objc_msgSend源碼解析(三)

1. 動態(tài)方法解析

resolveMethod_locked源碼

static NEVER_INLINE IMP
resolveMethod_locked(id inst, SEL sel, Class cls, int behavior)
{
    runtimeLock.assertLocked();
    ASSERT(cls->isRealized());
    runtimeLock.unlock();
    if (! cls->isMetaClass()) { 
        resolveInstanceMethod(inst, sel, cls);
    } 
    else { 
        resolveClassMethod(inst, sel, cls);
        if (!lookUpImpOrNil(inst, sel, cls)) {
            resolveInstanceMethod(inst, sel, cls);
        }
    }
    return lookUpImpOrForward(inst, sel, cls, behavior | LOOKUP_CACHE);
}

分析：根據(jù)傳入的cls是否是元類分別調(diào)用resolveInstanceMethod或者resolveClassMethod

對于類方法的動態(tài)解析示例

void myClassMethod() {
    NSLog(@"%s", __FUNCTION__);
}

+ (BOOL)resolveClassMethod:(SEL)sel {
    if ([NSStringFromSelector(sel) isEqualToString:@"classMethod"]) {
        const char *cls = [NSStringFromClass([self class]) UTF8String];
        Class metaClass = objc_getMetaClass(cls);
        
        return class_addMethod(metaClass, sel, (IMP)myClassMethod, "");
    }
    return [super resolveClassMethod:sel];
}

注意：

對于類方法的動態(tài)解析需要給元類添加IMP

由于NSObject的元類的父類為NSObject泻云，所以也可以給NSObject的分類添加對應的實例方法

對于實例方法的動態(tài)解析示例

void myInstanceMethod() {
    NSLog(@"%s", __FUNCTION__);
}

+ (BOOL)resolveInstanceMethod:(SEL)sel {
    if ([NSStringFromSelector(sel) isEqualToString:@"instanceMethod"]) {        
        return class_addMethod(self, sel, (IMP)myInstanceMethod, "");
    }
    return [super resolveInstanceMethod:sel];
}

2. 快速轉發(fā)流程

在lookUpImpOrForward函數(shù)中如果找到sel對應的imp莱找，則走到log_and_fill_cache這步，將找到的imp放入緩存交掏。

log_and_fill_cache源碼解析

static void
log_and_fill_cache(Class cls, IMP imp, SEL sel, id receiver, Class implementer)
{
#if SUPPORT_MESSAGE_LOGGING
    if (slowpath(objcMsgLogEnabled && implementer)) {
        bool cacheIt = logMessageSend(implementer->isMetaClass(), 
                                      cls->nameForLogging(),
                                      implementer->nameForLogging(), 
                                      sel);
        if (!cacheIt) return;
    }
#endif
    cache_fill(cls, sel, imp, receiver);
}

可以跟進logMessageSend函數(shù)->logMessageSend->instrumentObjcMessageSends，在instrumentObjcMessageSends傳入的flag即可以打印到文件膨蛮。
所以在外部定義函數(shù)如下

#import <Foundation/Foundation.h>
#import "LSPerson.h"

extern void instrumentObjcMessageSends(BOOL flag); 

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        LSPerson *person = [[LSPerson alloc] init];
        instrumentObjcMessageSends(true);
        [person performSelector:@selector(eat)];
        instrumentObjcMessageSends(false);
    }
    return 0;
}

crash報錯unrecognized selector sent to instance,然后由于是macos項目谦趣，則在/tmp/msgSends-xxx文件中可以看到如下調(diào)用順序

- LSPerson NSObject performSelector:
+ LSPerson NSObject resolveInstanceMethod:
+ LSPerson NSObject resolveInstanceMethod:
- LSPerson NSObject forwardingTargetForSelector:
- LSPerson NSObject forwardingTargetForSelector:
- LSPerson NSObject methodSignatureForSelector:
- LSPerson NSObject methodSignatureForSelector:
- LSPerson NSObject class
+ LSPerson NSObject resolveInstanceMethod:
+ LSPerson NSObject resolveInstanceMethod:
- LSPerson NSObject doesNotRecognizeSelector:
- LSPerson NSObject doesNotRecognizeSelector:

可以看到調(diào)用之后沒有找到方法除了會走動態(tài)解析邏輯resolveInstanceMethod，還走了forwardingTargetForSelector和methodSignatureForSelector分別對應快速轉發(fā)流程和慢速轉發(fā)流程飞主。

我理解的快速轉發(fā)流程和慢速轉發(fā)流程中的快慢是指在objc_msgSend中的先后順序狮惜，并不是快速一定比慢速要快，或者效率更高碌识。

通過反匯編查看____forwarding___流程猜測如果函數(shù)返回空或者self碾篡，仍然會報錯

loc_64bdc:
    rdi = rbx;
    rax = [rdi forwardingTargetForSelector:var_140];
    if ((rax == 0x0) || (rax == rbx)) goto loc_64c47;

所以可以給自己類或者其他類添加sel對應的imp后返回

@implementation LSPerson

- (void)run{
    NSLog(@"%s", __FUNCTION__);
}

- (id)forwardingTargetForSelector:(SEL)aSelector {
    if ([NSStringFromSelector(aSelector) isEqualToString:@"eat"]) {
        //獲取LSPerson中的run方法
        Method method = class_getInstanceMethod([self class], @selector(run));
        const char *type = method_getTypeEncoding(method);
        IMP imp = method_getImplementation(method);
        //將aSelector指向run的imp
        class_addMethod([self class], aSelector, imp, type);
        return [LSPerson alloc];
    }
    return [super forwardingTargetForSelector:aSelector];
}
@end

3. 慢速轉發(fā)流程

- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
    if (aSelector == @selector(eat)) {
        NSMethodSignature *methodSignature = [NSMethodSignature signatureWithObjCTypes:"v@@:"];
        return methodSignature;
    }
    return [super methodSignatureForSelector:aSelector];
}

- (void)forwardInvocation:(NSInvocation *)anInvocation {
    SEL selector = anInvocation.selector;
    if ([[LSPerson alloc] respondsToSelector:selector]) {
        [anInvocation invokeWithTarget:[LSPerson alloc]];
    }else {
        [self doesNotRecognizeSelector:[anInvocation selector]];
    }
}

- (void) doesNotRecognizeSelector: (SEL)aSelector
{
    NSLog(@"%@ does not recognize %@",NSStringFromClass([self class]), NSStringFromSelector(aSelector));
}

分析：

在methodSignatureForSelector這個函數(shù)中返回一個aSelector對應的NSMethodSignature *的函數(shù)簽名

在forwardInvocation函數(shù)中同樣像上述快速轉發(fā)流程一樣，修改消息接收者筏餐，即修改anInvocation.target指向开泽，也可以根據(jù)模塊前綴做相應的UI操作以及上報處理等。