Block的本質(zhì)

Block 對(duì)象是c語(yǔ)言的語(yǔ)法和運(yùn)行時(shí)結(jié)構(gòu)波附。很像c函數(shù)柏靶，但是執(zhí)行代碼的時(shí)會(huì)使用棧區(qū)和堆區(qū)的變量。因此想罕，一個(gè)block執(zhí)行的時(shí)候，它所維持的這些狀態(tài)和數(shù)據(jù)會(huì)影響它的行為霉涨。雖然block是C語(yǔ)言語(yǔ)法弧呐，并且能在c和C++中使用，但是他一個(gè)OC對(duì)象:

來(lái)自官方文檔.jpeg

它的底層結(jié)構(gòu)是一個(gè)結(jié)構(gòu)體嵌纲，結(jié)構(gòu)體中的函數(shù)指針指向block的函數(shù)實(shí)現(xiàn)斤葱，block()調(diào)用的就是這個(gè)函數(shù)准谚。

Block的類型

跟普通對(duì)象一樣，Block也有isa指針指向相應(yīng)的類型重慢。Block有三個(gè)類型（NSGlobalBlock今阳，NSMallocBlock师溅，NSStackBlock）茅信。

全局Block（NSGlobalBlock）

Block在不引用外部變量或只引用全局變量或者靜態(tài)變量就是全局Block。代碼示例：

    //不引用任何變量
    void (^block1)(void) = ^{
    };
    NSLog(@"block1:%@",block1);
    
    //引用靜態(tài)變量
   static int c = 0;
   void (^block2)(void) = ^{
       c = 1;
   };
   NSLog(@"block2:%@",block2);

打印結(jié)果：

2021-07-21 17:23:53.944309+0800 001---BlockDemo[32880:11497834] block1:<NSGlobalBlock: 0x10c92a0a0>
2021-07-21 17:23:53.944616+0800 001---BlockDemo[32880:11497834] block2:<NSGlobalBlock: 0x10c92a0c0>

堆Block（NSMallocBlock）

引用了局部變量墓臭，發(fā)生copy操作之后就變成堆block蘸鲸。代碼示例：

   //引用局部變量a
    int a = 0;
    //這里默認(rèn)是強(qiáng)引用，發(fā)生了copy操作
    void (^block3)(void) = ^{
       NSLog(@"a:%@",@(a));
    };
    NSLog(@"block3:%@",block3);

打印結(jié)果：

2021-07-21 17:32:21.386941+0800 001---BlockDemo[32934:11503105] block3:<NSMallocBlock: 0x600002227cf0>

棧Block（NSStackBlock）

引用了局部變量窿锉，未發(fā)生copy操作酌摇。代碼示例：

    //引用局部變量a
    int a = 0;
    //這里__weak是弱引用，未發(fā)生了copy操作
    void (^__weak block4)(void) = ^{
       NSLog(@"a:%@",@(a));
    };
    NSLog(@"block4:%@",block4);

打印結(jié)果：

2021-07-21 17:35:39.843363+0800 001---BlockDemo[32992:11509042] block4:<NSStackBlock: 0x7ffee2080488>

Block的底層結(jié)構(gòu)-Block layout

Block_layout是block結(jié)構(gòu)體的底層結(jié)構(gòu)嗡载，其源碼如下：

struct Block_layout {
    void *isa; //
    volatile int32_t flags; // contains ref count
    int32_t reserved;
    BlockInvokeFunction invoke;// block()通過(guò)它調(diào)用函數(shù)
    struct Block_descriptor_1 *descriptor; //
    // imported variables
};

• isa 指針指向Block的類型窑多；
• invoke 是Block函數(shù)，Block調(diào)用實(shí)際上就是調(diào)用的invoke
• flags 是個(gè)標(biāo)記位洼滚，用于標(biāo)記Block的類型埂息、狀態(tài)等

