main 函数可以说是在整个 iOS 开发中非常不起眼的一个函数，却是整个 iOS 应用的入口。
int main(int argc, char * argv[]) {
@autoreleasepool {
return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
}
}
@autoreleasepool 结构
通过对下面代码反汇编,
int main(int argc, const char * argv[]) {
@autoreleasepool {
}
return 0;
}
FPRuntimeTest`main:
0x100003f10 <+0>: pushq %rbp
0x100003f11 <+1>: movq %rsp, %rbp
0x100003f14 <+4>: subq $0x10, %rsp
0x100003f18 <+8>: movl $0x0, -0x8(%rbp)
0x100003f1f <+15>: movl %edi, -0x4(%rbp)
0x100003f22 <+18>: movq %rsi, -0x10(%rbp)
0x100003f26 <+22>: callq 0x100003f48 ; symbol stub for: objc_autoreleasePoolPush
-> 0x100003f2b <+27>: movq %rax, %rdi
0x100003f2e <+30>: callq 0x100003f42 ; symbol stub for: objc_autoreleasePoolPop
0x100003f33 <+35>: xorl %eax, %eax
0x100003f35 <+37>: addq $0x10, %rsp
0x100003f39 <+41>: popq %rbp
0x100003f3a <+42>: retq
可以知道,调用了objc_autoreleasePoolPush和objc_autoreleasePoolPop函数.
在runtime源码中查找
void *objc_autoreleasePoolPush(void)
{
return AutoreleasePoolPage::push();
}
void objc_autoreleasePoolPop(void *ctxt)
{
AutoreleasePoolPage::pop(ctxt);
}
调用了 AutoreleasePoolPage 类 的 push()和pop()方法
class AutoreleasePoolPage : private AutoreleasePoolPageData
{
friend struct thread_data_t; // 声明为友元
public:
static size_t const SIZE =
#if PROTECT_AUTORELEASEPOOL
PAGE_MAX_SIZE; // must be multiple of vm page size
#else
PAGE_MIN_SIZE; // size and alignment, power of 2 // 1左移12位=4096一个自动释放池页的大小,也是一个页大小
#endif
private:
static pthread_key_t const key = AUTORELEASE_POOL_KEY; // 用来从线程中取出来当前释放池的key
static uint8_t const SCRIBBLE = 0xA3; // 0xA3A3A3A3 after releasing
static size_t const COUNT = SIZE / sizeof(id);// 存储对象的数量
static size_t const MAX_FAULTS = 2;
/*
当仅推入一个池且从未包含任何对象时，EMPTY_POOL_PLACEHOLDER就会存储在TLS中。
当顶层（即libdispatch）推送并弹出池但从不使用它们时，这样可以节省内存。
*/
# define EMPTY_POOL_PLACEHOLDER ((id*)1)
// 哨兵对象,nil
# define POOL_BOUNDARY nil
···
}
父类
struct AutoreleasePoolPageData
{
#if SUPPORT_AUTORELEASEPOOL_DEDUP_PTRS
struct AutoreleasePoolEntry {
uintptr_t ptr: 48;
uintptr_t count: 16;
static const uintptr_t maxCount = 65535; // 2^16 - 1
};
static_assert((AutoreleasePoolEntry){ .ptr = MACH_VM_MAX_ADDRESS }.ptr == MACH_VM_MAX_ADDRESS, "MACH_VM_MAX_ADDRESS doesn't fit into AutoreleasePoolEntry::ptr!");
#endif
magic_t const magic;
__unsafe_unretained id *next;
pthread_t const thread;
AutoreleasePoolPage * const parent;
AutoreleasePoolPage *child;
uint32_t const depth;
uint32_t hiwat;
AutoreleasePoolPageData(__unsafe_unretained id* _next, pthread_t _thread, AutoreleasePoolPage* _parent, uint32_t _depth, uint32_t _hiwat)
: magic(), next(_next), thread(_thread),
parent(_parent), child(nil),
depth(_depth), hiwat(_hiwat)
{
}
};
由上可得,下面的代码可以理解为AutoreleasePoolPage的结构
class AutoreleasePoolPage {
magic_t const magic;
id *next;
pthread_t const thread;
AutoreleasePoolPage * const parent;
AutoreleasePoolPage *child;
uint32_t const depth;
uint32_t hiwat;
};
- magic 用于对当前 AutoreleasePoolPage 完整性的校验
- thread 保存了当前页所在的线程
parent 和 child 就是用来构造双向链表的指针。
每一个自动释放池都是由一系列的 AutoreleasePoolPage 组成的，并且每一个 AutoreleasePoolPage 的大小都是 4096 字节（16 进制 0x1000）
magic_t
struct magic_t {
static const uint32_t M0 = 0xA1A1A1A1;
