引言：這篇文章旨在從runtime源碼中分析出 引用計數(shù) 值本身的保存位置，適合對底層原理有興趣的朋友棵介，或者面試造火箭的同學(xué)（比如百度的面試官非常喜歡問底層原理：好，我知道你說了深淺復(fù)制的區(qū)別一大堆吧史，如果我讓你自己實現(xiàn)一個copy邮辽，你能實現(xiàn)嗎？如果我讓你實現(xiàn)引用計數(shù)的功能贸营，你有思路嗎逆巍？）。因而本文并 不適用于 專注業(yè)務(wù)層快速開發(fā)的同學(xué)莽使，因為這里將貼有大量的源碼锐极。沒有耐心的同學(xué)可以先收藏暫時回避一下，日后造火箭造飛機的時候再來芳肌。

核心問題

iOS開發(fā)者都知道OC里面的內(nèi)存管理是通過對象的引用計數(shù)來管理的灵再，或手動MRC，或自動ARC亿笤，有些操作可以讓引用計數(shù)加1翎迁，有些可以減1，一旦一個對象的引用計數(shù)為0净薛，就回收內(nèi)存了汪榔。

可是，你僅僅知道這里就行了嗎肃拜？指望你能造火箭造飛機的面試官可不這么想了痴腌，比如問你一句雌团，一個對象的 引用計數(shù)本身 保存在哪里？士聪？不關(guān)注底層的面試者锦援，這時候可能會懵逼。很多介紹內(nèi)存管理的文章對此也含糊不清剥悟，例如：

研究方式

這篇文章不同于其它文章通過 clang編譯 一個類文件以查看它的實現(xiàn)原理（筆者曾用clang編譯分析Block的原理灵寺，傳送門），而是直接通過下載runtime的源碼來查看分析区岗。

依據(jù)版本

蘋果開源了runtime的代碼略板，查看的方式既可以通過 在線網(wǎng)頁版 預(yù)覽，也可以 下載歸檔文件 到本地查看慈缔。本篇文件討論的版本是 objc4-723叮称。

目錄

• 1. 類與對象
  • 1.1 對象 -- Object
  • 1.2 對象 -- NSObject
  • 1.3 對象 -- objc_object
  • 1.4 類 -- objc_class
  • 1.5 NSObject，objc_object胀糜，objc_class 三者的關(guān)系
• 2. 手動引用對引用計數(shù)的影響 -- retain操作
  • 2.1 兩種對象：NSObject與Object的引用增加
  • 2.2 歸根結(jié)底 -- NSObject對象的rootRetain()
• 3. isa與Tagged Pointer
  • 3.1 NSObject的唯一成員變量 -- isa
  • 3.2 isa_t聯(lián)合體里面的數(shù)據(jù)含義
  • 3.3 isa_t聯(lián)合體里面的宏
  • 3.4 是否Tagged Pointer的判斷
  • 3.5 與isa類型有關(guān)的宏
  • 3.6 怎么判斷是否支持優(yōu)化的isa指針颅拦？-- 看設(shè)備蒂誉、自己設(shè)置教藻。
  • 3.7 怎么判斷是否Tagged Pointer的對象？-- 看對象右锨、自己設(shè)置
  • 3.8 引用計數(shù)的存儲形式 -- 散列表
• 4. 散列表
• 4.1 增加引用計數(shù) -- sidetable_retain()
• 4.2 增加引用計數(shù) -- sidetable_tryRetain()
• 4.3 獲取散列表 -- SideTable()
• 5. 設(shè)置變量導(dǎo)致的引用計數(shù)變化 -- objc_retain操作
  • 5.1 情況1
  • 5.2 情況2
  • 5.3 objc_storeStrong導(dǎo)致的retain
• 6. 新建對象（分配內(nèi)存與初始化）導(dǎo)致的引用計數(shù)變化 -- alloc 和 init 操作
  • 6.1 分配內(nèi)存 -- alloc
  • 6.2 初始化 -- init
• 7. 獲取引用計數(shù)
• 8. 結(jié)論
• 9. 拓展閱讀

1. 類與對象

下載完工程括堤，打開查看

module.modulemap
頭文件描述文件

module ObjectiveC [system] [extern_c] {
  umbrella "."
  export *
  module * { 
    export *
  }

  module NSObject {
    requires objc
    header "NSObject.h"
    export *
  }

#if defined(BUILD_FOR_OSX)
  module List {
    // Uses @defs, which does not work in ObjC++ or non-ARC.
    requires objc, !objc_arc, !cplusplus
    header "List.h"
    export *
  }

  module Object {
    requires objc
    header "Object.h"
    export *
  }

  module Protocol {
    requires objc
    header "Protocol.h"
    export *
  }
#endif

#if !defined(BUILD_FOR_OSX)
  // These file are not available outside macOS.
  exclude header "hashtable.h"
  exclude header "hashtable2.h"
#endif
}

這里的Module本質(zhì)上是一個描述文件，用來描述Module中包涵的內(nèi)容绍移，每個Module中必須包涵一個umbrella頭文件悄窃，這個文件用來#import所有這個Module下的文件，比如#import <UIKit/UIKit.h>這個UIKit.h就是一個umbrella文件蹂窖。關(guān)于Module更多參考 這篇文章轧抗。

從#if defined(BUILD_FOR_OSX)這句邏輯判斷可知， Object是針對macOS的瞬测，iOS開發(fā)暫時只關(guān)心NSObject即可横媚。

1.1 對象 -- Object

Object.mm
Object

#include "objc-private.h"

#undef id
#undef Class

typedef struct objc_class *Class;
typedef struct objc_object *id;

#if __OBJC2__

__OSX_AVAILABLE(10.0) 
__IOS_UNAVAILABLE __TVOS_UNAVAILABLE
__WATCHOS_UNAVAILABLE __BRIDGEOS_UNAVAILABLE
OBJC_ROOT_CLASS
@interface Object { 
    Class isa; 
} 
@end

@implementation Object

+ (id)initialize
{
    return self; 
}

+ (id)class
{
    return self;
}

-(id) retain
{
    return _objc_rootRetain(self);
}

-(void) release
{
    _objc_rootRelease(self);
}

-(id) autorelease
{
    return _objc_rootAutorelease(self);
}

+(id) retain
{
    return self;
}

+(void) release
{
}

+(id) autorelease
{
    return self;
}


@end

1.2 對象 -- NSObject

NSObject.h
NSObject

#ifndef _OBJC_NSOBJECT_H_
#define _OBJC_NSOBJECT_H_

#if __OBJC__

#include <objc/objc.h>
#include <objc/NSObjCRuntime.h>

@class NSString, NSMethodSignature, NSInvocation;

@protocol NSObject

- (BOOL)isEqual:(id)object;
@property (readonly) NSUInteger hash;

@property (readonly) Class superclass;
- (Class)class OBJC_SWIFT_UNAVAILABLE("use 'type(of: anObject)' instead");
- (instancetype)self;

- (id)performSelector:(SEL)aSelector;
- (id)performSelector:(SEL)aSelector withObject:(id)object;
- (id)performSelector:(SEL)aSelector withObject:(id)object1 withObject:(id)object2;

- (BOOL)isProxy;

- (BOOL)isKindOfClass:(Class)aClass;
- (BOOL)isMemberOfClass:(Class)aClass;
- (BOOL)conformsToProtocol:(Protocol *)aProtocol;

- (BOOL)respondsToSelector:(SEL)aSelector;

- (instancetype)retain OBJC_ARC_UNAVAILABLE;
- (oneway void)release OBJC_ARC_UNAVAILABLE;
- (instancetype)autorelease OBJC_ARC_UNAVAILABLE;
- (NSUInteger)retainCount OBJC_ARC_UNAVAILABLE;

- (struct _NSZone *)zone OBJC_ARC_UNAVAILABLE;

@property (readonly, copy) NSString *description;
@optional
@property (readonly, copy) NSString *debugDescription;

@end


OBJC_AVAILABLE(10.0, 2.0, 9.0, 1.0, 2.0)
OBJC_ROOT_CLASS
OBJC_EXPORT
@interface NSObject <NSObject> {
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wobjc-interface-ivars"
    Class isa  OBJC_ISA_AVAILABILITY;
#pragma clang diagnostic pop
}

+ (void)load;

+ (void)initialize;
- (instancetype)init
#if NS_ENFORCE_NSOBJECT_DESIGNATED_INITIALIZER
    NS_DESIGNATED_INITIALIZER
#endif
    ;

+ (instancetype)new OBJC_SWIFT_UNAVAILABLE("use object initializers instead");
+ (instancetype)allocWithZone:(struct _NSZone *)zone OBJC_SWIFT_UNAVAILABLE("use object initializers instead");
+ (instancetype)alloc OBJC_SWIFT_UNAVAILABLE("use object initializers instead");
- (void)dealloc OBJC_SWIFT_UNAVAILABLE("use 'deinit' to define a de-initializer");