//flags注釋
// Values for Block_layout->flags to describe block objects
//enum {
//    BLOCK_DEALLOCATING =      (0x0001),  // runtime
//    BLOCK_REFCOUNT_MASK =     (0xfffe),  // runtime
//    BLOCK_NEEDS_FREE =        (1 << 24), // runtime
//    BLOCK_HAS_COPY_DISPOSE =  (1 << 25), // compiler
//    BLOCK_HAS_CTOR =          (1 << 26), // compiler: helpers have C++ code
//    BLOCK_IS_GC =             (1 << 27), // runtime
//    BLOCK_IS_GLOBAL =         (1 << 28), // compiler
//    BLOCK_USE_STRET =         (1 << 29), // compiler: undefined if !BLOCK_HAS_SIGNATURE
//    BLOCK_HAS_SIGNATURE  =    (1 << 30), // compiler
//    BLOCK_HAS_EXTENDED_LAYOUT=(1 << 31)  // compiler
//};

• descriptor是可變屬性，而且是遞增的遥巴。默認(rèn)的是:

#define BLOCK_DESCRIPTOR_1 1
struct Block_descriptor_1 {
    uintptr_t reserved;
    uintptr_t size;
};

當(dāng)block引用對(duì)象時(shí)千康，就會(huì)新增如下結(jié)構(gòu)：

#define BLOCK_DESCRIPTOR_2 1
struct Block_descriptor_2 {
    // requires BLOCK_HAS_COPY_DISPOSE
    BlockCopyFunction copy;
    BlockDisposeFunction dispose;
};

BlockCopyFunction copy用于保存對(duì)象的copy函數(shù)，因?yàn)槿绻鸼lock引用對(duì)象铲掐，當(dāng)Block發(fā)生copy時(shí)拾弃，引用的對(duì)象也要copy(Block copy時(shí)有解析)。此時(shí)的descriptor相當(dāng)于：

struct Block_descriptor {
    uintptr_t reserved;
    uintptr_t size;
    BlockCopyFunction copy;
    BlockDisposeFunction dispose;
};
//依據(jù)是編譯成C++代碼時(shí)增加了：
static struct __main_block_desc_0 {
  size_t reserved;
  size_t Block_size;
  void (*copy)(struct __main_block_impl_0*, struct __main_block_impl_0*);
  void (*dispose)(struct __main_block_impl_0*);
} __main_block_desc_0_DATA = { 0, sizeof(struct __main_block_impl_0), __main_block_copy_0, __main_block_dispose_0};

當(dāng)block有簽名時(shí)迹炼，增加Block_descriptor_3：

#define BLOCK_DESCRIPTOR_3 1
struct Block_descriptor_3 {
    // requires BLOCK_HAS_SIGNATURE
    const char *signature;
    const char *layout;     // contents depend on BLOCK_HAS_EXTENDED_LAYOUT
};

Block捕獲外部變量

普通變量的捕獲

Block捕獲外部普通變量（不是__block等修飾的變量）會(huì)自動(dòng)生成一個(gè)屬性來(lái)保存砸彬。接下來(lái)我們通過(guò)將main.c文件編譯成main.cpp文件查看底層c++代碼進(jìn)行驗(yàn)證。首先在main函數(shù)實(shí)現(xiàn)如下block代碼：

#import <UIKit/UIKit.h>
int main(int argc, char * argv[]) {
    int a = 11;
    void (^block)(void) = ^(void){
        NSLog(@"%@",@(a));
    };
    block();
}

通過(guò)命令xcrun -sdk iphonesimulator clang -arch x86_64 -rewrite-objc main.m 編譯成main.cpp文件斯入，打開(kāi)砂碉，找到main函數(shù)對(duì)應(yīng)的c++代碼，如下：

int main(int argc, char * argv[]) {
    int a = 11;
  //這一行是block的創(chuàng)建
    void (*block)(void) = ((void (*)())&__main_block_impl_0((void *)__main_block_func_0, &__main_block_desc_0_DATA, a));
    //這一行是block調(diào)用
    ((void (*)(__block_impl *))((__block_impl *)block)->FuncPtr)((__block_impl *)block);
}
//為了便于分析刻两，把類型轉(zhuǎn)換符號(hào)去掉增蹭，可以簡(jiǎn)化成：
void (*block)(void) = __main_block_impl_0(__main_block_func_0, &__main_block_desc_0_DATA, a);
    //這一行是block調(diào)用，可以看到block調(diào)用的時(shí)候他會(huì)把自身作為參數(shù)再次傳到函數(shù)里面磅摹，這一步的用處在后面的__main_block_func_0會(huì)講解
block->FuncPtr(block);
}

