方法
在類(lèi)和對(duì)象篇中,我們了解到,方法存放在類(lèi)中.那么問(wèn)題來(lái)了.方法長(zhǎng)啥樣呢?
method_t
struct method_t {
struct big {
SEL name;
const char *types;
MethodListIMP imp;
};
}
從源碼中,我們得知objc_class中有一個(gè)類(lèi)型為method_array_t的二位數(shù)組的成員methods.扒開(kāi)method_array_t的類(lèi)型,我們找到了最終的method_t,就是方法函數(shù)本身的樣子.可以看到.一個(gè)method_t中包含3個(gè)屬性
- name:方法名
- types:編碼(包含參數(shù),返回值類(lèi)型).TypeEncoding的方式
- imp:方法實(shí)現(xiàn)
TypeEncoding
由蘋(píng)果定制的一系列方法返回值類(lèi)型,以及參數(shù)類(lèi)型的編碼規(guī)則.如下圖
OC方法調(diào)用機(jī)制
objc_msgSend
OC中,方法調(diào)用最終轉(zhuǎn)換為objc_msgSend調(diào)用.這種方式稱(chēng)為 消息機(jī)制,即發(fā)送消息給方法調(diào)用者.
消息接收者(receiver):調(diào)用方法的對(duì)象
-
消息名稱(chēng):@selector(xx)
[a foo] //實(shí)例方法
objc_msgSend(a, @selector(foo))
[A foo] //類(lèi)方法
objc_msgSend(objc_getClass("A"),@selector(foo))
objc_msgSend主要分為三個(gè)階段
- 消息發(fā)送
- 動(dòng)態(tài)方法解析
- 消息轉(zhuǎn)發(fā)
消息發(fā)送
蘋(píng)果開(kāi)放的源碼中,objc_msgsend以匯編的方式實(shí)現(xiàn).匯編
ENTRY _objc_msgSend
UNWIND _objc_msgSend, NoFrame
cmp p0, #0 // nil check and tagged pointer check
#if SUPPORT_TAGGED_POINTERS
b.le LNilOrTagged // (MSB tagged pointer looks negative)
#else
b.eq LReturnZero
#endif
ldr p13, [x0] // p13 = isa
GetClassFromIsa_p16 p13, 1, x0 // p16 = class
LGetIsaDone:
// calls imp or objc_msgSend_uncached
CacheLookup NORMAL, _objc_msgSend, __objc_msgSend_uncached
#if SUPPORT_TAGGED_POINTERS
LNilOrTagged:
b.eq LReturnZero // nil check
GetTaggedClass
b LGetIsaDone
// SUPPORT_TAGGED_POINTERS
#endif
LReturnZero:
// x0 is already zero
mov x1, #0
movi d0, #0
movi d1, #0
movi d2, #0
movi d3, #0
ret
END_ENTRY _objc_msgSend
LNilOrTagged
如果消息接收者是nil,直接return
CacheLookup
確定消息接收者不為空,查找緩存.如果緩存命中,調(diào)用_objc_msgSend,如果未命中.調(diào)用__objc_msgSend_uncached再調(diào)用MethodTableLookup,再調(diào)用_lookUpImpOrForward
lookUpImpOrForward
IMP lookUpImpOrForward(id inst, SEL sel, Class cls, int behavior)
{
for (unsigned attempts = unreasonableClassCount();;) {
if (curClass->cache.isConstantOptimizedCache(/* strict */true)) {
#if CONFIG_USE_PREOPT_CACHES
imp = cache_getImp(curClass, sel);
if (imp) goto done_unlock;
curClass = curClass->cache.preoptFallbackClass();
#endif
} else {
// curClass method list.
Method meth = getMethodNoSuper_nolock(curClass, sel);
if (meth) {
imp = meth->imp(false);
goto done;
}
if (slowpath((curClass = curClass->getSuperclass()) == nil)) {
// No implementation found, and method resolver didn't help.
// Use forwarding.
imp = forward_imp;
break;
}
}
// Halt if there is a cycle in the superclass chain.
if (slowpath(--attempts == 0)) {
_objc_fatal("Memory corruption in class list.");
}
// Superclass cache.
imp = cache_getImp(curClass, sel);
if (slowpath(imp == forward_imp)) {
// Found a forward:: entry in a superclass.