- (void)finalize OBJC_DEPRECATED("Objective-C garbage collection is no longer supported");

- (id)copy;
- (id)mutableCopy;

+ (id)copyWithZone:(struct _NSZone *)zone OBJC_ARC_UNAVAILABLE;
+ (id)mutableCopyWithZone:(struct _NSZone *)zone OBJC_ARC_UNAVAILABLE;

+ (BOOL)instancesRespondToSelector:(SEL)aSelector;
+ (BOOL)conformsToProtocol:(Protocol *)protocol;
- (IMP)methodForSelector:(SEL)aSelector;
+ (IMP)instanceMethodForSelector:(SEL)aSelector;
- (void)doesNotRecognizeSelector:(SEL)aSelector;

- (id)forwardingTargetForSelector:(SEL)aSelector OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);
- (void)forwardInvocation:(NSInvocation *)anInvocation OBJC_SWIFT_UNAVAILABLE("");
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector OBJC_SWIFT_UNAVAILABLE("");

+ (NSMethodSignature *)instanceMethodSignatureForSelector:(SEL)aSelector OBJC_SWIFT_UNAVAILABLE("");

- (BOOL)allowsWeakReference UNAVAILABLE_ATTRIBUTE;
- (BOOL)retainWeakReference UNAVAILABLE_ATTRIBUTE;

+ (BOOL)isSubclassOfClass:(Class)aClass;

+ (BOOL)resolveClassMethod:(SEL)sel OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);
+ (BOOL)resolveInstanceMethod:(SEL)sel OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);

+ (NSUInteger)hash;
+ (Class)superclass;
+ (Class)class OBJC_SWIFT_UNAVAILABLE("use 'aClass.self' instead");
+ (NSString *)description;
+ (NSString *)debugDescription;

@end

#endif

#endif

1.3 對象 -- objc_object

關(guān)鍵信息：

• isa: isa_t類型的指針，詳情可見下面3.2節(jié)月趟。簡單的說灯蝴，它是這樣的一個聯(lián)合體，包含了bits （是一個 uintptr_t 類型的值孝宗，作為isa初始化列表中必初始化的值穷躁，可以用來獲取isa結(jié)構(gòu)體）和 cls （該變量會指向?qū)ο笏鶎俚念惖慕Y(jié)構(gòu)，在 64 位設(shè)備上會占用 8byte）因妇。

objc-private.h
objc_object

struct objc_object {
private:
    isa_t isa;

public:

    // ISA() assumes this is NOT a tagged pointer object
    Class ISA();

    // getIsa() allows this to be a tagged pointer object
    Class getIsa();

    // initIsa() should be used to init the isa of new objects only.
    // If this object already has an isa, use changeIsa() for correctness.
    // initInstanceIsa(): objects with no custom RR/AWZ
    // initClassIsa(): class objects
    // initProtocolIsa(): protocol objects
    // initIsa(): other objects
    void initIsa(Class cls /*nonpointer=false*/);
    void initClassIsa(Class cls /*nonpointer=maybe*/);
    void initProtocolIsa(Class cls /*nonpointer=maybe*/);
    void initInstanceIsa(Class cls, bool hasCxxDtor);

    // changeIsa() should be used to change the isa of existing objects.
    // If this is a new object, use initIsa() for performance.
    Class changeIsa(Class newCls);

    bool hasNonpointerIsa();
    bool isTaggedPointer();
    bool isBasicTaggedPointer();
    bool isExtTaggedPointer();
    bool isClass();

    // object may have associated objects?
    bool hasAssociatedObjects();
    void setHasAssociatedObjects();

    // object may be weakly referenced?
    bool isWeaklyReferenced();
    void setWeaklyReferenced_nolock();

    // object may have -.cxx_destruct implementation?
    bool hasCxxDtor();

    // Optimized calls to retain/release methods
    id retain();
    void release();
    id autorelease();

    // Implementations of retain/release methods
    id rootRetain();
    bool rootRelease();
    id rootAutorelease();
    bool rootTryRetain();
    bool rootReleaseShouldDealloc();
    uintptr_t rootRetainCount();

    // Implementation of dealloc methods
    bool rootIsDeallocating();
    void clearDeallocating();
    void rootDealloc();

private:
    void initIsa(Class newCls, bool nonpointer, bool hasCxxDtor);

    // Slow paths for inline control
    id rootAutorelease2();
    bool overrelease_error();

#if SUPPORT_NONPOINTER_ISA
    // Unified retain count manipulation for nonpointer isa
    id rootRetain(bool tryRetain, bool handleOverflow);
    bool rootRelease(bool performDealloc, bool handleUnderflow);
    id rootRetain_overflow(bool tryRetain);
    bool rootRelease_underflow(bool performDealloc);

    void clearDeallocating_slow();

    // Side table retain count overflow for nonpointer isa
    void sidetable_lock();
    void sidetable_unlock();

    void sidetable_moveExtraRC_nolock(size_t extra_rc, bool isDeallocating, bool weaklyReferenced);
    bool sidetable_addExtraRC_nolock(size_t delta_rc);
    size_t sidetable_subExtraRC_nolock(size_t delta_rc);
    size_t sidetable_getExtraRC_nolock();
#endif

    // Side-table-only retain count
    bool sidetable_isDeallocating();
    void sidetable_clearDeallocating();

    bool sidetable_isWeaklyReferenced();
    void sidetable_setWeaklyReferenced_nolock();

    id sidetable_retain();
    id sidetable_retain_slow(SideTable& table);

    uintptr_t sidetable_release(bool performDealloc = true);
    uintptr_t sidetable_release_slow(SideTable& table, bool performDealloc = true);

    bool sidetable_tryRetain();

    uintptr_t sidetable_retainCount();
#if DEBUG
    bool sidetable_present();
#endif
};

1.4 類 -- objc_class

關(guān)鍵信息：

• isa: 繼承于objc_object
• superclass: 指向自己父類的指針
• cache: 方法緩存
• bits: 它是一個class_data_bits_t類型的指針问潭。作為本類的實例方法鏈表猿诸。

注意區(qū)別：

這里的bits是class_data_bits_t類型的，上一節(jié)objc_object的isa_t類型數(shù)據(jù)中也有一個uintptr_t類型的bits睦授，但是這是兩種結(jié)構(gòu)两芳。

class_data_bits_t

由此可見，objc_class 繼承于 objc_object去枷， 所以也是包含一個isa的類怖辆。在OC里，不只是對象的實例包含一個isa删顶，這個對象的類本身也有這么一個isa竖螃，類本身也是一個對象。

objc-runtime-new.h
objc_class

struct objc_class : objc_object {
    // Class ISA;
    Class superclass;
    cache_t cache;             // formerly cache pointer and vtable
    class_data_bits_t bits;    // class_rw_t * plus custom rr/alloc flags

    class_rw_t *data() { 
        return bits.data();
    }
    void setData(class_rw_t *newData) {
        bits.setData(newData);
    }

    void setInfo(uint32_t set) {
        assert(isFuture()  ||  isRealized());
        data()->setFlags(set);
    }

    void clearInfo(uint32_t clear) {
        assert(isFuture()  ||  isRealized());
        data()->clearFlags(clear);
    }

    // set and clear must not overlap
    void changeInfo(uint32_t set, uint32_t clear) {
        assert(isFuture()  ||  isRealized());
        assert((set & clear) == 0);
        data()->changeFlags(set, clear);
    }

    bool hasCustomRR() {
        return ! bits.hasDefaultRR();
    }
    void setHasDefaultRR() {
        assert(isInitializing());
        bits.setHasDefaultRR();
    }
    void setHasCustomRR(bool inherited = false);
    void printCustomRR(bool inherited);

    bool hasCustomAWZ() {
        return ! bits.hasDefaultAWZ();
    }
    void setHasDefaultAWZ() {
        assert(isInitializing());
        bits.setHasDefaultAWZ();
    }
    void setHasCustomAWZ(bool inherited = false);
    void printCustomAWZ(bool inherited);

    bool instancesRequireRawIsa() {
        return bits.instancesRequireRawIsa();
    }
    void setInstancesRequireRawIsa(bool inherited = false);
    void printInstancesRequireRawIsa(bool inherited);

    bool canAllocNonpointer() {
        assert(!isFuture());
        return !instancesRequireRawIsa();
    }
    bool canAllocFast() {
        assert(!isFuture());
        return bits.canAllocFast();
    }


    bool hasCxxCtor() {
        // addSubclass() propagates this flag from the superclass.
        assert(isRealized());
        return bits.hasCxxCtor();
    }
    void setHasCxxCtor() { 
        bits.setHasCxxCtor();
    }

    bool hasCxxDtor() {
        // addSubclass() propagates this flag from the superclass.
        assert(isRealized());
        return bits.hasCxxDtor();
    }
    void setHasCxxDtor() { 
        bits.setHasCxxDtor();
    }


    bool isSwift() {
        return bits.isSwift();
    }


    // Return YES if the class's ivars are managed by ARC, 
    // or the class is MRC but has ARC-style weak ivars.
    bool hasAutomaticIvars() {
        return data()->ro->flags & (RO_IS_ARC | RO_HAS_WEAK_WITHOUT_ARC);
    }