• __main_block_impl_0結(jié)構(gòu)體分析
  __main_block_impl_0是Block編譯時(shí)自動(dòng)生成的結(jié)構(gòu)體滋迈，Block的創(chuàng)建實(shí)際上就是這個(gè)結(jié)構(gòu)調(diào)用了構(gòu)造函數(shù)創(chuàng)建的，其結(jié)構(gòu)體代碼如下：

struct __block_impl {
  void *isa;
  int Flags;
  int Reserved;
  void *FuncPtr;
};
struct __main_block_impl_0 {
  struct __block_impl impl;
  struct __main_block_desc_0* Desc;
  int a; //自動(dòng)生成a屬性來(lái)保存捕獲的變量a
  __main_block_impl_0(void *fp, struct __main_block_desc_0 *desc, int _a, int flags=0) : a(_a) {// 構(gòu)造函數(shù)
    impl.isa = &_NSConcreteStackBlock;//isa指針
    impl.Flags = flags;//
    impl.FuncPtr = fp;//fp函數(shù)作為參數(shù)傳入户誓，保存在FuncPtr指針饼灿，這樣block()才能調(diào)用函數(shù)
    Desc = desc;
  }
};

在這里可以看到__block_impl的構(gòu)造函數(shù)跟我們前面的Block_layout結(jié)構(gòu)體是對(duì)應(yīng)關(guān)系：

isa 對(duì)應(yīng) isa
Flags 對(duì)應(yīng)falgs
FuncPtr 對(duì)應(yīng) invoke
Desc 對(duì)應(yīng) descriptor

• 為捕獲的變量自動(dòng)生成屬性以及descriptor的確定
  __main_block_impl_0在__block_impl的基礎(chǔ)上增加了屬性int a用于捕獲的外部變量a；同時(shí)還增加可變屬性__main_block_desc_0* Desc帝美，這個(gè)Desc的可變?cè)趺大w現(xiàn)呢碍彭？比如上面的demo把a(bǔ)是一個(gè)值類型（int），它對(duì)應(yīng)的__main_block_desc_0的結(jié)構(gòu)如下：

static struct __main_block_desc_0 {
  size_t reserved;
  size_t Block_size;
} __main_block_desc_0_DATA = { 0, sizeof(struct __main_block_impl_0)};

但是如果把a(bǔ)換成對(duì)象類型，比如：

    NSObject *obj = [[NSObject alloc] init];
    void (^block1)(void) = ^{
        NSLog(@"%@",obj);
    };
    block1();

這時(shí)候編譯的到的_main_block_desc_0變成：

static struct __main_block_desc_0 {
  size_t reserved;
  size_t Block_size;
  void (*copy)(struct __main_block_impl_0*, struct __main_block_impl_0*);
  void (*dispose)(struct __main_block_impl_0*);
} __main_block_desc_0_DATA = { 0, sizeof(struct __main_block_impl_0), __main_block_copy_0, __main_block_dispose_0};

這與我們前面對(duì)Block_layout的分析是一致的庇忌，它增加了copy和dispose方法舞箍。因?yàn)閷?duì)象類型需要這兩個(gè)方法而值類型不需要。