# define M1 "AUTORELEASE!"
static const size_t M1_len = 12;
uint32_t m[4];
magic_t() {
assert(M1_len == strlen(M1));//判断M1是否是12个字符长度
assert(M1_len == 3 * sizeof(m[1]));//判断M1_len是不是12
m[0] = M0;//将0xA1A1A1A1赋值给M0
//把M1字符串地址的12个字节复制到m1地址所指向的空间中
strncpy((char *)&m[1], M1, M1_len);
}
//析构函数
~magic_t() {
m[0] = m[1] = m[2] = m[3] = 0;
}
//检测函数
bool check() const {
return (m[0] == M0 && 0 == strncmp((char *)&m[1], M1, M1_len));
}
//快速检测函数
bool fastcheck() const {
#if CHECK_AUTORELEASEPOOL
return check();
#else
return (m[0] == M0);
#endif
}
# undef M1
};
push
static inline void *push()
{
id *dest;
// 判断是不是在Debug模式下，在 Debug 情况下每一个自动释放池都以一个新的poolPage开始会去调用autoreleaseNewPage方法，否则的话就去调用autoreleaseFast函数
if (slowpath(DebugPoolAllocation)) {
// Each autorelease pool starts on a new pool page.每个自动释放池都在一个新的池页面上开始。
dest = autoreleaseNewPage(POOL_BOUNDARY);
} else {
dest = autoreleaseFast(POOL_BOUNDARY);
}
ASSERT(dest == EMPTY_POOL_PLACEHOLDER || *dest == POOL_BOUNDARY);
return dest;
}
autoreleaseFast
static inline id *autoreleaseFast(id obj)
{
AutoreleasePoolPage *page = hotPage();
if (page && !page->full()) { // 有page且page没有存满
return page->add(obj);
} else if (page) {
return autoreleaseFullPage(obj, page);// 有page,但是存满了
} else {
return autoreleaseNoPage(obj); // 没有page
}
}
上述方法分三种情况选择不同的代码执行：
- 有 hotPage 并且当前 page 不满
-- 调用 page->add(obj) 方法将对象添加至 AutoreleasePoolPage 的栈中 - 有 hotPage 并且当前 page 已满
-- 调用 autoreleaseFullPage 初始化一个新的页
-- 调用 page->add(obj) 方法将对象添加至 AutoreleasePoolPage 的栈中 - 无 hotPage
-- 调用 autoreleaseNoPage 创建一个 hotPage
-- 调用 page->add(obj) 方法将对象添加至 AutoreleasePoolPage 的栈中
最后的都会调用 page->add(obj) 将对象添加到自动释放池中。
hotPage 可以理解为当前正在使用的 AutoreleasePoolPage。
hotPage()
取出当前的page，如果取出的page是EMPTY_POOL_PLACEHOLDER，那就说明是空的池子，就说明还没有page，直接返回nil
EMPTY_POOL_PLACEHOLDER其实就是当一个释放池没有包含任何对象,又被推入栈中,就存储在TLS(Thread_local_storage)中,叫做空池占位符
我们会发现里面有一个tls_get_direct()函数，其实就是通过这个函数去取出当前的page的，其中tls的意思就是线程局部存储(Thread Local Storage)的缩写。
static inline AutoreleasePoolPage *hotPage()
{
AutoreleasePoolPage *result = (AutoreleasePoolPage *)
tls_get_direct(key);
if ((id *)result == EMPTY_POOL_PLACEHOLDER) return nil;
if (result) result->fastcheck();
return result;
}
id *add(id obj)
{
ASSERT(!full());
unprotect();//解除保护
id *ret;
ret = next; // faster than `return next-1` because of aliasing
*next++ = obj;//将obj插入到page中并且重新去设置next的指向
protect();//设置保护
return ret;
}
我们主要去看unprotect()方法和protect()方法
这个函数在Linux中，mprotect()函数可以用来修改一段指定内存区域的保护属性，函数原型int mprotect(const void *start, size_t len, int prot); 这个函数的区间开始的地址start必须是一个内存页的起始地址，并且区间长度len必须是页大小的整数倍。关于这一点在AutoreleasePoolPage类当中也有提及
autoreleaseFullPage
static __attribute__((noinline))
id *autoreleaseFullPage(id obj, AutoreleasePoolPage *page)
{
// The hot page is full.