    // Return YES if the class's ivars are managed by ARC.
    bool isARC() {
        return data()->ro->flags & RO_IS_ARC;
    }


#if SUPPORT_NONPOINTER_ISA
    // Tracked in non-pointer isas; not tracked otherwise
#else
    bool instancesHaveAssociatedObjects() {
        // this may be an unrealized future class in the CF-bridged case
        assert(isFuture()  ||  isRealized());
        return data()->flags & RW_INSTANCES_HAVE_ASSOCIATED_OBJECTS;
    }

    void setInstancesHaveAssociatedObjects() {
        // this may be an unrealized future class in the CF-bridged case
        assert(isFuture()  ||  isRealized());
        setInfo(RW_INSTANCES_HAVE_ASSOCIATED_OBJECTS);
    }
#endif

    bool shouldGrowCache() {
        return true;
    }

    void setShouldGrowCache(bool) {
        // fixme good or bad for memory use?
    }

    bool isInitializing() {
        return getMeta()->data()->flags & RW_INITIALIZING;
    }

    void setInitializing() {
        assert(!isMetaClass());
        ISA()->setInfo(RW_INITIALIZING);
    }

    bool isInitialized() {
        return getMeta()->data()->flags & RW_INITIALIZED;
    }

    void setInitialized();

    bool isLoadable() {
        assert(isRealized());
        return true;  // any class registered for +load is definitely loadable
    }

    IMP getLoadMethod();

    // Locking: To prevent concurrent realization, hold runtimeLock.
    bool isRealized() {
        return data()->flags & RW_REALIZED;
    }

    // Returns true if this is an unrealized future class.
    // Locking: To prevent concurrent realization, hold runtimeLock.
    bool isFuture() { 
        return data()->flags & RW_FUTURE;
    }

    bool isMetaClass() {
        assert(this);
        assert(isRealized());
        return data()->ro->flags & RO_META;
    }

    // NOT identical to this->ISA when this is a metaclass
    Class getMeta() {
        if (isMetaClass()) return (Class)this;
        else return this->ISA();
    }

    bool isRootClass() {
        return superclass == nil;
    }
    bool isRootMetaclass() {
        return ISA() == (Class)this;
    }

    const char *mangledName() { 
        // fixme can't assert locks here
        assert(this);

        if (isRealized()  ||  isFuture()) {
            return data()->ro->name;
        } else {
            return ((const class_ro_t *)data())->name;
        }
    }
    
    const char *demangledName(bool realize = false);
    const char *nameForLogging();

    // May be unaligned depending on class's ivars.
    uint32_t unalignedInstanceStart() {
        assert(isRealized());
        return data()->ro->instanceStart;
    }

    // Class's instance start rounded up to a pointer-size boundary.
    // This is used for ARC layout bitmaps.
    uint32_t alignedInstanceStart() {
        return word_align(unalignedInstanceStart());
    }

    // May be unaligned depending on class's ivars.
    uint32_t unalignedInstanceSize() {
        assert(isRealized());
        return data()->ro->instanceSize;
    }

    // Class's ivar size rounded up to a pointer-size boundary.
    uint32_t alignedInstanceSize() {
        return word_align(unalignedInstanceSize());
    }

    size_t instanceSize(size_t extraBytes) {
        size_t size = alignedInstanceSize() + extraBytes;
        // CF requires all objects be at least 16 bytes.
        if (size < 16) size = 16;
        return size;
    }

    void setInstanceSize(uint32_t newSize) {
        assert(isRealized());
        if (newSize != data()->ro->instanceSize) {
            assert(data()->flags & RW_COPIED_RO);
            *const_cast<uint32_t *>(&data()->ro->instanceSize) = newSize;
        }
        bits.setFastInstanceSize(newSize);
    }

    void chooseClassArrayIndex();

    void setClassArrayIndex(unsigned Idx) {
        bits.setClassArrayIndex(Idx);
    }

    unsigned classArrayIndex() {
        return bits.classArrayIndex();
    }

};

1.5 NSObject逗余，objc_object特咆，objc_class 三者的關(guān)系

1）NSObject與objc_class

NSObject有一個Class類型，名為isa成員變量

NSObject有一個Class類型录粱，名為isa成員變量

繼續(xù)查看Class的本質(zhì)腻格，可以發(fā)現(xiàn)Class 其實就是 C 語言定義的結(jié)構(gòu)體類型(struct objc_class)的指針，這個聲明說明 Objective-C 的 類 實際上就是 struct objc_class啥繁。

Class的本質(zhì)

另外菜职，第二個定義是經(jīng)常遇到的 id 類型，這里可以看出 id 類型是 C 語言定義的結(jié)構(gòu)體類型(struct objc_object)的指針旗闽，我們知道我們可以用 id 來聲明一個對象酬核，所以這也說明了 Objective-C 的 對象 實際上就是 struct objc_object。

2）objc_object與objc_class

繼續(xù)查看objc_class的本質(zhì)适室，可以發(fā)現(xiàn)objc_class是一個 繼承 自objc_object的結(jié)構(gòu)體嫡意。所以 Objective-C 中的 類 自身也是一個 對象，只是除了 objc_object 中定義的成員變量外捣辆，還有另外三個成員變量：superclass蔬螟、cache 和 bits。

objc_class繼承自objc_object

注意汽畴，這里面的 “結(jié)構(gòu)體” 并非 C語言 里面的結(jié)構(gòu)體旧巾，而是 C++語言 里面的結(jié)構(gòu)體，而且這個概念僅限字面意思的結(jié)構(gòu)體整袁。嚴(yán)格來講菠齿，其實struct關(guān)鍵字定義的是 類，跟class關(guān)鍵字定義的類除了默認(rèn)訪問權(quán)限的區(qū)別坐昙，沒有區(qū)別绳匀。這一點，國內(nèi)人寫的C++書籍卻很少有注意到。下面是比較權(quán)威的《C++ Primer》（第546頁）一書關(guān)于這點的說明疾棵。

C++ Primer

3）知識補課

C++中的struct對C中的struct進(jìn)行了擴充戈钢，它已經(jīng)不再只是一個包含不同數(shù)據(jù)類型的數(shù)據(jù)結(jié)構(gòu)了，它已經(jīng)獲取了太多的功能是尔。下面簡單列一下C++的struct跟C中的struct不一樣的地方：

• struct能包含成員函數(shù)
• struct能繼承
• struct能實現(xiàn)多態(tài)

2. 手動引用對引用計數(shù)的影響 -- retain操作

2.1 兩種對象：NSObject與Object的引用增加

① NSObject的retain

NSObject.mm
retain

+ (id)retain {
    return (id)self;
}

// Replaced by ObjectAlloc
- (id)retain {
    return ((id)self)->rootRetain();
}

② Object的retain

Object.mm
retain

+(id) retain
{
    return self;
}

-(id) retain
{
    return _objc_rootRetain(self);
}

NSObject.mm
_objc_rootRetain(id obj)

id
_objc_rootRetain(id obj)
{
    assert(obj);

    return obj->rootRetain();
}

可見殉了，無論是NSObject還是Object的 retain，歸根結(jié)底拟枚，調(diào)用的都是 objc_object 的 rootRetain()薪铜。

2.2 歸根結(jié)底 -- NSObject對象的rootRetain()

objc4/objc4-723/runtime/objc-object.h
objc_object::rootRetain()

ALWAYS_INLINE id 
objc_object::rootRetain()
{
    return rootRetain(false, false);
}

objc4/objc4-723/runtime/objc-object.h
objc_object::rootRetain(bool tryRetain, bool handleOverflow)