• 被捕獲的外部變量的訪問(wèn)
  __main_block_func_0就是block()調(diào)用的函數(shù)的實(shí)現(xiàn)皆疹。我們創(chuàng)建Block的時(shí)候并沒(méi)有傳入函數(shù)名稱疏橄，但是Block卻自動(dòng)生成一個(gè)函數(shù)實(shí)現(xiàn)，這也是block被稱為匿名函數(shù)的由來(lái)略就。__main_block_func_0它的實(shí)現(xiàn)代碼：

static void __main_block_func_0(struct __main_block_impl_0 *__cself) {
//函數(shù)內(nèi)又會(huì)自定義一個(gè)臨時(shí)變量copy了block結(jié)構(gòu)體中cself->a的值
  int a = __cself->a; // // bound by copy
        NSLog((NSString *)&__NSConstantStringImpl__var_folders_kz_91163dcd57j_zw_xyry904bc0000gn_T_main_c2c542_mi_0,((NSNumber *(*)(Class, SEL, int))(void *)objc_msgSend)(objc_getClass("NSNumber"), sel_registerName("numberWithInt:"), (int)(a)));
    }

通過(guò)源碼我們發(fā)現(xiàn)__main_block_func_0的參數(shù)實(shí)際上是Block結(jié)構(gòu)體本身捎迫，這樣也就解釋了為什么我們能在Block代碼塊里面訪問(wèn)其結(jié)構(gòu)體__main_block_impl_0中的屬性了，比如這里的int a屬性残制，這里面的a實(shí)際上已經(jīng)不是block外面的變量a立砸，而是__main_block_func_0自定義的臨時(shí)變量用于接收Block結(jié)構(gòu)體屬性a。這同時(shí)也解釋了為什么在Block里面無(wú)法對(duì)a進(jìn)行修改初茶。

那為什么__block修飾的變量可以被修改呢颗祝？它是如何被捕獲的？加下來(lái)我們看看__block修飾的變量的捕獲恼布。

__block變量的捕獲

用__block對(duì)int a進(jìn)行修飾螺戳，同時(shí)在block內(nèi)對(duì)a++操作，研究一下__block的實(shí)現(xiàn)原理及a為何能被修改折汞。代碼如下：

__block int a = 11;
    void (^block)(void) = ^(void){
        a++;
        NSLog(@"%@",@(a));
    };
    block();

重復(fù)上面的編譯步驟倔幼，得到編譯后main函數(shù)的c++代碼如下：

int main(int argc, char * argv[]) {

    __attribute__((__blocks__(byref))) __Block_byref_a_0 a = {(void*)0,(__Block_byref_a_0 *)&a, 0, sizeof(__Block_byref_a_0), 11};
    void (*block)(void) = ((void (*)())&__main_block_impl_0((void *)__main_block_func_0, &__main_block_desc_0_DATA, (__Block_byref_a_0 *)&a, 570425344));
    ((void (*)(__block_impl *))((__block_impl *)block)->FuncPtr)((__block_impl *)block);
}

為方便閱讀，簡(jiǎn)化成如下代碼：

int main(int argc, char * argv[]) {

    __Block_byref_a_0 a = {
        (void*)0,
        (__Block_byref_a_0 *)&a,
        0,
        sizeof(__Block_byref_a_0),
        11
        
    };
    void (*block)(void) = __main_block_impl_0(
                                              _main_block_func_0,
                                              &__main_block_desc_0_DATA,
                                              (__Block_byref_a_0 *)&a,
                                              570425344
                                              );
   block->FuncPtr(block);
}

• __main_block_impl_0結(jié)構(gòu)體分析
  此時(shí)的Block的結(jié)構(gòu)體__main_block_impl_0 代碼如下：

struct __main_block_impl_0 {
  struct __block_impl impl;
  struct __main_block_desc_0* Desc;
  __Block_byref_a_0 *a; // by ref 
  __main_block_impl_0(void *fp, struct __main_block_desc_0 *desc, __Block_byref_a_0 *_a, int flags=0) : a(_a->__forwarding) {
    impl.isa = &_NSConcreteStackBlock;
    impl.Flags = flags;
    impl.FuncPtr = fp;
    Desc = desc;
  }
};

此時(shí)的__main_block_impl_0和捕獲普通對(duì)象時(shí)的結(jié)構(gòu)基本是一樣的爽待，唯一不同在于對(duì)外部變量的捕獲损同。