// Step to the next non-full page, adding a new page if necessary.
// Then add the object to that page.
ASSERT(page == hotPage());//判断是不是最新的page
ASSERT(page->full() || DebugPoolAllocation);////判断page是不是满了或者是不是Debug模式下
do {
//判断page->child是不是存在，如果存在的话就让page = page->child
if (page->child) page = page->child;
//否则就去创建
else page = new AutoreleasePoolPage(page);
} while (page->full());
setHotPage(page);
return page->add(obj);
}
setHotPage
static inline void setHotPage(AutoreleasePoolPage *page)
{
if (page) page->fastcheck();
tls_set_direct(key, (void *)page);
}
autoreleaseNoPage
static __attribute__((noinline))
id *autoreleaseNoPage(id obj)
{
// "No page" could mean no pool has been pushed
// or an empty placeholder pool has been pushed and has no contents yet
ASSERT(!hotPage()); //判断hotPage()返回的page是否为空，如果为空的话才能继续下去
bool pushExtraBoundary = false; // 是否要push边界对象
//如果有占位的EMPTY_POOL_PLACEHOLDER，就去设置需要去push一个边界对象
if (haveEmptyPoolPlaceholder()) {
// We are pushing a second pool over the empty placeholder pool
// or pushing the first object into the empty placeholder pool.
// Before doing that, push a pool boundary on behalf of the pool
// that is currently represented by the empty placeholder.
pushExtraBoundary = true;
}
else if (obj != POOL_BOUNDARY && DebugMissingPools) {
// We are pushing an object with no pool in place,
// and no-pool debugging was requested by environment.
_objc_inform("MISSING POOLS: (%p) Object %p of class %s "
"autoreleased with no pool in place - "
"just leaking - break on "
"objc_autoreleaseNoPool() to debug",
objc_thread_self(), (void*)obj, object_getClassName(obj));
objc_autoreleaseNoPool(obj);
return nil;
}
//如果不是debug模式以及obj是边界对象就去设置空的占位池子也就是 EMPTY_POOL_PLACEHOLDER
else if (obj == POOL_BOUNDARY && !DebugPoolAllocation) {
// We are pushing a pool with no pool in place,
// and alloc-per-pool debugging was not requested.
// Install and return the empty pool placeholder.
return setEmptyPoolPlaceholder();
}
// We are pushing an object or a non-placeholder'd pool.
// Install the first page.
// Install the first page. 创建第一个page
AutoreleasePoolPage *page = new AutoreleasePoolPage(nil);
//设置最新的page
setHotPage(page);
// Push a boundary on behalf of the previously-placeholder'd pool.
if (pushExtraBoundary) {
/*插入一个边界对象会走这里的方法肯定是之前已经设置过 setEmptyPoolPlaceholder也就是说不是在Debug模式下，并且obj不是POOL_BOUNDARY*/
page->add(POOL_BOUNDARY);
}
// Push the requested object or pool.
// 添加一个对象
return page->add(obj);
}
pop
void
objc_autoreleasePoolPop(void *ctxt)
{
AutoreleasePoolPage::pop(ctxt);
}
pop函数里面的参数是调用objc_autoreleasePoolPush()的返回值，返回值是EMPTY_POOL_PLACEHOLDER或一个地址, 地址存储的值是POOL_BOUNDARY
static inline void
pop(void *token)
{
AutoreleasePoolPage *page;
id *stop;
//判断token是否是EMPTY_POOL_PLACEHOLDER
if (token == (void*)EMPTY_POOL_PLACEHOLDER) {
// Popping the top-level placeholder pool.
//调用hotPage()方法判断当前的页存不存在
page = hotPage();
if (!page) {
// Pool was never used. Clear the placeholder.
return setHotPage(nil);
}
// Pool was used. Pop its contents normally.
// Pool pages remain allocated for re-use as usual.