ALWAYS_INLINE id 
objc_object::rootRetain(bool tryRetain, bool handleOverflow)
{
    if (isTaggedPointer()) return (id)this;

    bool sideTableLocked = false;
    bool transcribeToSideTable = false;

    isa_t oldisa;
    isa_t newisa;

    do {
        transcribeToSideTable = false;
        oldisa = LoadExclusive(&isa.bits);
        newisa = oldisa;
        if (slowpath(!newisa.nonpointer)) {
            ClearExclusive(&isa.bits);
            if (!tryRetain && sideTableLocked) sidetable_unlock();
            if (tryRetain) return sidetable_tryRetain() ? (id)this : nil;
            else return sidetable_retain();
        }
        // don't check newisa.fast_rr; we already called any RR overrides
        if (slowpath(tryRetain && newisa.deallocating)) {
            ClearExclusive(&isa.bits);
            if (!tryRetain && sideTableLocked) sidetable_unlock();
            return nil;
        }
        uintptr_t carry;
        newisa.bits = addc(newisa.bits, RC_ONE, 0, &carry);  // extra_rc++

        if (slowpath(carry)) {
            // newisa.extra_rc++ overflowed
            if (!handleOverflow) {
                ClearExclusive(&isa.bits);
                return rootRetain_overflow(tryRetain);
            }
            // Leave half of the retain counts inline and 
            // prepare to copy the other half to the side table.
            if (!tryRetain && !sideTableLocked) sidetable_lock();
            sideTableLocked = true;
            transcribeToSideTable = true;
            newisa.extra_rc = RC_HALF;
            newisa.has_sidetable_rc = true;
        }
    } while (slowpath(!StoreExclusive(&isa.bits, oldisa.bits, newisa.bits)));

    if (slowpath(transcribeToSideTable)) {
        // Copy the other half of the retain counts to the side table.
        sidetable_addExtraRC_nolock(RC_HALF);
    }

    if (slowpath(!tryRetain && sideTableLocked)) sidetable_unlock();
    return (id)this;
}

其中，手動retain對引用計數(shù)的影響關(guān)鍵在這么一句話：

newisa.bits = addc(newisa.bits, RC_ONE, 0, &carry);  // extra_rc++

對isa的 extra_rc 變量進(jìn)行+1恩溅，前面說到isa會存很多東西隔箍。

3. isa與Tagged Pointer

3.1 NSObject的唯一成員變量 -- isa

NSObject.h
NSObject的isa

OBJC_AVAILABLE(10.0, 2.0, 9.0, 1.0, 2.0)
OBJC_ROOT_CLASS
OBJC_EXPORT
@interface NSObject <NSObject> {
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wobjc-interface-ivars"
    Class isa  OBJC_ISA_AVAILABILITY;
#pragma clang diagnostic pop
}

其中，Class isa繼續(xù)查看Class的定義：

objc-private.h
Class

typedef struct objc_class *Class;
typedef struct objc_object *id;

其中脚乡，objc_object類內(nèi)部結(jié)構(gòu)：

其中蜒滩，私有的成員數(shù)據(jù)isa為isa_t類型的聯(lián)合體：

objc-private.h
isa_t

union isa_t 
{
    isa_t() { }
    isa_t(uintptr_t value) : bits(value) { }

    Class cls;
    uintptr_t bits;

#if SUPPORT_PACKED_ISA

    // extra_rc must be the MSB-most field (so it matches carry/overflow flags)
    // nonpointer must be the LSB (fixme or get rid of it)
    // shiftcls must occupy the same bits that a real class pointer would
    // bits + RC_ONE is equivalent to extra_rc + 1
    // RC_HALF is the high bit of extra_rc (i.e. half of its range)

    // future expansion:
    // uintptr_t fast_rr : 1;     // no r/r overrides
    // uintptr_t lock : 2;        // lock for atomic property, @synch
    // uintptr_t extraBytes : 1;  // allocated with extra bytes

# if __arm64__
#   define ISA_MASK        0x0000000ffffffff8ULL
#   define ISA_MAGIC_MASK  0x000003f000000001ULL
#   define ISA_MAGIC_VALUE 0x000001a000000001ULL
    struct {
        uintptr_t nonpointer        : 1;
        uintptr_t has_assoc         : 1;
        uintptr_t has_cxx_dtor      : 1;
        uintptr_t shiftcls          : 33; // MACH_VM_MAX_ADDRESS 0x1000000000
        uintptr_t magic             : 6;
        uintptr_t weakly_referenced : 1;
        uintptr_t deallocating      : 1;
        uintptr_t has_sidetable_rc  : 1;
        uintptr_t extra_rc          : 19;
#       define RC_ONE   (1ULL<<45)
#       define RC_HALF  (1ULL<<18)
    };

# elif __x86_64__
#   define ISA_MASK        0x00007ffffffffff8ULL
#   define ISA_MAGIC_MASK  0x001f800000000001ULL
#   define ISA_MAGIC_VALUE 0x001d800000000001ULL
    struct {
        uintptr_t nonpointer        : 1;
        uintptr_t has_assoc         : 1;
        uintptr_t has_cxx_dtor      : 1;
        uintptr_t shiftcls          : 44; // MACH_VM_MAX_ADDRESS 0x7fffffe00000
        uintptr_t magic             : 6;
        uintptr_t weakly_referenced : 1;
        uintptr_t deallocating      : 1;
        uintptr_t has_sidetable_rc  : 1;
        uintptr_t extra_rc          : 8;
#       define RC_ONE   (1ULL<<56)
#       define RC_HALF  (1ULL<<7)
    };

# else
#   error unknown architecture for packed isa
# endif

// SUPPORT_PACKED_ISA
#endif


#if SUPPORT_INDEXED_ISA

# if  __ARM_ARCH_7K__ >= 2

#   define ISA_INDEX_IS_NPI      1
#   define ISA_INDEX_MASK        0x0001FFFC
#   define ISA_INDEX_SHIFT       2
#   define ISA_INDEX_BITS        15
#   define ISA_INDEX_COUNT       (1 << ISA_INDEX_BITS)
#   define ISA_INDEX_MAGIC_MASK  0x001E0001
#   define ISA_INDEX_MAGIC_VALUE 0x001C0001
    struct {
        uintptr_t nonpointer        : 1;
        uintptr_t has_assoc         : 1;
        uintptr_t indexcls          : 15;
        uintptr_t magic             : 4;
        uintptr_t has_cxx_dtor      : 1;
        uintptr_t weakly_referenced : 1;
        uintptr_t deallocating      : 1;
        uintptr_t has_sidetable_rc  : 1;
        uintptr_t extra_rc          : 7;
#       define RC_ONE   (1ULL<<25)
#       define RC_HALF  (1ULL<<6)
    };

# else
#   error unknown architecture for indexed isa
# endif

// SUPPORT_INDEXED_ISA
#endif

};

其中，cls 變量會指向?qū)ο笏鶎俚念惖慕Y(jié)構(gòu)奶稠，在 64 位設(shè)備上會占用 8byte俯艰。

另外，bits 變量保存著isa的唯一標(biāo)志（可以根據(jù)bits獲取isa）锌订，是一個類型為 uintptr_t 的數(shù)據(jù)竹握， uintptr_t的定義：

typedef unsigned long       uintptr_t;

知識回顧

不熟悉C++的朋友可能很難看出來bits會是如何初始化的，其實瀑志，這是一種與構(gòu)造函數(shù)并列的初始化辦法 -- 初始化列表涩搓。關(guān)于初始化列表的定義污秆，截取百度百科的一段話：

初始化列表的用法

所以劈猪，再回過來看bits，bits以isa_t(uintptr_t value)中的value為初始化的值:

`bits`

例如isa初始化的API objc_object::initIsa(Class cls)中良拼，有這樣一句：

isa_t newisa(0);
newisa.bits = ISA_INDEX_MAGIC_VALUE;
//...

而這個bits值可以用來獲取isa（注意區(qū)分左右兩邊的bits分別是兩個東西）:

isa_t bits = LoadExclusive(&isa.bits);

其中战得，LoadExclusive根據(jù)平臺的不同，實現(xiàn)體并不一樣庸推，這是__arm64__平臺的實現(xiàn)體：

#if __arm64__

static ALWAYS_INLINE
uintptr_t 
LoadExclusive(uintptr_t *src)
{
    uintptr_t result;
    asm("ldxr %x0, [%x1]" 
        : "=r" (result) 
        : "r" (src), "m" (*src));
    return result;
}

對這個isa (這里是左邊的bits常侦，它是個isa，而非右邊的uintptr_t) 的調(diào)用贬媒，比如獲取引用計數(shù)的源代碼中就有幾處：

inline uintptr_t 
objc_object::rootRetainCount()
{
    if (isTaggedPointer()) return (uintptr_t)this;

    sidetable_lock();
    isa_t bits = LoadExclusive(&isa.bits);
    ClearExclusive(&isa.bits);
    if (bits.nonpointer) {
        uintptr_t rc = 1 + bits.extra_rc;
        if (bits.has_sidetable_rc) {
            rc += sidetable_getExtraRC_nolock();
        }
        sidetable_unlock();
        return rc;
    }

    sidetable_unlock();
    return sidetable_retainCount();
}

調(diào)用的有：
bits.extra_rc
bits.nonpointer
bits.has_sidetable_rc

3.2 isa_t聯(lián)合體里面struct的數(shù)據(jù)含義

nonpointer

該變量占用 1bit 內(nèi)存空間聋亡，可以有兩個值：0 和 1，分別代表不同的 isa_t 的類型：

• 0 表示 isa_t 沒有開啟指針優(yōu)化际乘，不使用 isa_t 中定義的結(jié)構(gòu)體坡倔。訪問 objc_object 的 isa 會直接返回 isa_t 結(jié)構(gòu)中的 cls 變量，cls 變量會指向?qū)ο笏鶎俚念惖慕Y(jié)構(gòu)，在 64 位設(shè)備上會占用 8byte罪塔。