• 自動(dòng)生成一個(gè)結(jié)構(gòu)體屬性用于接收外部__block變量
  通過(guò)上面的代碼可以看出這段代碼比前面的多了一個(gè)結(jié)構(gòu)體__Block_byref_a_0，這個(gè)結(jié)構(gòu)體實(shí)際上Block用來(lái)捕獲__block int a 變量的鸟款，其結(jié)構(gòu)體源碼如下：

struct __Block_byref_a_0 {
  void *__isa;
__Block_byref_a_0 *__forwarding;// 保存變量a的指針
 int __flags;
 int __size;
 int a;// 保存變量a的值
};

• 為什么__block 變量可以在Block里面修改
  由代碼可以看出Block不僅捕獲__block int a 變量的值膏燃，還捕獲了a的指針，通過(guò)__Block_byref_a_0結(jié)構(gòu)體分別保存在屬性int a 和 __Block_byref_a_0 *__forwarding中何什， 保存原始變量 指針 - 值组哩，拿到變量a的地址，所以可以通過(guò)指針進(jìn)行修改处渣。
• __block變量在Block函數(shù)中如何訪問(wèn)伶贰？
  此時(shí)__main_block_func_0函數(shù)實(shí)現(xiàn)也變成如下?tīng)顟B(tài)：

static void __main_block_func_0(struct __main_block_impl_0 *__cself) {
  __Block_byref_a_0 *a = __cself->a; // bound by ref，這里是指針拷貝

        (a->__forwarding->a)++; //通過(guò)__forwarding指針訪問(wèn)a變量并可以修改
        NSLog((NSString *)&__NSConstantStringImpl__var_folders_kz_91163dcd57j_zw_xyry904bc0000gn_T_main_2b95a8_mi_0,((NSNumber *(*)(Class, SEL, int))(void *)objc_msgSend)(objc_getClass("NSNumber"), sel_registerName("numberWithInt:"), (int)((a->__forwarding->a))));
    }

可以看到__main_block_func_0函數(shù)里面變量a的指針進(jìn)行了拷貝罐栈，并且通過(guò)a->__forwarding->a訪問(wèn)變量a并進(jìn)行修改黍衙，這樣Block內(nèi)部和外部指向同一個(gè)地址，所以可以修改外部變量荠诬。

Block的copy原理解析

什么時(shí)候進(jìn)行Copy琅翻？

通過(guò)匯編調(diào)試可以找到Block進(jìn)行copy的地方 涯捻。以下通過(guò)以下兩步匯編斷點(diǎn)調(diào)試，跳到_Block_copy的代碼實(shí)現(xiàn)：

       NSObject *obj = [[NSObject alloc] init];
    void (^block1)(void) = ^{
//        NSLog(@"a:%@",@(a));
        NSLog(@"%@",obj);
    };
    block1();

Block斷點(diǎn)調(diào)試.jpg

block源碼.jpg

根據(jù)提示可以看出Block源碼出自libsystem_blocks.dylib動(dòng)態(tài)庫(kù)望迎，Block的copy操作是在_Block_copy函數(shù)中完成的。

NSStackBlock變成NSMallocBlock過(guò)程演示

棧Block進(jìn)行copy操作之后就變成堆Block的凌外。接下來(lái)我們通過(guò)匯編調(diào)試驗(yàn)證這一過(guò)程辩尊。通過(guò)在_Block_copy調(diào)用前和調(diào)用結(jié)束打斷點(diǎn)分析block類型變化來(lái)演示：

BlockDemo.jpg

運(yùn)行到斷點(diǎn)位置，然后進(jìn)入?yún)R編調(diào)試康辑，然后添加符號(hào)objc_retainBlock斷點(diǎn)摄欲，繼續(xù)運(yùn)行：

符號(hào)斷點(diǎn).png

Copy前.jpg

這一步就可以看到已經(jīng)準(zhǔn)備調(diào)用_Block_copy函數(shù)了，在這之前打印Block發(fā)現(xiàn)是__NSStackBlock類型疮薇。接下來(lái)繼續(xù)運(yùn)行一步步跳入到_Block_copy實(shí)現(xiàn)胸墙，并在_Block_copy結(jié)束并準(zhǔn)備返回（ret）前打斷點(diǎn)，如下：

block源碼.jpg

_Block_copy結(jié)束.png

這回可以看到Block已經(jīng)變成了__NSMallocBlock按咒。

_Block_copy源碼解析

由上面的調(diào)試可知迟隅，Block的copy發(fā)生在_Block_copy函數(shù)中，接下來(lái)通過(guò)源碼查看_Block_copy的流程：

void *_Block_copy(const void *arg) {
    struct Block_layout *aBlock;

    if (!arg) return NULL;
    
