內(nèi)存偏移
以數(shù)組為例:
int a[4] = {1,2,3,4};
int *b = a;
NSLog(@"%p - %p - %p - %p",&a,&a[0],&a[1],&a[2]);
NSLog(@"%p - %p - %p",b,b+1,b+2);
打印結(jié)果:
0x7ffeefbff520 - 0x7ffeefbff520 - 0x7ffeefbff524 - 0x7ffeefbff528
0x7ffeefbff520 - 0x7ffeefbff524 - 0x7ffeefbff528
由上面結(jié)果可知:
1.由&a與&a[0]的打印結(jié)果相同可知,數(shù)組的首地址存著數(shù)組的第一個(gè)元素;
2.int占用4個(gè)字節(jié),由打印b的指針可以看出,0x7ffeefbff520-> 0x7ffeefbff524地址偏移4個(gè)字節(jié),通過對(duì)地址的偏移,我們一樣可以找到數(shù)組a中的元素;
通過lldb測(cè)試由b拿到數(shù)組a中的元素:
(lldb) po *b
1
(lldb) po *(b+1)
2
(lldb) po *(b+2)
3
小結(jié):我們可以通過地址偏移拿到自己需要的相應(yīng)元素.
類的結(jié)構(gòu)分析
首先我們來看一下類的結(jié)構(gòu)是什么樣的:
struct objc_class : objc_object {
Class ISA;//8字節(jié)
Class superclass;//結(jié)構(gòu)體指針8字節(jié)
cache_t cache; // formerly cache pointer and vtable
class_data_bits_t bits; // class_rw_t * plus custom rr/alloc flags
class_rw_t *data() {
return bits.data();
}
/**此處省略代碼*/
}
typedef struct objc_class *Class;
由上面內(nèi)存偏移的分析可知,如果我們要拿到class_data_bits_t bits,只需要知道我們需要對(duì)首地址便宜多少,便能拿到, Class定義為結(jié)構(gòu)體,我們可以知道ISA,superclass各占8個(gè)字節(jié), class_data_bits_t又占多少字節(jié)呢?
cache_t
struct cache_t {
struct bucket_t *_buckets;//結(jié)構(gòu)體8個(gè)字節(jié)
mask_t _mask;//typedef uint32_t mask_t; 由此可知mask_t占用4個(gè)字節(jié)
mask_t _occupied;//4個(gè)字節(jié)
public://方法不占內(nèi)存
struct bucket_t *buckets();
mask_t mask();
mask_t occupied();
void incrementOccupied();
void setBucketsAndMask(struct bucket_t *newBuckets, mask_t newMask);
void initializeToEmpty();
mask_t capacity();
bool isConstantEmptyCache();
bool canBeFreed();
static size_t bytesForCapacity(uint32_t cap);
static struct bucket_t * endMarker(struct bucket_t *b, uint32_t cap);
void expand();
void reallocate(mask_t oldCapacity, mask_t newCapacity);
struct bucket_t * find(cache_key_t key, id receiver);
static void bad_cache(id receiver, SEL sel, Class isa) __attribute__((noreturn));
};
由注釋我們可以看出cache_t所占的字節(jié)說為16個(gè)字節(jié),因此我們要拿到bits只需將首地址偏移8 + 8 +16 = 32字節(jié)便可得到;
class_rw_t結(jié)構(gòu)
struct class_rw_t {
// Be warned that Symbolication knows the layout of this structure.