• 1 表示 isa_t 開啟了指針優(yōu)化投蝉，不能直接訪問 objc_object 的 isa 成員變量 (因為 isa 已經(jīng)不是一個合法的內(nèi)存指針了，而是一個 Tagged Pointer )征堪，從其名字 nonpointer 也可獲知這個 isa 已經(jīng)不是一個指針了瘩缆。但是 isa 中包含了類信息、對象的引用計數(shù)等信息佃蚜，在 64 位設(shè)備上充分利用了內(nèi)存空間庸娱。

shiftcls

存儲類指針的值。開啟指針優(yōu)化的情況下谐算，在 arm64 架構(gòu)中有 33 位用來存儲類指針涌韩。

has_assoc

該變量與對象的關(guān)聯(lián)引用有關(guān)，當(dāng)對象有關(guān)聯(lián)引用時氯夷，釋放對象時需要做額外的邏輯臣樱。關(guān)聯(lián)引用就是我們通常用 objc_setAssociatedObject 方法設(shè)置給對象的，這里對于關(guān)聯(lián)引用不做過多分析腮考，如果后續(xù)有時間寫關(guān)聯(lián)引用實現(xiàn)時再深入分析關(guān)聯(lián)引用有關(guān)的代碼雇毫。

has_cxx_dtor

表示該對象是否有 C++ 或者 Objc 的析構(gòu)器，如果有析構(gòu)函數(shù)踩蔚，則需要做析構(gòu)邏輯棚放，如果沒有，則可以更快的釋放對象馅闽。

magic

用于判斷對象是否已經(jīng)完成了初始化飘蚯，在 arm64 中 0x16 是調(diào)試器判斷當(dāng)前對象是真的對象還是沒有初始化的空間(在 x86_64 中該值為 0x3b)。

weakly_referenced

標(biāo)志對象是否被指向或者曾經(jīng)指向一個 ARC 的弱變量福也，沒有弱引用的對象可以更快釋放局骤。

deallocating

標(biāo)志對象是否正在釋放內(nèi)存。

extra_rc

表示該對象的引用計數(shù)值暴凑，實際上是引用計數(shù)值減 1峦甩，例如，如果對象的引用計數(shù)為 10现喳，那么 extra_rc 為 9凯傲。如果引用計數(shù)大于 10，則需要使用到下面的 has_sidetable_rc嗦篱。

has_sidetable_rc

當(dāng)對象引用計數(shù)大于 10 時冰单，則has_sidetable_rc 的值為 1，那么引用計數(shù)會存儲在一個叫 SideTable 的類的屬性中灸促，這是一個散列表诫欠。

ISA_MAGIC_MASK

通過掩碼方式獲取 magic 值狮腿。

ISA_MASK

通過掩碼方式獲取 isa 的類指針值。

RC_ONE 和 RC_HALF

用于引用計數(shù)的相關(guān)計算呕诉。

3.3 isa_t聯(lián)合體里面的宏

SUPPORT_PACKED_ISA

表示平臺是否支持在 isa 指針中插入除 Class 之外的信息缘厢。

• 如果支持就會將 Class 信息放入 isa_t 定義的 struct 內(nèi)，并附上一些其他信息甩挫，例如上面的 nonpointer 等等贴硫；
• 如果不支持，那么不會使用 isa_t 內(nèi)定義的 struct伊者，這時 isa_t 只使用 cls(Class 指針)英遭。

小結(jié)：在 iOS 以及 MacOSX 設(shè)備上，SUPPORT_PACKED_ISA 定義為 1亦渗。

__arm64__挖诸、__x86_64__

表示 CPU 架構(gòu)，例如電腦一般是 __x86_64__ 架構(gòu)法精，手機一般是 arm 結(jié)構(gòu)多律，這里 64 代表是 64 位 CPU。上面只列出了 __arm64__ 架構(gòu)的定義搂蜓。

小結(jié)：iOS 設(shè)備上 __arm64__ 是 1狼荞。

SUPPORT_INDEXED_ISA

SUPPORT_INDEXED_ISA 表示 isa_t 中存放的 Class 信息是 Class 的地址，還是一個索引(根據(jù)該索引可在類信息表中查找該類結(jié)構(gòu)地址)帮碰∠辔叮可以看出，多了一個 uintptr_t indexcls : 15;殉挽。

小結(jié)：iOS 設(shè)備上 SUPPORT_INDEXED_ISA 是 0丰涉。

3.4 是否Tagged Pointer的判斷

objc-object.h
objc_object::isTaggedPointer()

inline bool 
objc_object::isTaggedPointer() 
{
    return _objc_isTaggedPointer(this);
}

objc-internal.h
_objc_isTaggedPointer(const void * _Nullable ptr)

static inline bool 
_objc_isTaggedPointer(const void * _Nullable ptr) 
{
    return ((uintptr_t)ptr & _OBJC_TAG_MASK) == _OBJC_TAG_MASK;
}

3.5 與isa類型有關(guān)的宏

SUPPORT_NONPOINTER_ISA

用于標(biāo)記是否支持優(yōu)化的 isa 指針，其字面含義意思是 isa 的內(nèi)容不再是類的指針了斯碌，而是包含了更多信息一死，比如引用計數(shù)，析構(gòu)狀態(tài)输拇，被其他 weak 變量引用情況摘符。下面看看SUPPORT_NONPOINTER_ISA及其相關(guān)宏的定義：

objc-config.h
SUPPORT_TAGGED_POINTERS

// Define SUPPORT_TAGGED_POINTERS=1 to enable tagged pointer objects
// Be sure to edit tagged pointer SPI in objc-internal.h as well.
#if !(__OBJC2__  &&  __LP64__)
#   define SUPPORT_TAGGED_POINTERS 0
#else
#   define SUPPORT_TAGGED_POINTERS 1
#endif

// Define SUPPORT_MSB_TAGGED_POINTERS to use the MSB 
// as the tagged pointer marker instead of the LSB.
// Be sure to edit tagged pointer SPI in objc-internal.h as well.
#if !SUPPORT_TAGGED_POINTERS  ||  !TARGET_OS_IPHONE
#   define SUPPORT_MSB_TAGGED_POINTERS 0
#else
#   define SUPPORT_MSB_TAGGED_POINTERS 1
#endif

// Define SUPPORT_INDEXED_ISA=1 on platforms that store the class in the isa 
// field as an index into a class table.
// Note, keep this in sync with any .s files which also define it.
// Be sure to edit objc-abi.h as well.
#if __ARM_ARCH_7K__ >= 2
#   define SUPPORT_INDEXED_ISA 1
#else
#   define SUPPORT_INDEXED_ISA 0
#endif

// Define SUPPORT_PACKED_ISA=1 on platforms that store the class in the isa 
// field as a maskable pointer with other data around it.
#if (!__LP64__  ||  TARGET_OS_WIN32  ||  TARGET_OS_SIMULATOR)
#   define SUPPORT_PACKED_ISA 0
#else
#   define SUPPORT_PACKED_ISA 1
#endif

// Define SUPPORT_NONPOINTER_ISA=1 on any platform that may store something
// in the isa field that is not a raw pointer.
#if !SUPPORT_INDEXED_ISA  &&  !SUPPORT_PACKED_ISA
#   define SUPPORT_NONPOINTER_ISA 0
#else
#   define SUPPORT_NONPOINTER_ISA 1
#endif

3.6 怎么判斷是否支持優(yōu)化的isa指針贤斜？-- 看設(shè)備策吠、自己設(shè)置。

• 已知iOS系統(tǒng)的SUPPORT_PACKED_ISA為1瘩绒，SUPPORT_INDEXED_ISA為0猴抹，根據(jù)4.5節(jié)中源代碼的定義可知，iOS系統(tǒng)的SUPPORT_NONPOINTER_ISA為1锁荔。

• 在環(huán)境變量中設(shè)置OBJC_DISABLE_NONPOINTER_ISA蟀给。

即，iOS系統(tǒng) 支持 優(yōu)化的isa指針。

在 64 位環(huán)境下跋理，優(yōu)化的 isa 指針并不是就一定會存儲引用計數(shù)择克，畢竟用 19bit （iOS 系統(tǒng)）保存引用計數(shù)不一定夠。需要注意的是這 19 位保存的是引用計數(shù)的值減一前普。

3.7 怎么判斷是否Tagged Pointer的對象肚邢？-- 看對象、自己設(shè)置

• 可以啟用Tagged Pointer的類對象有：NSDate拭卿、NSNumber骡湖、NSString。Tagged Pointer專門用來存儲小的對象峻厚。