    // The following would be better done as a switch statement
    aBlock = (struct Block_layout *)arg;
    if (aBlock->flags & BLOCK_NEEDS_FREE) {
        // latches on high
        latching_incr_int(&aBlock->flags);
        return aBlock;
    }
    else if (aBlock->flags & BLOCK_IS_GLOBAL) {
        return aBlock; //如果是全局Block励七，則不需要copy智袭，直接返回
    }
    else { // 如果是棧Block，則會(huì)申請(qǐng)一個(gè)堆空間創(chuàng)建一個(gè)新的Block,并將所有屬性值拷貝一份
        // Its a stack block.  Make a copy.
        
        struct Block_layout *result =
            (struct Block_layout *)malloc(aBlock->descriptor->size);
        if (!result) return NULL;
        memmove(result, aBlock, aBlock->descriptor->size); // bitcopy first
#if __has_feature(ptrauth_calls)
        // Resign the invoke pointer as it uses address authentication.
        result->invoke = aBlock->invoke;
#endif
        // reset refcount
        result->flags &= ~(BLOCK_REFCOUNT_MASK|BLOCK_DEALLOCATING);    // XXX not needed
        result->flags |= BLOCK_NEEDS_FREE | 2;  // logical refcount 1
        _Block_call_copy_helper(result, aBlock);
        // Set isa last so memory analysis tools see a fully-initialized object.
        //最后把block的類型改為堆Block
        result->isa = _NSConcreteMallocBlock;
        return result;
    }
}

有源碼可知掠抬，_Block_copy主要做了如下幾件事情：

• 1吼野、判斷如果是重復(fù)copy，則直接返回：

if (aBlock->flags & BLOCK_NEEDS_FREE) {
        // latches on high
        latching_incr_int(&aBlock->flags);
        return aBlock;
    }

當(dāng)?shù)谝淮蝐opy之后BLOCK_NEEDS_FREE會(huì)被標(biāo)記两波。下次在對(duì)同一個(gè)block進(jìn)行copy時(shí)直接返回瞳步。

• 2、判斷如果是全局Block則直接返回：

if (aBlock->flags & BLOCK_IS_GLOBAL) {
        return aBlock; //如果是全局Block腰奋，則不需要copy单起，直接返回
    }

全局Block是不需要copy的。

• 3氛堕、開(kāi)辟堆空間馏臭，copy棧block到堆區(qū)

      struct Block_layout *result =
            (struct Block_layout *)malloc(aBlock->descriptor->size);
        if (!result) return NULL;
        memmove(result, aBlock, aBlock->descriptor->size); // bitcopy first
#if __has_feature(ptrauth_calls)
        // Resign the invoke pointer as it uses address authentication.
        result->invoke = aBlock->invoke;
#endif
        // reset refcount
        result->flags &= ~(BLOCK_REFCOUNT_MASK|BLOCK_DEALLOCATING);    // XXX not needed
        result->flags |= BLOCK_NEEDS_FREE | 2;  // logical refcount 1
        _Block_call_copy_helper(result, aBlock);
        // Set isa last so memory analysis tools see a fully-initialized object.
        //最后把block的類型改為堆Block
        result->isa = _NSConcreteMallocBlock;
        return result;

設(shè)置invoke：aBlock->invoke
更新Block的狀態(tài)：flags
如果引用對(duì)象類型，copy對(duì)象：_Block_call_copy_helper（后面有專門對(duì)象copy的分析）
isa指針指向堆類型：result->isa = _NSConcreteMallocBlock

