iOS - 类的结构分析

内存偏移

以数组为例:

int a[4] = {1,2,3,4};
int *b = a;
NSLog(@"%p - %p - %p - %p",&a,&a[0],&a[1],&a[2]);
NSLog(@"%p - %p - %p",b,b+1,b+2);

打印结果:

0x7ffeefbff520 - 0x7ffeefbff520 - 0x7ffeefbff524 - 0x7ffeefbff528
0x7ffeefbff520 - 0x7ffeefbff524 - 0x7ffeefbff528

由上面结果可知:
1.由&a与&a[0]的打印结果相同可知,数组的首地址存着数组的第一个元素;
2.int占用4个字节,由打印b的指针可以看出,0x7ffeefbff520-> 0x7ffeefbff524地址偏移4个字节,通过对地址的偏移,我们一样可以找到数组a中的元素;

通过lldb测试由b拿到数组a中的元素:

(lldb) po *b
1
(lldb) po *(b+1)
2
(lldb) po *(b+2)
3

小结:我们可以通过地址偏移拿到自己需要的相应元素.

类的结构分析

首先我们来看一下类的结构是什么样的:

struct objc_class : objc_object {
    Class ISA;//8字节
    Class superclass;//结构体指针8字节
    cache_t cache;             // formerly cache pointer and vtable
    class_data_bits_t bits;    // class_rw_t * plus custom rr/alloc flags
    class_rw_t *data() { 
        return bits.data();
    }
/**此处省略代码*/
}

typedef struct objc_class *Class;

由上面内存偏移的分析可知,如果我们要拿到class_data_bits_t bits,只需要知道我们需要对首地址便宜多少,便能拿到, Class定义为结构体,我们可以知道ISA,superclass各占8个字节, class_data_bits_t又占多少字节呢?

cache_t

struct cache_t {
    struct bucket_t *_buckets;//结构体8个字节
    mask_t _mask;//typedef uint32_t mask_t; 由此可知mask_t占用4个字节
    mask_t _occupied;//4个字节

public://方法不占内存
    struct bucket_t *buckets();
    mask_t mask();
    mask_t occupied();
    void incrementOccupied();
    void setBucketsAndMask(struct bucket_t *newBuckets, mask_t newMask);
    void initializeToEmpty();

    mask_t capacity();
    bool isConstantEmptyCache();
    bool canBeFreed();

    static size_t bytesForCapacity(uint32_t cap);
    static struct bucket_t * endMarker(struct bucket_t *b, uint32_t cap);

    void expand();
    void reallocate(mask_t oldCapacity, mask_t newCapacity);
    struct bucket_t * find(cache_key_t key, id receiver);

    static void bad_cache(id receiver, SEL sel, Class isa) __attribute__((noreturn));
};

由注释我们可以看出cache_t所占的字节说为16个字节,因此我们要拿到bits只需将首地址偏移8 + 8 +16 = 32字节便可得到;

class_rw_t结构

struct class_rw_t {
    // Be warned that Symbolication knows the layout of this structure.
    uint32_t flags;
    uint32_t version;

    const class_ro_t *ro;

    method_array_t methods;//方法
    property_array_t properties;//属性
    protocol_array_t protocols;//协议

    /**省略*/
};

通过class_rw_t结构可以看出来类的方法,属性,协议都在这里面;

那么我们就通过栗子来进行验证:

创建一个student的类:

@interface Student : NSObject{
    NSString *hobby;
}

@property (nonatomic, copy) NSString *name;

- (void)study;
+ (void)play;

@end

Student *student = [Student alloc];
Class sClass     = object_getClass(student);
NSLog(@"%@ - %p",student,sClass);

通过打断点用lldb进行调试:

(lldb) x/4gx sClass
0x1000025d8: 0x001d8001000025b1 0x0000000100b38140
0x1000025e8: 0x00000001003db260 0x0000000000000000
(lldb) p (class_data_bits_t *)0x1000025f8//由上面分析可知data存在首地址偏移32个字节的内存中,可计算出该地址,将其强转成class_data_bits_t类型
(class_data_bits_t *) $1 = 0x00000001000025f8
(lldb) p $1->data()
(class_rw_t *) $2 = 0x0000000100f3ec30
(lldb) p *$2
(class_rw_t) $3 = {
  flags = 2148139008
  version = 0
  ro = 0x00000001000024c8
  methods = {
    list_array_tt = {
       = {
        list = 0x0000000100002400
        arrayAndFlag = 4294976512
      }
    }
  }
  properties = {
    list_array_tt = {
       = {
        list = 0x00000001000024b0
        arrayAndFlag = 4294976688
      }
    }
  }
  protocols = {
    list_array_tt = {
       = {
        list = 0x0000000000000000
        arrayAndFlag = 0
      }
    }
  }
  firstSubclass = nil
  nextSiblingClass = LGPerson
  demangledName = 0x0000000000000000
}
(lldb) p $3.properties
(property_array_t) $4 = {
  list_array_tt = {
     = {
      list = 0x00000001000024b0
      arrayAndFlag = 4294976688
    }
  }
}
(lldb) p $4.list
(property_list_t *) $5 = 0x00000001000024b0
(lldb) p $5->first//由对property_list_t继承结构分析可知$5存在该字段
(property_t) $6 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")

//property_list_t结构
struct property_list_t : entsize_list_tt {
};
struct entsize_list_tt {
    uint32_t entsizeAndFlags;
    uint32_t count;
    Element first;
}

通过答应我们确实在properties中找到了name属性,但却没找到hobby属性;
结合class_rw_t的结构,我们尝试从ro寻找:

(lldb) p $2->ro
(const class_ro_t *) $7 = 0x00000001000024c8
(lldb) p *$7
(const class_ro_t) $8 = {
  flags = 388
  instanceStart = 8
  instanceSize = 24
  reserved = 0
  ivarLayout = 0x0000000100001f80 "\x02"
  name = 0x0000000100001f82 "Student"
  baseMethodList = 0x0000000100002400
  baseProtocols = 0x0000000000000000
  ivars = 0x0000000100002468
  weakIvarLayout = 0x0000000000000000
  baseProperties = 0x00000001000024b0
}
(lldb) p $8.baseProperties
(property_list_t *const) $9 = 0x00000001000024b0
(lldb) p *$9
(property_list_t) $10 = {
  entsize_list_tt = {
    entsizeAndFlags = 16
    count = 1
    first = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
  }
}
(lldb) p $10.get(0)
(property_t) $13 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")

由上面打印结果可知: baseProperties存储着name属性,但hobby依旧没看到,我们尝试答应一下ivars发现:

(lldb) p $8.ivars
(const ivar_list_t *const) $11 = 0x0000000100002468
(lldb) p *$11
(const ivar_list_t) $12 = {
  entsize_list_tt = {
    entsizeAndFlags = 32
    count = 2
    first = {
      offset = 0x0000000100002550
      name = 0x0000000100001e14 "hobby"
      type = 0x0000000100001fa5 "@\"NSString\""
      alignment_raw = 3
      size = 8
    }
  }
}

(lldb) p $12.get(1)
(ivar_t) $14 = {
  offset = 0x0000000100002558
  name = 0x0000000100001e3d "_name"
  type = 0x0000000100001fa5 "@\"NSString\""
  alignment_raw = 3
  size = 8
}
(lldb) p $12.get(0)
(ivar_t) $15 = {
  offset = 0x0000000100002550
  name = 0x0000000100001e14 "hobby"
  type = 0x0000000100001fa5 "@\"NSString\""
  alignment_raw = 3
  size = 8
}

通过打印ivars我们找到了hobby,并且发现其count = 2;我们通过打印get方法可得到其存储了"name"和"hobby";
由此可知: 属性在底层会生成一个带下划线""的成员变量，也就是上面的_name成员变量
变量我们找到了,那方法又存储在哪呢?通过打印我们继续寻找:

(lldb) p $8.baseMethodList
(method_list_t *const) $16 = 0x0000000100002400
(lldb) p *$16
(method_list_t) $17 = {
  entsize_list_tt = {
    entsizeAndFlags = 26
    count = 4//存了四个方法
    first = {
      name = "study"
      types = 0x0000000100001f8a "v16@0:8"
      imp = 0x0000000100001b40 (LGTest`-[Student study] at Student.m:12)
    }
  }
}

通过打印我们发现baseMethodList中存了4个方法,那么我们就一一看看存了哪些方法:

(lldb) p $17.get(0)
(method_t) $18 = {
  name = "study"//study方法
  types = 0x0000000100001f8a "v16@0:8"
  imp = 0x0000000100001b40 (LGTest`-[Student study] at Student.m:12)
}
(lldb) p $17.get(1)
(method_t) $19 = {
  name = ".cxx_destruct"//c++的方法
  types = 0x0000000100001f8a "v16@0:8"
  imp = 0x0000000100001c10 (LGTest`-[Student .cxx_destruct] at Student.m:10)
}
(lldb) p $17.get(2)
(method_t) $20 = {
  name = "name"//name的get方法
  types = 0x0000000100001f92 "@16@0:8"
  imp = 0x0000000100001ba0 (LGTest`-[Student name] at Student.h:16)
}
(lldb) p $17.get(3)
(method_t) $21 = {
  name = "setName:"//name的set的方法
  types = 0x0000000100001f9a "v24@0:8@16"
  imp = 0x0000000100001bd0 (LGTest`-[Student setName:] at Student.h:16)
}

通过打印我们找了实例方法study,但是类方法play哪去了呢?猜想:类方法会不会存在元类中呢?

验证过程

(lldb) x/4gx sClass
0x1000025d8: 0x001d8001000025b1 0x0000000100b38140
0x1000025e8: 0x00000001003db260 0x0000000000000000
(lldb) p/x 0x001d8001000025b1 & 0x00007ffffffffff8
(long) $1 = 0x00000001000025b0//元类的地址
(lldb) x/4gx 0x00000001000025b0
0x1000025b0: 0x001d800100b380f1 0x0000000100b380f0
0x1000025c0: 0x00000001022175c0 0x0000000100000003
(lldb) p (class_data_bits_t *)0x1000025d0
(class_data_bits_t *) $2 = 0x00000001000025d0
(lldb) p $2->data()
(class_rw_t *) $3 = 0x0000000102217540
(lldb) p $3->ro
(const class_ro_t *) $4 = 0x00000001000023b8
(lldb) p *$4
(const class_ro_t) $5 = {
  flags = 389
  instanceStart = 40
  instanceSize = 40
  reserved = 0
  ivarLayout = 0x0000000000000000
  name = 0x0000000100001f82 "Student"
  baseMethodList = 0x0000000100002398
  baseProtocols = 0x0000000000000000
  ivars = 0x0000000000000000
  weakIvarLayout = 0x0000000000000000
  baseProperties = 0x0000000000000000
}
(lldb) p $5.baseMethodList
(method_list_t *const) $6 = 0x0000000100002398
(lldb) p *$6
(method_list_t) $7 = {
  entsize_list_tt = {
    entsizeAndFlags = 26
    count = 1
    first = {
      name = "play"
      types = 0x0000000100001f8a "v16@0:8"
      imp = 0x0000000100001b70 (LGTest`+[Student play] at Student.m:16)
    }
  }
}

通过对元类的方法的查找我们找到了play方法,同时也证明了类方法存在于元类中.

总结

1.类的属性和成员变量都存放在类的class_rw_t结构体中
2.属性的定义，还伴随着成员变量以及其getter和setter的自动生成
3.类的类方法，则以实例方法的形式，存放在元类中