• 在環(huán)境變量中設(shè)置OBJC_DISABLE_TAGGED_POINTERS=YES強制不啟用Tagged Pointer响蕴。

3.8 引用計數(shù)的存儲形式 -- 散列表

下面對sidetable_retain進(jìn)行分析。

4. 散列表

4.1 增加引用計數(shù) -- sidetable_retain()

第2節(jié)的增加引用假設(shè)惠桃，以及后面第8節(jié)的獲取引用計數(shù)會用到下面的API:

NSObject.mm
objc_object::sidetable_retain()

id
objc_object::sidetable_retain()
{
#if SUPPORT_NONPOINTER_ISA
    assert(!isa.nonpointer);
#endif
    SideTable& table = SideTables()[this];
    
    table.lock();
    size_t& refcntStorage = table.refcnts[this];
    if (! (refcntStorage & SIDE_TABLE_RC_PINNED)) {
        refcntStorage += SIDE_TABLE_RC_ONE;
    }
    table.unlock();

    return (id)this;
}

4.2 增加引用計數(shù) -- sidetable_tryRetain()

NSObject.mm
objc_object::sidetable_tryRetain()

bool
objc_object::sidetable_tryRetain()
{
#if SUPPORT_NONPOINTER_ISA
    assert(!isa.nonpointer);
#endif
    SideTable& table = SideTables()[this];

    // NO SPINLOCK HERE
    // _objc_rootTryRetain() is called exclusively by _objc_loadWeak(), 
    // which already acquired the lock on our behalf.

    // fixme can't do this efficiently with os_lock_handoff_s
    // if (table.slock == 0) {
    //     _objc_fatal("Do not call -_tryRetain.");
    // }

    bool result = true;
    RefcountMap::iterator it = table.refcnts.find(this);
    if (it == table.refcnts.end()) {
        table.refcnts[this] = SIDE_TABLE_RC_ONE;
    } else if (it->second & SIDE_TABLE_DEALLOCATING) {
        result = false;
    } else if (! (it->second & SIDE_TABLE_RC_PINNED)) {
        it->second += SIDE_TABLE_RC_ONE;
    }
    
    return result;
}

4.3 獲取散列表 -- SideTable()

NSObject.mm
SideTable

struct SideTable {
    spinlock_t slock;
    RefcountMap refcnts;
    weak_table_t weak_table;

    SideTable() {
        memset(&weak_table, 0, sizeof(weak_table));
    }

    ~SideTable() {
        _objc_fatal("Do not delete SideTable.");
    }

    void lock() { slock.lock(); }
    void unlock() { slock.unlock(); }
    void forceReset() { slock.forceReset(); }

    // Address-ordered lock discipline for a pair of side tables.

    template<HaveOld, HaveNew>
    static void lockTwo(SideTable *lock1, SideTable *lock2);
    template<HaveOld, HaveNew>
    static void unlockTwo(SideTable *lock1, SideTable *lock2);
};

其中浦夷，RefcountMap以及HaveOld，HaveNew的定義為：

// RefcountMap disguises its pointers because we 
// don't want the table to act as a root for `leaks`.
typedef objc::DenseMap<DisguisedPtr<objc_object>,size_t,true> RefcountMap;

// Template parameters.
enum HaveOld { DontHaveOld = false, DoHaveOld = true };
enum HaveNew { DontHaveNew = false, DoHaveNew = true };

llvm-DenseMap.h
DenseMap/DenseMapBase

位置

DenseMapBase

DenseMapBase

DenseMap

DenseMap

5. 設(shè)置變量導(dǎo)致的引用計數(shù)變化 -- objc_retain操作

5.1 情況1 -- strong

runtime.h
設(shè)置strong變量

/** 
 * Sets the value of an instance variable in an object.
 * 
 * @param obj The object containing the instance variable whose value you want to set.
 * @param ivar The Ivar describing the instance variable whose value you want to set.
 * @param value The new value for the instance variable.
 * 
 * @note Instance variables with known memory management (such as ARC strong and weak)
 *  use that memory management. Instance variables with unknown memory management 
 *  are assigned as if they were strong.
 * @note \c object_setIvar is faster than \c object_setInstanceVariable if the Ivar
 *  for the instance variable is already known.
 */
OBJC_EXPORT void
object_setIvarWithStrongDefault(id _Nullable obj, Ivar _Nonnull ivar,
                                id _Nullable value) 
    OBJC_AVAILABLE(10.12, 10.0, 10.0, 3.0, 2.0);

objc-class.mm
object_setIvarWithStrongDefault

void object_setIvarWithStrongDefault(id obj, Ivar ivar, id value)
{
    return _object_setIvar(obj, ivar, value, true /*strong default*/);
}

objc-class.mm
_object_setIvar

static ALWAYS_INLINE 
void _object_setIvar(id obj, Ivar ivar, id value, bool assumeStrong)
{
    if (!obj  ||  !ivar  ||  obj->isTaggedPointer()) return;

    ptrdiff_t offset;
    objc_ivar_memory_management_t memoryManagement;
    _class_lookUpIvar(obj->ISA(), ivar, offset, memoryManagement);

    if (memoryManagement == objc_ivar_memoryUnknown) {
        if (assumeStrong) memoryManagement = objc_ivar_memoryStrong;
        else memoryManagement = objc_ivar_memoryUnretained;
    }

    id *location = (id *)((char *)obj + offset);

    switch (memoryManagement) {
    case objc_ivar_memoryWeak:       objc_storeWeak(location, value); break;
    case objc_ivar_memoryStrong:     objc_storeStrong(location, value); break;
    case objc_ivar_memoryUnretained: *location = value; break;
    case objc_ivar_memoryUnknown:    _objc_fatal("impossible");
    }
}

NSObject.mm
objc_storeStrong

void
objc_storeStrong(id *location, id obj)
{
    id prev = *location;
    if (obj == prev) {
        return;
    }
    objc_retain(obj);
    *location = obj;
    objc_release(prev);
}

5.2 情況2 -- weak

objc-class.mm
設(shè)置weak變量

object_setIvar(id _Nullable obj, Ivar _Nonnull ivar, id _Nullable value) 
    OBJC_AVAILABLE(10.5, 2.0, 9.0, 1.0, 2.0);

objc-class.mm
object_setIvar

void object_setIvar(id obj, Ivar ivar, id value)
{
    return _object_setIvar(obj, ivar, value, false /*not strong default*/);
}

• 可見辜王，這里同樣調(diào)用了 _object_setIvar军拟，代碼情況1，是同一個API誓禁。其中懈息，不同于objc_storeStrong，走的是objc_storeWeak摹恰，下面分析一下：

NSObject.mm
objc_storeWeak

/** 
 * This function stores a new value into a __weak variable. It would
 * be used anywhere a __weak variable is the target of an assignment.
 * 
 * @param location The address of the weak pointer itself
 * @param newObj The new object this weak ptr should now point to
 * 
 * @return \e newObj
 */
id
objc_storeWeak(id *location, id newObj)
{
    return storeWeak<DoHaveOld, DoHaveNew, DoCrashIfDeallocating>
        (location, (objc_object *)newObj);
}

上面有一個storeWeak<DoHaveOld, DoHaveNew, DoCrashIfDeallocating> (location, (objc_object *)newObj)辫继，它的代碼有點長，核心的關(guān)鍵是更新了weak哈希表：->weak_table俗慈。讀者可以從下面搜索一下這個關(guān)鍵詞的位置姑宽。

// Update a weak variable.
// If HaveOld is true, the variable has an existing value 
//   that needs to be cleaned up. This value might be nil.
// If HaveNew is true, there is a new value that needs to be 
//   assigned into the variable. This value might be nil.
// If CrashIfDeallocating is true, the process is halted if newObj is 
//   deallocating or newObj's class does not support weak references. 
//   If CrashIfDeallocating is false, nil is stored instead.
enum CrashIfDeallocating {
    DontCrashIfDeallocating = false, DoCrashIfDeallocating = true
};
template <HaveOld haveOld, HaveNew haveNew,
          CrashIfDeallocating crashIfDeallocating>
static id 
storeWeak(id *location, objc_object *newObj)
{
    assert(haveOld  ||  haveNew);
    if (!haveNew) assert(newObj == nil);

    Class previouslyInitializedClass = nil;
    id oldObj;
    SideTable *oldTable;
    SideTable *newTable;

    // Acquire locks for old and new values.
    // Order by lock address to prevent lock ordering problems. 
    // Retry if the old value changes underneath us.
 retry:
    if (haveOld) {
        oldObj = *location;
        oldTable = &SideTables()[oldObj];
    } else {
        oldTable = nil;
    }
    if (haveNew) {
        newTable = &SideTables()[newObj];
    } else {
        newTable = nil;
    }