對(duì)象的Copy操作

對(duì)象的Copy是通過(guò)函數(shù)_Block_object_assign完成的讼稚。其源碼如下：

void _Block_object_assign(void *destArg, const void *object, const int flags) {
    const void **dest = (const void **)destArg;
   
    switch (os_assumes(flags & BLOCK_ALL_COPY_DISPOSE_FLAGS)) {
     
        case BLOCK_FIELD_IS_OBJECT:
        /*******
        id object = ...;
        [^{ object; } copy];
        ********/
        // objc 指針地址 weakSelf (self)
        _Block_retain_object(object);
         // 持有
        *dest = object;
        break;

      case BLOCK_FIELD_IS_BLOCK:
        /*******
        void (^object)(void) = ...;
        [^{ object; } copy];
        ********/
            
            // block 被一個(gè) block 捕獲

        *dest = _Block_copy(object);
        break;
    
      case BLOCK_FIELD_IS_BYREF | BLOCK_FIELD_IS_WEAK:
      case BLOCK_FIELD_IS_BYREF:
        /*******
         // copy the onstack __block container to the heap
         // Note this __weak is old GC-weak/MRC-unretained.
         // ARC-style __weak is handled by the copy helper directly.
         __block ... x;
         __weak __block ... x;
         [^{ x; } copy];
         ********/
            
        *dest = _Block_byref_copy(object);
        break;
        
      case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_OBJECT:
      case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_BLOCK:
        /*******
         // copy the actual field held in the __block container
         // Note this is MRC unretained __block only. 
         // ARC retained __block is handled by the copy helper directly.
         __block id object;
         __block void (^object)(void);
         [^{ object; } copy];
         ********/

        *dest = object;
        break;

      case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_OBJECT | BLOCK_FIELD_IS_WEAK:
      case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_BLOCK  | BLOCK_FIELD_IS_WEAK:
        /*******
         // copy the actual field held in the __block container
         // Note this __weak is old GC-weak/MRC-unretained.
         // ARC-style __weak is handled by the copy helper directly.
         __weak __block id object;
         __weak __block void (^object)(void);
         [^{ object; } copy];
         ********/

        *dest = object;
        break;

      default:
        break;
    }
}

對(duì)象類型

對(duì)象類型有以下幾種：

enum {
    // see function implementation for a more complete description of these fields and combinations
    BLOCK_FIELD_IS_OBJECT   =  3,  // id, NSObject, __attribute__((NSObject)), block, ...
    BLOCK_FIELD_IS_BLOCK    =  7,  // a block variable
    BLOCK_FIELD_IS_BYREF    =  8,  // the on stack structure holding the __block variable
    BLOCK_FIELD_IS_WEAK     = 16,  // declared __weak, only used in byref copy helpers
    BLOCK_BYREF_CALLER      = 128, // called from __block (byref) copy/dispose support routines.
};

普通對(duì)象copy

普通的對(duì)象（不加任何修飾比如__weak, 或者_(dá)_block）的copy會(huì)被Block持有的同時(shí)還被Block進(jìn)行retain使得引用計(jì)數(shù)增加：

        case BLOCK_FIELD_IS_OBJECT:
        /*******
        id object = ...;
        [^{ object; } copy];
        ********/
        // objc 指針地址 weakSelf (self)
            // arc
        _Block_retain_object(object);
            // 持有
        *dest = object;

引用的對(duì)象本身是個(gè)Block

Block也有可能捕獲其他的block括儒，對(duì)于Block類型對(duì)象，直接調(diào)用_Block_copy（前面已有分析）：

case BLOCK_FIELD_IS_BLOCK:
        /*******
        void (^object)(void) = ...;
        [^{ object; } copy];
        ********/
            // block 被一個(gè) block 捕獲
        *dest = _Block_copy(object);
        break;