//先调用coldPage()寻找到最上面的祖宗结点,然后调用begin方法,返回的即可以用于存放对象地址的第一个位置，然后进行pop
page = coldPage();
token = page->begin();
} else {
//根据token寻找到页所在的地址
page = pageForPointer(token);
}
stop = (id *)token;
if (*stop != POOL_BOUNDARY) { // 如果token存储的不是nil
if (stop == page->begin() && !page->parent) { // 传进来的是 EMPTY_POOL_PLACEHOLDER
//最冷页面的开始可能不是POOL_BOUNDARY：
// 1.弹出顶级池，将冷页保留在原处
// 2.一个没有池的对象被自动释放
} else {
// Error. For bincompat purposes this is not
// fatal in executables built with old SDKs.
return badPop(token);
}
}
if (slowpath(PrintPoolHiwat || DebugPoolAllocation || DebugMissingPools)) {
return popPageDebug(token, page, stop);
}
return popPage(token, page, stop);
}
pageForPointer 找到token地址对应的autorelease页
static AutoreleasePoolPage *pageForPointer(uintptr_t p)
{
AutoreleasePoolPage *result;
uintptr_t offset = p % SIZE;
ASSERT(offset >= sizeof(AutoreleasePoolPage));
result = (AutoreleasePoolPage *)(p - offset);
result->fastcheck();
return result;
}
popPage
template
static void
popPage(void *token, AutoreleasePoolPage *page, id *stop)
{
if (allowDebug && PrintPoolHiwat) printHiwat();
//释放直到遇到stop
page->releaseUntil(stop);
// memory: delete empty children
if (allowDebug && DebugPoolAllocation && page->empty()) {
// special case: delete everything during page-per-pool debugging
AutoreleasePoolPage *parent = page->parent;
page->kill();
setHotPage(parent);
} else if (allowDebug && DebugMissingPools && page->empty() && !page->parent) {
// special case: delete everything for pop(top)
// when debugging missing autorelease pools
page->kill();
setHotPage(nil);
} else if (page->child) {
// hysteresis: keep one empty child if page is more than half full
if (page->lessThanHalfFull()) {
page->child->kill();
}
else if (page->child->child) {
page->child->child->kill();
}
}
}
释放直到遇到stop
void releaseUntil(id *stop)
{
// Not recursive: we don't want to blow out the stack
// if a thread accumulates a stupendous amount of garbage
while (this->next != stop) { // while循环
// Restart from hotPage() every time, in case -release
// autoreleased more objects
AutoreleasePoolPage *page = hotPage(); // 当前页
// fixme I think this `while` can be `if`, but I can't prove it
while (page->empty()) { // 如果页变空了,设置父页为当前页
page = page->parent;
setHotPage(page);
}
page->unprotect(); // 解除保护
#if SUPPORT_AUTORELEASEPOOL_DEDUP_PTRS
AutoreleasePoolEntry* entry = (AutoreleasePoolEntry*) --page->next;
// create an obj with the zeroed out top byte and release that
id obj = (id)entry->ptr;
int count = (int)entry->count; // grab these before memset
#else
id obj = *--page->next; // 获取需要释放的对象
#endif
memset((void*)page->next, SCRIBBLE, sizeof(*page->next)); // 空间存储的值变成0xA3A3A3A3
page->protect();
if (obj != POOL_BOUNDARY) {
#if SUPPORT_AUTORELEASEPOOL_DEDUP_PTRS
// release count+1 times since it is count of the additional
// autoreleases beyond the first one
for (int i = 0; i < count + 1; i++) {
objc_release(obj);
}
#else
objc_release(obj); // 引用计数-1
#endif
}
}
setHotPage(this); // 设置当前页
#if DEBUG
// we expect any children to be completely empty
for (AutoreleasePoolPage *page = child; page; page = page->child) {
ASSERT(page->empty());
}
#endif
}
kill
void kill()
{
// Not recursive: we don't want to blow out the stack
// if a thread accumulates a stupendous amount of garbage
AutoreleasePoolPage *page = this;
while (page->child) page = page->child; // 找到最后一页
AutoreleasePoolPage *deathptr;
do {
deathptr = page;
page = page->parent;
if (page) {
page->unprotect();
page->child = nil;
page->protect();
}
delete deathptr;
} while (deathptr != this); // 通过 parent 进行autorelease的释放
}
autorelease
static inline id autorelease(id obj)
{
ASSERT(!obj->isTaggedPointerOrNil());
id *dest __unused = autoreleaseFast(obj);
#if SUPPORT_AUTORELEASEPOOL_DEDUP_PTRS
ASSERT(!dest || dest == EMPTY_POOL_PLACEHOLDER || (id)((AutoreleasePoolEntry *)dest)->ptr == obj);
#else
ASSERT(!dest || dest == EMPTY_POOL_PLACEHOLDER || *dest == obj);
#endif
return obj;
}