    SideTable::lockTwo<haveOld, haveNew>(oldTable, newTable);

    if (haveOld  &&  *location != oldObj) {
        SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);
        goto retry;
    }

    // Prevent a deadlock between the weak reference machinery
    // and the +initialize machinery by ensuring that no 
    // weakly-referenced object has an un-+initialized isa.
    if (haveNew  &&  newObj) {
        Class cls = newObj->getIsa();
        if (cls != previouslyInitializedClass  &&  
            !((objc_class *)cls)->isInitialized()) 
        {
            SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);
            _class_initialize(_class_getNonMetaClass(cls, (id)newObj));

            // If this class is finished with +initialize then we're good.
            // If this class is still running +initialize on this thread 
            // (i.e. +initialize called storeWeak on an instance of itself)
            // then we may proceed but it will appear initializing and 
            // not yet initialized to the check above.
            // Instead set previouslyInitializedClass to recognize it on retry.
            previouslyInitializedClass = cls;

            goto retry;
        }
    }

    // Clean up old value, if any.
    if (haveOld) {
        weak_unregister_no_lock(&oldTable->weak_table, oldObj, location);
    }

    // Assign new value, if any.
    if (haveNew) {
        newObj = (objc_object *)
            weak_register_no_lock(&newTable->weak_table, (id)newObj, location, 
                                  crashIfDeallocating);
        // weak_register_no_lock returns nil if weak store should be rejected

        // Set is-weakly-referenced bit in refcount table.
        if (newObj  &&  !newObj->isTaggedPointer()) {
            newObj->setWeaklyReferenced_nolock();
        }

        // Do not set *location anywhere else. That would introduce a race.
        *location = (id)newObj;
    }
    else {
        // No new value. The storage is not changed.
    }
    
    SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);

    return (id)newObj;
}

5.3 objc_storeStrong導(dǎo)致的retain

上面第5.1節(jié)中有一個objc_storeStrong闺阱，這里繼續(xù)分析它的原理。

NSObject.mm
objc_storeStrong(id *location, id obj)

void
objc_storeStrong(id *location, id obj)
{
    id prev = *location;
    if (obj == prev) {
        return;
    }
    objc_retain(obj);
    *location = obj;
    objc_release(prev);
}

NSObject.mm
objc_retain(id obj)

/***********************************************************************
* Optimized retain/release/autorelease entrypoints
**********************************************************************/


#if __OBJC2__

__attribute__((aligned(16)))
id 
objc_retain(id obj)
{
    if (!obj) return obj;
    if (obj->isTaggedPointer()) return obj;
    return obj->retain();
}


__attribute__((aligned(16)))
void 
objc_release(id obj)
{
    if (!obj) return;
    if (obj->isTaggedPointer()) return;
    return obj->release();
}


__attribute__((aligned(16)))
id
objc_autorelease(id obj)
{
    if (!obj) return obj;
    if (obj->isTaggedPointer()) return obj;
    return obj->autorelease();
}


// OBJC2
#else
// not OBJC2


id objc_retain(id obj) { return [obj retain]; }
void objc_release(id obj) { [obj release]; }
id objc_autorelease(id obj) { return [obj autorelease]; }


#endif

可知：
1）如果TaggedPointer，則返回本身悲伶。
2）如果非TaggedPointer舆声，則由對象的retain()返回主穗。

objc-object.h
objc_object::retain()

// Equivalent to calling [this retain], with shortcuts if there is no override
inline id 
objc_object::retain()
{
    assert(!isTaggedPointer());

    if (fastpath(!ISA()->hasCustomRR())) {
        return rootRetain();
    }

    return ((id(*)(objc_object *, SEL))objc_msgSend)(this, SEL_retain);
}

objc-object.h
objc_object::rootRetain()

// Base retain implementation, ignoring overrides.
// This does not check isa.fast_rr; if there is an RR override then 
// it was already called and it chose to call [super retain].
//
// tryRetain=true is the -_tryRetain path.
// handleOverflow=false is the frameless fast path.
// handleOverflow=true is the framed slow path including overflow to side table
// The code is structured this way to prevent duplication.

ALWAYS_INLINE id 
objc_object::rootRetain()
{
    return rootRetain(false, false);
}

這里的rootRetain(false, false);正是上文第2.2節(jié)中介紹的，不再贅述晦雨。

6. 新建對象（分配內(nèi)存與初始化）導(dǎo)致的引用計數(shù)變化 -- alloc 和 init 操作

首先，新建一個對象的典型寫法：

NSObject *obj = [NSObject alloc] init];

6.1 分配內(nèi)存 -- alloc

+ (id)alloc {
    return _objc_rootAlloc(self);
}

// Base class implementation of +alloc. cls is not nil.
// Calls [cls allocWithZone:nil].
id
_objc_rootAlloc(Class cls)
{
    return callAlloc(cls, false/*checkNil*/, true/*allocWithZone*/);
}

// Call [cls alloc] or [cls allocWithZone:nil], with appropriate 
// shortcutting optimizations.
static ALWAYS_INLINE id
callAlloc(Class cls, bool checkNil, bool allocWithZone=false)
{
    if (slowpath(checkNil && !cls)) return nil;

#if __OBJC2__
    if (fastpath(!cls->ISA()->hasCustomAWZ())) {
        // No alloc/allocWithZone implementation. Go straight to the allocator.
        // fixme store hasCustomAWZ in the non-meta class and 
        // add it to canAllocFast's summary
        if (fastpath(cls->canAllocFast())) {
            // No ctors, raw isa, etc. Go straight to the metal.
            bool dtor = cls->hasCxxDtor();
            id obj = (id)calloc(1, cls->bits.fastInstanceSize());
            if (slowpath(!obj)) return callBadAllocHandler(cls);
            obj->initInstanceIsa(cls, dtor);
            return obj;
        }
        else {
            // Has ctor or raw isa or something. Use the slower path.
            id obj = class_createInstance(cls, 0);
            if (slowpath(!obj)) return callBadAllocHandler(cls);
            return obj;
        }
    }
#endif

    // No shortcuts available.
    if (allocWithZone) return [cls allocWithZone:nil];
    return [cls alloc];
}

分支1 -- obj->initInstanceIsa(cls, dtor);

inline void 
objc_object::initInstanceIsa(Class cls, bool hasCxxDtor)
{
    assert(!cls->instancesRequireRawIsa());
    assert(hasCxxDtor == cls->hasCxxDtor());

    initIsa(cls, true, hasCxxDtor);
}

inline void 
objc_object::initIsa(Class cls, bool nonpointer, bool hasCxxDtor) 
{ 
    assert(!isTaggedPointer()); 
    
    if (!nonpointer) {
        isa.cls = cls;
    } else {
        assert(!DisableNonpointerIsa);
        assert(!cls->instancesRequireRawIsa());

        isa_t newisa(0);

#if SUPPORT_INDEXED_ISA
        assert(cls->classArrayIndex() > 0);
        newisa.bits = ISA_INDEX_MAGIC_VALUE;
        // isa.magic is part of ISA_MAGIC_VALUE
        // isa.nonpointer is part of ISA_MAGIC_VALUE
        newisa.has_cxx_dtor = hasCxxDtor;
        newisa.indexcls = (uintptr_t)cls->classArrayIndex();
#else
        newisa.bits = ISA_MAGIC_VALUE;
        // isa.magic is part of ISA_MAGIC_VALUE
        // isa.nonpointer is part of ISA_MAGIC_VALUE
        newisa.has_cxx_dtor = hasCxxDtor;
        newisa.shiftcls = (uintptr_t)cls >> 3;
#endif

        // This write must be performed in a single store in some cases
        // (for example when realizing a class because other threads
        // may simultaneously try to use the class).
        // fixme use atomics here to guarantee single-store and to
        // guarantee memory order w.r.t. the class index table
        // ...but not too atomic because we don't want to hurt instantiation
        isa = newisa;
    }
}

上述代碼中，newisa.bits = ISA_MAGIC_VALUE; 是為了對 isa 結(jié)構(gòu)賦值一個初始值，通過對 isa_t 的結(jié)構(gòu)分析，我們可以知道此次賦值只是對 nonpointer 和 magic 部分進(jìn)行了賦值。

newisa.shiftcls = (uintptr_t)cls >> 3; 是將類的地址存儲在對象的 isa 結(jié)構(gòu)中。這里右移三位的主要原因是用于將 Class 指針中無用的后三位清除減小內(nèi)存的消耗，因為類的指針要按照字節(jié)（8 bits）對齊內(nèi)存旭咽，其指針后三位都是沒有意義的 0。關(guān)于類指針對齊的詳細(xì)解析可參考：從 NSObject 的初始化了解 isa 轿塔。

分支2 -- id obj = class_createInstance(cls, 0);

id 
class_createInstance(Class cls, size_t extraBytes)
{
    return _class_createInstanceFromZone(cls, extraBytes, nil);
}