// Stop searching, but don't cache yet; call method
// resolver for this class first.
break;
}
if (fastpath(imp)) {
// Found the method in a superclass. Cache it in this class.
goto done;
}
}
// No implementation found. Try method resolver once.
if (slowpath(behavior & LOOKUP_RESOLVER)) {
behavior ^= LOOKUP_RESOLVER;
return resolveMethod_locked(inst, sel, cls, behavior);
}
done:
if (fastpath((behavior & LOOKUP_NOCACHE) == 0)) {
#if CONFIG_USE_PREOPT_CACHES
while (cls->cache.isConstantOptimizedCache(/* strict */true)) {
cls = cls->cache.preoptFallbackClass();
}
#endif
log_and_fill_cache(cls, imp, sel, inst, curClass);
}
done_unlock:
runtimeLock.unlock();
if (slowpath((behavior & LOOKUP_NIL) && imp == forward_imp)) {
return nil;
}
return imp;
}
這里我截取了lookUpImpOrForward的部分代碼.可以得出.
- 1.cache_getImp從類(lèi)的緩存方法列表尋找,若命中,直接返回imp,
- 2.未命中,調(diào)用getMethodNoSuper_nolock嘗試從類(lèi)的方法列表中查找方法.
- 2.1命中,則調(diào)用cache_t::insert將方法緩存到消息接收者緩存列表中,并返回imp供消息接收者調(diào)用.
- 2.2未命中,則找到父類(lèi),重新執(zhí)行步驟1,
- 2.3若未命中,執(zhí)行2.2
- 2.直到父類(lèi)為nil時(shí),imp未命中,則進(jìn)入動(dòng)態(tài)解析resolveMethod_locked
getMethodNoSuper_nolock
static method_t *
getMethodNoSuper_nolock(Class cls, SEL sel)
{
runtimeLock.assertLocked();
ASSERT(cls->isRealized());
auto const methods = cls->data()->methods();
for (auto mlists = methods.beginLists(),
end = methods.endLists();
mlists != end;
++mlists)
{
method_t *m = search_method_list_inline(*mlists, sel);
if (m) return m;
}
return nil;
}
static method_t *
search_method_list_inline(const method_list_t *mlist, SEL sel)
{
int methodListIsFixedUp = mlist->isFixedUp();
int methodListHasExpectedSize = mlist->isExpectedSize();
if (fastpath(methodListIsFixedUp && methodListHasExpectedSize)) {
return findMethodInSortedMethodList(sel, mlist);
} else {
// Linear search of unsorted method list
if (auto *m = findMethodInUnsortedMethodList(sel, mlist))
return m;
}
}
可以看到搜索方法列表的search_method_list_inline方法中,對(duì)已經(jīng)排好序的方法列表是進(jìn)行二分查找.而未排序的,則采用遍歷查找
動(dòng)態(tài)方法解析
resolveMethod_locked
static NEVER_INLINE IMP
resolveMethod_locked(id inst, SEL sel, Class cls, int behavior)
{
runtimeLock.assertLocked();
ASSERT(cls->isRealized());
runtimeLock.unlock();
if (! cls->isMetaClass()) {
// try [cls resolveInstanceMethod:sel]
resolveInstanceMethod(inst, sel, cls);
}
else {
// try [nonMetaClass resolveClassMethod:sel]
// and [cls resolveInstanceMethod:sel]
resolveClassMethod(inst, sel, cls);
if (!lookUpImpOrNilTryCache(inst, sel, cls)) {
resolveInstanceMethod(inst, sel, cls);
}
}
// chances are that calling the resolver have populated the cache
// so attempt using it
return lookUpImpOrForwardTryCache(inst, sel, cls, behavior);
}
動(dòng)態(tài)解析時(shí),根據(jù)類(lèi)或者元類(lèi)屬性來(lái)分別調(diào)用resolveInstanceMethod,resolveClassMethod
實(shí)現(xiàn)動(dòng)態(tài)方法解析
每一個(gè)NSObject類(lèi),都存在下述方法供我們處理動(dòng)態(tài)方法解析.