uint32_t flags;
uint32_t version;
const class_ro_t *ro;
method_array_t methods;//方法
property_array_t properties;//屬性
protocol_array_t protocols;//協(xié)議
/**省略*/
};
通過class_rw_t結(jié)構(gòu)可以看出來類的方法,屬性,協(xié)議都在這里面;
那么我們就通過栗子來進(jìn)行驗(yàn)證:
創(chuàng)建一個(gè)student的類:
@interface Student : NSObject{
NSString *hobby;
}
@property (nonatomic, copy) NSString *name;
- (void)study;
+ (void)play;
@end
Student *student = [Student alloc];
Class sClass = object_getClass(student);
NSLog(@"%@ - %p",student,sClass);
通過打斷點(diǎn)用lldb進(jìn)行調(diào)試:
(lldb) x/4gx sClass
0x1000025d8: 0x001d8001000025b1 0x0000000100b38140
0x1000025e8: 0x00000001003db260 0x0000000000000000
(lldb) p (class_data_bits_t *)0x1000025f8//由上面分析可知data存在首地址偏移32個(gè)字節(jié)的內(nèi)存中,可計(jì)算出該地址,將其強(qiáng)轉(zhuǎn)成class_data_bits_t類型
(class_data_bits_t *) $1 = 0x00000001000025f8
(lldb) p $1->data()
(class_rw_t *) $2 = 0x0000000100f3ec30
(lldb) p *$2
(class_rw_t) $3 = {
flags = 2148139008
version = 0
ro = 0x00000001000024c8
methods = {
list_array_tt<method_t, method_list_t> = {
= {
list = 0x0000000100002400
arrayAndFlag = 4294976512
}
}
}
properties = {
list_array_tt<property_t, property_list_t> = {
= {
list = 0x00000001000024b0
arrayAndFlag = 4294976688
}
}
}
protocols = {
list_array_tt<unsigned long, protocol_list_t> = {
= {
list = 0x0000000000000000
arrayAndFlag = 0
}
}
}
firstSubclass = nil
nextSiblingClass = LGPerson
demangledName = 0x0000000000000000
}
(lldb) p $3.properties
(property_array_t) $4 = {
list_array_tt<property_t, property_list_t> = {
= {
list = 0x00000001000024b0
arrayAndFlag = 4294976688
}
}
}
(lldb) p $4.list
(property_list_t *) $5 = 0x00000001000024b0
(lldb) p $5->first//由對(duì)property_list_t繼承結(jié)構(gòu)分析可知$5存在該字段
(property_t) $6 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
//property_list_t結(jié)構(gòu)
struct property_list_t : entsize_list_tt<property_t, property_list_t, 0> {
};
struct entsize_list_tt {
uint32_t entsizeAndFlags;
uint32_t count;
Element first;
}
通過答應(yīng)我們確實(shí)在properties中找到了name屬性,但卻沒找到hobby屬性;
結(jié)合class_rw_t的結(jié)構(gòu),我們嘗試從ro尋找:
(lldb) p $2->ro
(const class_ro_t *) $7 = 0x00000001000024c8
(lldb) p *$7
(const class_ro_t) $8 = {
flags = 388
instanceStart = 8
instanceSize = 24
reserved = 0
ivarLayout = 0x0000000100001f80 "\x02"
name = 0x0000000100001f82 "Student"
baseMethodList = 0x0000000100002400
baseProtocols = 0x0000000000000000
ivars = 0x0000000100002468
weakIvarLayout = 0x0000000000000000
baseProperties = 0x00000001000024b0
}
(lldb) p $8.baseProperties
(property_list_t *const) $9 = 0x00000001000024b0
(lldb) p *$9
(property_list_t) $10 = {
entsize_list_tt<property_t, property_list_t, 0> = {
entsizeAndFlags = 16
count = 1
first = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
}
}
(lldb) p $10.get(0)
(property_t) $13 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
由上面打印結(jié)果可知: baseProperties存儲(chǔ)著name屬性,但hobby依舊沒看到,我們嘗試答應(yīng)一下ivars發(fā)現(xiàn):
(lldb) p $8.ivars
(const ivar_list_t *const) $11 = 0x0000000100002468
(lldb) p *$11
(const ivar_list_t) $12 = {
entsize_list_tt<ivar_t, ivar_list_t, 0> = {
entsizeAndFlags = 32
count = 2
first = {
offset = 0x0000000100002550
name = 0x0000000100001e14 "hobby"