/***********************************************************************
* class_createInstance
* fixme
* Locking: none
**********************************************************************/

static __attribute__((always_inline)) 
id
_class_createInstanceFromZone(Class cls, size_t extraBytes, void *zone, 
                              bool cxxConstruct = true, 
                              size_t *outAllocatedSize = nil)
{
    if (!cls) return nil;

    assert(cls->isRealized());

    // Read class's info bits all at once for performance
    bool hasCxxCtor = cls->hasCxxCtor();
    bool hasCxxDtor = cls->hasCxxDtor();
    bool fast = cls->canAllocNonpointer();

    size_t size = cls->instanceSize(extraBytes);
    if (outAllocatedSize) *outAllocatedSize = size;

    id obj;
    if (!zone  &&  fast) {
        obj = (id)calloc(1, size);
        if (!obj) return nil;
        obj->initInstanceIsa(cls, hasCxxDtor);
    } 
    else {
        if (zone) {
            obj = (id)malloc_zone_calloc ((malloc_zone_t *)zone, 1, size);
        } else {
            obj = (id)calloc(1, size);
        }
        if (!obj) return nil;

        // Use raw pointer isa on the assumption that they might be 
        // doing something weird with the zone or RR.
        obj->initIsa(cls);
    }

    if (cxxConstruct && hasCxxCtor) {
        obj = _objc_constructOrFree(obj, cls);
    }

    return obj;
}

其中仲墨，有個 obj->initIsa(cls);勾缭，初始化isa的操作：

inline void 
objc_object::initIsa(Class cls, bool nonpointer, bool hasCxxDtor) 
{ 
    assert(!isTaggedPointer()); 
    
    if (!nonpointer) {
        isa.cls = cls;
    } else {
        assert(!DisableNonpointerIsa);
        assert(!cls->instancesRequireRawIsa());

        isa_t newisa(0);

#if SUPPORT_INDEXED_ISA
        assert(cls->classArrayIndex() > 0);
        newisa.bits = ISA_INDEX_MAGIC_VALUE;
        // isa.magic is part of ISA_MAGIC_VALUE
        // isa.nonpointer is part of ISA_MAGIC_VALUE
        newisa.has_cxx_dtor = hasCxxDtor;
        newisa.indexcls = (uintptr_t)cls->classArrayIndex();
#else
        newisa.bits = ISA_MAGIC_VALUE;
        // isa.magic is part of ISA_MAGIC_VALUE
        // isa.nonpointer is part of ISA_MAGIC_VALUE
        newisa.has_cxx_dtor = hasCxxDtor;
        newisa.shiftcls = (uintptr_t)cls >> 3;
#endif

        // This write must be performed in a single store in some cases
        // (for example when realizing a class because other threads
        // may simultaneously try to use the class).
        // fixme use atomics here to guarantee single-store and to
        // guarantee memory order w.r.t. the class index table
        // ...but not too atomic because we don't want to hurt instantiation
        isa = newisa;
    }
}

可見目养，alloc的時候會初始化isa，并通過newisa(0)的初始化列表辦法生成一個isa，并根據(jù)是否支持indexed isa分別設(shè)置.bits的值煞躬。

6.2 初始化 -- init

- (id)init {
    return _objc_rootInit(self);
}

id
_objc_rootInit(id obj)
{
    // In practice, it will be hard to rely on this function.
    // Many classes do not properly chain -init calls.
    return obj;
}

7. 獲取引用計數(shù)

NSObject.mm
retainCount

- (NSUInteger)retainCount {
    return ((id)self)->rootRetainCount();
}

objc-object.h
objc_object::rootRetainCount()

inline uintptr_t 
objc_object::rootRetainCount()
{
    if (isTaggedPointer()) return (uintptr_t)this;

    sidetable_lock();
    isa_t bits = LoadExclusive(&isa.bits);
    ClearExclusive(&isa.bits);
    if (bits.nonpointer) {
        uintptr_t rc = 1 + bits.extra_rc;
        if (bits.has_sidetable_rc) {
            rc += sidetable_getExtraRC_nolock();
        }
        sidetable_unlock();
        return rc;
    }

    sidetable_unlock();
    return sidetable_retainCount();
}

可見汰翠，獲取引用計數(shù)的關(guān)鍵在這么一句話：

uintptr_t rc = 1 + bits.extra_rc;

bits.extra_rc表示引用計數(shù)減1。當(dāng)然昭雌，這只針對情況1复唤，即bits.nonpointer為1（開啟了指針優(yōu)化），且bits.has_sidetable_rc為0（表示不存儲在散列表Side Table中烛卧，而存儲在extra_rc中）佛纫。

• 情況0 -- TaggedPointer

直接返回isa值本身。

• 情況1 -- 非TaggedPointer总放，開啟了指針優(yōu)化呈宇，且存儲在extra_rc中

objc-os.h
LoadExclusive(uintptr_t *src)

static ALWAYS_INLINE
uintptr_t 
LoadExclusive(uintptr_t *src)
{
    return *src;
}

• 情況2 -- 非TaggedPointer，開啟指針優(yōu)化局雄，且存儲在散列表中

NSObject.mm
objc_object::sidetable_getExtraRC_nolock()

size_t 
objc_object::sidetable_getExtraRC_nolock()
{
    assert(isa.nonpointer);
    SideTable& table = SideTables()[this];
    RefcountMap::iterator it = table.refcnts.find(this);
    if (it == table.refcnts.end()) return 0;
    else return it->second >> SIDE_TABLE_RC_SHIFT;
}

可見甥啄，其邏輯就是先從 SideTable 的靜態(tài)方法獲取當(dāng)前實例對應(yīng)的 SideTable 對象，其 refcnts 屬性就是之前說的存儲引用計數(shù)的散列表炬搭，這里將其類型簡寫為 RefcountMap：

typedef objc::DenseMap RefcountMap;

然后在引用計數(shù)表中用迭代器查找當(dāng)前實例對應(yīng)的鍵值對蜈漓，獲取引用計數(shù)值穆桂，并在此基礎(chǔ)上 +1 并將結(jié)果返回。這也就是為什么之前說引用計數(shù)表存儲的值為實際引用計數(shù)減一融虽。

需要注意的是為什么這里把鍵值對的值做了向右移位操作（it->second >> SIDE_TABLE_RC_SHIFT）:

// The order of these bits is important.
#define SIDE_TABLE_WEAKLY_REFERENCED (1UL<<0)
#define SIDE_TABLE_DEALLOCATING      (1UL<<1)  // MSB-ward of weak bit
#define SIDE_TABLE_RC_ONE            (1UL<<2)  // MSB-ward of deallocating bit
#define SIDE_TABLE_RC_PINNED         (1UL<<(WORD_BITS-1))

#define SIDE_TABLE_RC_SHIFT 2
#define SIDE_TABLE_FLAG_MASK (SIDE_TABLE_RC_ONE-1)

可以看出值的第一個 bit 表示該對象是否有過 weak 對象享完，如果沒有，在析構(gòu)釋放內(nèi)存時可以更快有额；第二個 bit 表示該對象是否正在析構(gòu)般又。從第三個 bit 開始才是存儲引用計數(shù)數(shù)值的地方。所以這里要做向右移兩位的操作巍佑，而對引用計數(shù)的 +1 和 -1 可以使用 SIDE_TABLE_RC_ONE茴迁，還可以用 SIDE_TABLE_RC_PINNED 來判斷是否引用計數(shù)值有可能溢出。

• 情況3 -- 默認(rèn)值 -- 非TaggedPointer萤衰，沒有開啟指針優(yōu)化

NSObject.mm
objc_object::sidetable_retainCount()

uintptr_t
objc_object::sidetable_retainCount()
{
    SideTable& table = SideTables()[this];

    size_t refcnt_result = 1;
    
    table.lock();
    RefcountMap::iterator it = table.refcnts.find(this);
    if (it != table.refcnts.end()) {
        // this is valid for SIDE_TABLE_RC_PINNED too
        refcnt_result += it->second >> SIDE_TABLE_RC_SHIFT;
    }
    table.unlock();
    return refcnt_result;
}

8. 結(jié)論

1. 如果有些對象支持使用 TaggedPointer：

• 蘋果會直接將對象的指針值作為引用計數(shù)返回堕义。

2. 如果另外一些對象不支持使用 TaggedPointer：

• 如果當(dāng)前設(shè)備是 64 位環(huán)境并且使用 Objective-C 2.0，那么會使用對象的 isa 指針 的 一部分空間 （bits.extra_rc）來存儲它的引用計數(shù)腻菇；
• 否則 Runtime 會使用一張 散列表 （SideTables()）來管理引用計數(shù)胳螟。

9. 拓展閱讀

weak表

http://www.reibang.com/p/13c4fb1cedea