+ (BOOL)resolveClassMethod:(SEL)sel OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);
+ (BOOL)resolveInstanceMethod:(SEL)sel OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);
那么怎么處理呢?上代碼吧
@interface Test : NSObject
+ (void)test;
- (void)test;
@end
@implementation Test
+ (BOOL)resolveClassMethod:(SEL)sel {
if (sel == @selector(test)) {
Method method = class_getClassMethod(self, @selector(handleResolveClassMethod));
class_addMethod(object_getClass(self), sel, method_getImplementation(method), method_getTypeEncoding(method));
return YES;
}
return [super resolveClassMethod:sel];
}
+ (void)handleResolveClassMethod {
NSLog(@"%s",__func__);
}
+ (BOOL)resolveInstanceMethod:(SEL)sel {
if (sel == @selector(test)) {
Method method = class_getInstanceMethod(self, @selector(handleResolveInstanceMethod));
class_addMethod(self, sel, method_getImplementation(method), method_getTypeEncoding(method));
return YES;
}
return [super resolveInstanceMethod:sel];
}
- (void)handleResolveInstanceMethod {
NSLog(@"%s",__func__);
}
@end
int main(int argc, const char * argv[]) {
@autoreleasepool {
[Test test];
[[Test new] test];
}
return 0;
}
值得注意的是.類(lèi)方法存在元類(lèi)里面.所以用runtime動(dòng)態(tài)添加類(lèi)方法時(shí),記得要找到類(lèi)的元類(lèi)進(jìn)行添加.
而如果是添加實(shí)例方法,則直接傳入self即可.
當(dāng)我們動(dòng)態(tài)為類(lèi)添加了對(duì)應(yīng)的方法實(shí)現(xiàn)后.會(huì)重新走一次objc_msgSend
_lookUpImpTryCache
ALWAYS_INLINE
static IMP _lookUpImpTryCache(id inst, SEL sel, Class cls, int behavior)
{
runtimeLock.assertUnlocked();
if (slowpath(!cls->isInitialized())) {
// see comment in lookUpImpOrForward
return lookUpImpOrForward(inst, sel, cls, behavior);
}
IMP imp = cache_getImp(cls, sel);
if (imp != NULL) goto done;
#if CONFIG_USE_PREOPT_CACHES
if (fastpath(cls->cache.isConstantOptimizedCache(/* strict */true))) {
imp = cache_getImp(cls->cache.preoptFallbackClass(), sel);
}
#endif
if (slowpath(imp == NULL)) {
return lookUpImpOrForward(inst, sel, cls, behavior);
}
done:
if ((behavior & LOOKUP_NIL) && imp == (IMP)_objc_msgForward_impcache) {
return nil;
}
return imp;
}
從方法可以看出.實(shí)現(xiàn)動(dòng)態(tài)方法解析后,也是重新走消息發(fā)送的流程.先從方法緩存列表找起.再走lookUpImpOrForward
到這一步,動(dòng)態(tài)方法解析基本走完.如果我們沒(méi)有實(shí)現(xiàn)動(dòng)態(tài)方法解析的話(huà),就會(huì)進(jìn)入第三階段.消息轉(zhuǎn)發(fā)
消息轉(zhuǎn)發(fā)
消息轉(zhuǎn)發(fā)
找遍了源碼.也找不到消息轉(zhuǎn)發(fā)相關(guān)的東西.但是從最終崩潰的調(diào)用棧來(lái)看.
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '+[Test test]: unrecognized selector sent to class 0x100008208'
*** First throw call stack:
(
0 CoreFoundation 0x00007fff206206af __exceptionPreprocess + 242
1 libobjc.A.dylib 0x00000001002fbb80 objc_exception_throw + 48
2 CoreFoundation 0x00007fff206a2bdd __CFExceptionProem + 0
3 CoreFoundation 0x00007fff2058807d ___forwarding___ + 1467
4 CoreFoundation 0x00007fff20587a38 _CF_forwarding_prep_0 + 120
5 KCObjcBuild 0x0000000100003ee5 main + 53
6 libdyld.dylib 0x00007fff204c9621 start + 1
)
看到了forwarding,進(jìn)入該調(diào)用棧的匯編.發(fā)現(xiàn)有一句注釋講到未實(shí)現(xiàn)methodSignatureForSelector,那我們嘗試實(shí)現(xiàn)一下.
0x7fff20587fbe <+1276>: leaq 0x5febb1ab(%rip), %rsi ; @"*** NSForwarding: warning: object %p of class '%s' does not implement methodSignatureForSelector: -- did you forget to declare the superclass of '%s'?"
methodSignatureForSelector
+ (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector
可以看到這個(gè)方法需要返回一個(gè)NSMethodSignature.查看該類(lèi)的初始化方法,我們需要傳入方法實(shí)現(xiàn)的Method_t的types參數(shù).也就是typeEncoding.那我們?cè)囋噷?shí)現(xiàn)一下.我們?cè)赥est類(lèi)中添加如下代碼,然后運(yùn)行
+ (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
if (aSelector == @selector(test)) {
return [NSMethodSignature signatureWithObjCTypes:"v16@0:8"];
}
return [super methodSignatureForSelector:aSelector];
}
運(yùn)行過(guò)后繼續(xù)報(bào)錯(cuò).繼續(xù)輸出調(diào)用棧.