__block變量的Copy

__block對(duì)象跟普通對(duì)象不一樣锐想，在block里面它是一個(gè)結(jié)構(gòu)體帮寻，它的copy實(shí)現(xiàn)是在函數(shù)_Block_byref_copy中實(shí)現(xiàn)的：

static struct Block_byref *_Block_byref_copy(const void *arg) {
    
    // Block_byref  結(jié)構(gòu)體
    struct Block_byref *src = (struct Block_byref *)arg;

    if ((src->forwarding->flags & BLOCK_REFCOUNT_MASK) == 0) {
        // src points to stack
        struct Block_byref *copy = (struct Block_byref *)malloc(src->size);
        copy->isa = NULL;
        // byref value 4 is logical refcount of 2: one for caller, one for stack
        copy->flags = src->flags | BLOCK_BYREF_NEEDS_FREE | 4;
        copy->forwarding = copy; // patch heap copy to point to itself
        src->forwarding = copy;  // patch stack to point to heap copy
       
        copy->size = src->size;

        if (src->flags & BLOCK_BYREF_HAS_COPY_DISPOSE) {
            // Trust copy helper to copy everything of interest
            // If more than one field shows up in a byref block this is wrong XXX
            struct Block_byref_2 *src2 = (struct Block_byref_2 *)(src+1);
            struct Block_byref_2 *copy2 = (struct Block_byref_2 *)(copy+1);
            copy2->byref_keep = src2->byref_keep;
            copy2->byref_destroy = src2->byref_destroy;

            if (src->flags & BLOCK_BYREF_LAYOUT_EXTENDED) {
                struct Block_byref_3 *src3 = (struct Block_byref_3 *)(src2+1);
                struct Block_byref_3 *copy3 = (struct Block_byref_3*)(copy2+1);
                copy3->layout = src3->layout;
            }

            (*src2->byref_keep)(copy, src);
        }
        else {
            // Bitwise copy.
            // This copy includes Block_byref_3, if any.
            memmove(copy+1, src+1, src->size - sizeof(*src));
        }
    }
    // already copied to heap
    else if ((src->forwarding->flags & BLOCK_BYREF_NEEDS_FREE) == BLOCK_BYREF_NEEDS_FREE) {
        latching_incr_int(&src->forwarding->flags);
    }
   
    return src->forwarding;
}

Copy出來(lái)的forwarding和原來(lái)的forwarding指向同一個(gè)，保證了block內(nèi)部持有的變量和外部的__block變量是同一個(gè)：

copy->forwarding = copy; // patch heap copy to point to itself
src->forwarding = copy;  // patch stack to point to heap copy 

但是__block修飾的變量又可分為值變量類型（比如int類型等）和對(duì)象類型赠摇。對(duì)于對(duì)象類型固逗，會(huì)調(diào)用對(duì)象的copy方法：

if (src->flags & BLOCK_BYREF_HAS_COPY_DISPOSE) {
            // Trust copy helper to copy everything of interest
            // If more than one field shows up in a byref block this is wrong XXX
            struct Block_byref_2 *src2 = (struct Block_byref_2 *)(src+1);
            struct Block_byref_2 *copy2 = (struct Block_byref_2 *)(copy+1);
            copy2->byref_keep = src2->byref_keep;
            copy2->byref_destroy = src2->byref_destroy;

            if (src->flags & BLOCK_BYREF_LAYOUT_EXTENDED) {
                struct Block_byref_3 *src3 = (struct Block_byref_3 *)(src2+1);
                struct Block_byref_3 *copy3 = (struct Block_byref_3*)(copy2+1);
                copy3->layout = src3->layout;
            }

            (*src2->byref_keep)(copy, src);
        }

對(duì)于值變量類型浅蚪，有：

else {
            // Bitwise copy.
            // This copy includes Block_byref_3, if any.
            memmove(copy+1, src+1, src->size - sizeof(*src));
        }

其他對(duì)象的copy

其他對(duì)象沒(méi)有copy，只是簡(jiǎn)單的指針賦值操作烫罩。

Block調(diào)用情況

Block是如何調(diào)用并執(zhí)行里面的代碼的呢惜傲？通過(guò)匯編斷點(diǎn)繼續(xù)調(diào)試：

block_invoke.jpg

block_invoke實(shí)現(xiàn).jpeg

實(shí)際上是在底層調(diào)用了Block_layout的invoke實(shí)現(xiàn)的。