系列的查找调用,如果还没有找到对象的IMP,苹果还是比较仁慈的,允许你进行补救,也就是动态方法解析,可以在合适的位置动态的为这个类添加方法,一起看看吧!
// No implementation found. Try method resolver once.
//没有找到方法实现,尝试使用一次解析器
if (resolver && !triedResolver) {
runtimeLock.unlockRead();
_class_resolveMethod(cls, sel, inst);
runtimeLock.read();
// Don't cache the result; we don't hold the lock so it may have
// changed already. Re-do the search from scratch instead.
triedResolver = YES;
goto retry;
}
void _class_resolveMethod(Class cls, SEL sel, id inst)
{
if (! cls->isMetaClass()) {
// try [cls resolveInstanceMethod:sel]
_class_resolveInstanceMethod(cls, sel, inst);
}
else {
// try [nonMetaClass resolveClassMethod:sel]
// and [cls resolveInstanceMethod:sel]
_class_resolveClassMethod(cls, sel, inst);
if (!lookUpImpOrNil(cls, sel, inst,
NO/*initialize*/, YES/*cache*/, NO/*resolver*/))
{
_class_resolveInstanceMethod(cls, sel, inst);
}
}
}
进入动态解析阶段会去调用两个方法,如果传入的是类对象就调用+ (BOOL)resolveClassMethod:(SEL)sel,如果是元类对象就调用+ (BOOL)resolveInstanceMethod:(SEL)sel
,如果什么都不做返回NO,如果在这里动态的添加方法,返回YES
动态添加方法实现的三种方式
//第一种方式,自定义结构体,获取到method对象赋值给结构体
struct method_t {
SEL sel;
char *types;
IMP imp;
};
- (void)other
{
NSLog(@"%s",__func__);
}
+(BOOL)resolveInstanceMethod:(SEL)sel
{
if (sel == @selector(test)) {
struct method_t *method = (struct method_t *)class_getInstanceMethod(self, @selector(other));
class_addMethod(self, sel, method->imp, method->types);
return YES;
}
return [super resolveInstanceMethod:sel];
}
//第二种方式.,直接通过函数去获取相关信息
+ (BOOL)resolveInstanceMethod:(SEL)sel
{
if (sel == @selector(test)) {
Method method = class_getInstanceMethod(self, @selector(other));
class_addMethod(self, sel, method_getImplementation(method), method_getTypeEncoding(method));
return YES;
}
return [super resolveInstanceMethod:sel];
}
//第三种方式
- (void)other
{
NSLog(@"%s",__func__);
}
+ (BOOL)resolveInstanceMethod:(SEL)sel
{
if (sel == @selector(test)) {
class_addMethod(self, sel, (IMP)c_other, "v16@0:8");
return YES;
}
return [super resolveInstanceMethod:sel];
}
调用了上面的方法然后调用goto retry;再走一次消息发送流程
如果没有进行动态方法解析,就继续向下走咯,消息转发
动态方法解析
三: 消息转发
imp = (IMP)_objc_msgForward_impcache;
cache_fill(cls, sel, imp, inst);
到这里SEL还是没有找到对应的IMP,对象方法可以重写- (id)forwardingTargetForSelector:(SEL)aSelector,类方法+ (id)forwardingTargetForSelector:(SEL)aSelector，把消息的接受者换成一个可以处理该消息的对象。
- (id)forwardingTargetForSelector:(SEL)aSelector
{
if (aSelector == @selector(goCooking)) {
return "可以处理消息的实例对象";
}
return [super forwardingTargetForSelector:aSelector];
}
+ (id)forwardingTargetForSelector:(SEL)aSelector
{
if (aSelector == @selector(goCooking)) {
return "可以处理消息的类对象"
}
return [super forwardingTargetForSelector:aSelector];
}
如果这一步返回的是nil,Runtime系统会向对象发送methodSignatureForSelector:消息，并取到返回的方法签名用于生成NSInvocation对象。为接下来的完整的消息转发生成一个 NSMethodSignature对象。NSMethodSignature 对象会被包装成 NSInvocation 对象，forwardInvocation: 方法里就可以对 NSInvocation 进行处理了
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector
{
if (aSelector == @selector(test)) {
return [NSMethodSignature signatureWithObjCTypes:"v16@0:8"];
// return nil;
}
return [super methodSignatureForSelector:aSelector];
}
- (void)forwardInvocation:(NSInvocation *)anInvocation
{
XXObject *xxobjc = [[XXObject alloc]init];
anInvocation.target = xxobjc;
if ([xxobjc respondsToSelector:anInvocation.selector]) {
[anInvocation invoke];
}else{
[super forwardInvocation:anInvocation];
}
}
如果XXObject处理不了的话,就去父类找,一直找到NSObject,还不能处理这个消息的话,就只能抛出“doesNotRecognizeSelector”异常了。
消息发送与转发流程
理解了消息发送转发的机制.对以后的工作和阅读别人源码有很大的帮助,作为iOS开发者也有必要对底层原理多一些了解,这也是很多面试中经常被问到的问题,希望我的这些废话,没有误人子弟,如有错误欢迎提出
请大家多多支持,在此谢过!!!