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '+[Test test]: unrecognized selector sent to class 0x100008258'
*** First throw call stack:
(
0 CoreFoundation 0x00007fff206206af __exceptionPreprocess + 242
1 libobjc.A.dylib 0x00000001002fbb80 objc_exception_throw + 48
2 CoreFoundation 0x00007fff206a2bdd __CFExceptionProem + 0
3 libobjc.A.dylib 0x0000000100350957 +[NSObject forwardInvocation:] + 103
4 CoreFoundation 0x00007fff20587e07 ___forwarding___ + 837
5 CoreFoundation 0x00007fff20587a38 _CF_forwarding_prep_0 + 120
6 KCObjcBuild 0x0000000100003ea3 main + 51
7 libdyld.dylib 0x00007fff204c9621 start + 1
)
forwardInvocation
此時(shí)可以看到.多了一個(gè)[NSObject forwardInvocation:].
+ (void)forwardInvocation:(NSInvocation *)invocation {
[self doesNotRecognizeSelector:(invocation ? [invocation selector] : 0)];
}
- (void)forwardInvocation:(NSInvocation *)invocation {
[self doesNotRecognizeSelector:(invocation ? [invocation selector] : 0)];
}
// Replaced by CF (throws an NSException)
+ (void)doesNotRecognizeSelector:(SEL)sel {
_objc_fatal("+[%s %s]: unrecognized selector sent to instance %p",
class_getName(self), sel_getName(sel), self);
}
進(jìn)入NSObject的源碼中發(fā)現(xiàn).調(diào)用了doesNotRecognizeSelector方法.最終發(fā)現(xiàn)了萬(wàn)惡之源...
就是每次崩潰時(shí)輸出的unrecognized selector sent to class錯(cuò)誤
NSInvocation
@interface NSInvocation : NSObject
+ (NSInvocation *)invocationWithMethodSignature:(NSMethodSignature *)sig;
@property (readonly, retain) NSMethodSignature *methodSignature;
- (void)retainArguments;
@property (readonly) BOOL argumentsRetained;
@property (nullable, assign) id target;
@property SEL selector;
- (void)getReturnValue:(void *)retLoc;
- (void)setReturnValue:(void *)retLoc;
- (void)getArgument:(void *)argumentLocation atIndex:(NSInteger)idx;
- (void)setArgument:(void *)argumentLocation atIndex:(NSInteger)idx;
- (void)invoke;
- (void)invokeWithTarget:(id)target;
@end
我們?cè)趂orwardInvocation中加入斷點(diǎn).看看anInvocation放了什么東西.
(lldb) po anInvocation
<NSInvocation: 0x10070f420>
return value: {v} void
target: {@} 0x100008298
selector: {:} test
(lldb) po 0x100008298
Test
可以看到.anInvocation里面放了要執(zhí)行的方法名以及執(zhí)行它的target.如果我們此時(shí)調(diào)用invoke.那還是會(huì)繼續(xù)報(bào)找不到方法錯(cuò)誤.那么怎么解決呢.如果我們讓其他實(shí)現(xiàn)了test方法的類(lèi)來(lái)作為target.是不是就可以呢.讓我們?cè)囋?/p>
@interface Test1 : NSObject
@end
@implementation Test1
+ (void)test {
NSLog(@"%s",__func__);
}
@end
@interface Test : NSObject
+ (void)test;
@end
@implementation Test
+ (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
if (aSelector == @selector(test)) {
return [NSMethodSignature signatureWithObjCTypes:"v16@0:8"];
}
return [super methodSignatureForSelector:aSelector];
}
+ (void)forwardInvocation:(NSInvocation *)anInvocation {
[anInvocation invokeWithTarget:[Test1 class]];
}
@end
int main(int argc, const char * argv[]) {
@autoreleasepool {
[Test test];
}
return 0;
}
我們發(fā)現(xiàn).最終通過(guò)消息轉(zhuǎn)發(fā).Test1成為了消息接收者并完成了方法的調(diào)用.到此消息轉(zhuǎn)發(fā)就結(jié)束了.