type = 0x0000000100001fa5 "@\"NSString\""
alignment_raw = 3
size = 8
}
}
}
(lldb) p $12.get(1)
(ivar_t) $14 = {
offset = 0x0000000100002558
name = 0x0000000100001e3d "_name"
type = 0x0000000100001fa5 "@\"NSString\""
alignment_raw = 3
size = 8
}
(lldb) p $12.get(0)
(ivar_t) $15 = {
offset = 0x0000000100002550
name = 0x0000000100001e14 "hobby"
type = 0x0000000100001fa5 "@\"NSString\""
alignment_raw = 3
size = 8
}
通過打印ivars我們找到了hobby,并且發(fā)現(xiàn)其count = 2;我們通過打印get方法可得到其存儲(chǔ)了"name"和"hobby";
由此可知: 屬性在底層會(huì)生成一個(gè)帶下劃線""的成員變量，也就是上面的_name成員變量
變量我們找到了,那方法又存儲(chǔ)在哪呢?通過打印我們繼續(xù)尋找:
(lldb) p $8.baseMethodList
(method_list_t *const) $16 = 0x0000000100002400
(lldb) p *$16
(method_list_t) $17 = {
entsize_list_tt<method_t, method_list_t, 3> = {
entsizeAndFlags = 26
count = 4//存了四個(gè)方法
first = {
name = "study"
types = 0x0000000100001f8a "v16@0:8"
imp = 0x0000000100001b40 (LGTest`-[Student study] at Student.m:12)
}
}
}
通過打印我們發(fā)現(xiàn)baseMethodList中存了4個(gè)方法,那么我們就一一看看存了哪些方法:
(lldb) p $17.get(0)
(method_t) $18 = {
name = "study"http://study方法
types = 0x0000000100001f8a "v16@0:8"
imp = 0x0000000100001b40 (LGTest`-[Student study] at Student.m:12)
}
(lldb) p $17.get(1)
(method_t) $19 = {
name = ".cxx_destruct"http://c++的方法
types = 0x0000000100001f8a "v16@0:8"
imp = 0x0000000100001c10 (LGTest`-[Student .cxx_destruct] at Student.m:10)
}
(lldb) p $17.get(2)
(method_t) $20 = {
name = "name"http://name的get方法
types = 0x0000000100001f92 "@16@0:8"
imp = 0x0000000100001ba0 (LGTest`-[Student name] at Student.h:16)
}
(lldb) p $17.get(3)
(method_t) $21 = {
name = "setName:"http://name的set的方法
types = 0x0000000100001f9a "v24@0:8@16"
imp = 0x0000000100001bd0 (LGTest`-[Student setName:] at Student.h:16)
}
通過打印我們找了實(shí)例方法study,但是類方法play哪去了呢?猜想:類方法會(huì)不會(huì)存在元類中呢?
驗(yàn)證過程
(lldb) x/4gx sClass
0x1000025d8: 0x001d8001000025b1 0x0000000100b38140
0x1000025e8: 0x00000001003db260 0x0000000000000000
(lldb) p/x 0x001d8001000025b1 & 0x00007ffffffffff8
(long) $1 = 0x00000001000025b0//元類的地址
(lldb) x/4gx 0x00000001000025b0
0x1000025b0: 0x001d800100b380f1 0x0000000100b380f0
0x1000025c0: 0x00000001022175c0 0x0000000100000003
(lldb) p (class_data_bits_t *)0x1000025d0
(class_data_bits_t *) $2 = 0x00000001000025d0
(lldb) p $2->data()
(class_rw_t *) $3 = 0x0000000102217540
(lldb) p $3->ro
(const class_ro_t *) $4 = 0x00000001000023b8
(lldb) p *$4
(const class_ro_t) $5 = {
flags = 389
instanceStart = 40
instanceSize = 40
reserved = 0
ivarLayout = 0x0000000000000000
name = 0x0000000100001f82 "Student"
baseMethodList = 0x0000000100002398
baseProtocols = 0x0000000000000000
ivars = 0x0000000000000000
weakIvarLayout = 0x0000000000000000
baseProperties = 0x0000000000000000
}
(lldb) p $5.baseMethodList
(method_list_t *const) $6 = 0x0000000100002398
(lldb) p *$6
(method_list_t) $7 = {
entsize_list_tt<method_t, method_list_t, 3> = {
entsizeAndFlags = 26
count = 1
first = {
name = "play"
types = 0x0000000100001f8a "v16@0:8"
imp = 0x0000000100001b70 (LGTest`+[Student play] at Student.m:16)
}
}
}
通過對(duì)元類的方法的查找我們找到了play方法,同時(shí)也證明了類方法存在于元類中.
總結(jié)
1.類的屬性和成員變量都存放在類的class_rw_t結(jié)構(gòu)體中
2.屬性的定義叔营，還伴隨著成員變量以及其getter和setter的自動(dòng)生成
3.類的類方法屋彪，則以實(shí)例方法的形式尖阔，存放在元類中
