iOS底层原理(五)Runtime(上)

什么是Runtime

Objective-C是一门动态性比较强的编程语言,跟C、C++等语言有着很大的不同;Objective-C的动态性是由Runtime API来支撑的

Runtime API提供的接口基本都是C语言的,源码由C\C++\汇编语言编写

方法类型的底层结构

Class对象的底层结构objc_class中,我们知道通过bits & FAST_DATA_MASK就可以得到class_rw_t类型的表结构

class_rw_t里面的methods、properties、protocols都是二维数组,是可读可写的,包含了类的初始内容、分类的内容

method_array_t举例,里面的元素都是method_list_t类型的二维数组,每一个二维数组又是method_t类型的元素,表示每一个方法类型

class method_array_t : 
    public list_array_tt<method_t, method_list_t, method_list_t_authed_ptr>
{
    typedef list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> Super;

 public:
    method_array_t() : Super() { }
    method_array_t(method_list_t *l) : Super(l) { }

    ....
};

class_ro_t里面的baseMethodList、baseProtocols、ivars、baseProperties是一维数组,是只读的,包含了类的初始内容

objc源码里的头文件objc-runtime-new.mm,通过查看函数realizeClassWithoutSwift的实现,程序运行时会将class_ro_t里面的数据和分类里面的数据信息全部合并到一起放到class_rw_t里面来

static Class realizeClassWithoutSwift(Class cls, Class previously)
{
    ....
    
    auto ro = (const class_ro_t *)cls->data();
    auto isMeta = ro->flags & RO_META;
    if (ro->flags & RO_FUTURE) {
        // This was a future class. rw data is already allocated.
        rw = cls->data();
        ro = cls->data()->ro();
        ASSERT(!isMeta);
        cls->changeInfo(RW_REALIZED|RW_REALIZING, RW_FUTURE);
    } else {
        // 分配内存空间,将ro的数据放到rw
        rw = objc::zalloc<class_rw_t>();
        rw->set_ro(ro);
        rw->flags = RW_REALIZED|RW_REALIZING|isMeta;
        cls->setData(rw);
    }

    cls->cache.initializeToEmptyOrPreoptimizedInDisguise();

	....	
}

method_t

method_t是对方法\函数的封装,里面包含了函数名,编码信息以及函数地址

struct method_t {
    static const uint32_t smallMethodListFlag = 0x80000000;

    method_t(const method_t &other) = delete;

    struct big {
        SEL name; // 函数名
        const char *types; // 编码(返回值类型、参数类型)
        MethodListIMP imp; // 指向函数的指针
    };
}

IMP代表函数的具体实现,指向着该函数的地址

typedef id _Nullable (*IMP)(id _Nonnull, SEL _Nonnull, ...); 

SEL代表方法\函数名,一般叫做选择器,底层结构跟char *类似,可以通过@selector()sel_registerName()获得

typedef struct objc_selector *SEL;

不同类中相同名字的方法,所对应的方法选择器是相同的,可以通过sel_getName()NSStringFromSelector()转成字符串

types包含了函数返回值、参数编码的字符串,排列顺序如下

iOS中提供了一个叫做@encode的指令,可以将具体的类型表示成字符串编码

一个函数默认会带有两个参数id _NonnullSEL _Nonnull,之后才是写入的参数

下面举例说明,函数的types是多少

- (int)test:(int)age height:(float)height
{
    NSLog(@"%s", __func__);
    return 0;
}

// 该函数types为i24@0:8i16f20
// i 返回值int类型
// 24 几个返回值类型占据的大小总和(8 + 8 + 4 + 4)
// @ id类型
// 0 表示从第0位开始
// : SEL类型
// 8 从第8位开始
// i 参数int类型
// 16 从第16位开始
// f 参数float类型
// 20 从第20位开始

方法缓存

Class内部结构中有个方法缓存cache_t,用散列表(哈希表)来缓存曾经调用过的方法,可以提高方法的查找速度

struct cache_t {
private:
	explicit_atomic<uintptr_t> _bucketsAndMaybeMask;
	union {
	   struct {
	       explicit_atomic<mask_t>    _maybeMask; // 散列表的长度 - 1
	#if __LP64__
	       uint16_t                   _flags;
	#endif
	       uint16_t                   _occupied; // 已经缓存的方法数量
	   };
	   explicit_atomic<preopt_cache_t *> _originalPreoptCache;
	};
	
	....
	
	mask_t mask() const; 
	
public:
    unsigned capacity() const;
    struct bucket_t *buckets() const; // 散列表
    Class cls() const;
    
    ....
}

散列表bucket_t内部有SEL作为key函数地址IMP一一对应

struct bucket_t {
private:
    // IMP-first is better for arm64e ptrauth and no worse for arm64.
    // SEL-first is better for armv7* and i386 and x86_64.
#if __arm64__
    explicit_atomic<uintptr_t> _imp; // 函数的内存地址
    explicit_atomic<SEL> _sel; // sel为key
#else
    explicit_atomic<SEL> _sel;
    explicit_atomic<uintptr_t> _imp;
#endif

	....
}

objc-cache.mm文件里可以查看 cache_t::insert函数,是通过一套哈希算法计算出索引,然后根据索引在散列表数组里直接插入数据进行缓存

void cache_t::insert(SEL sel, IMP imp, id receiver) {

    ....
    
    mask_t newOccupied = occupied() + 1;
    unsigned oldCapacity = capacity(), capacity = oldCapacity;
    if (slowpath(isConstantEmptyCache())) {
        // Cache is read-only. Replace it.
        if (!capacity) capacity = INIT_CACHE_SIZE;
        reallocate(oldCapacity, capacity, /* freeOld */false);
    }
    else if (fastpath(newOccupied + CACHE_END_MARKER <= cache_fill_ratio(capacity))) {
        // Cache is less than 3/4 or 7/8 full. Use it as-is.
    }
#if CACHE_ALLOW_FULL_UTILIZATION
    else if (capacity <= FULL_UTILIZATION_CACHE_SIZE && newOccupied + CACHE_END_MARKER <= capacity) {
        // Allow 100% cache utilization for small buckets. Use it as-is.
    }
#endif
    else {
        // 如果空间已满,那么就进行扩容,乘以2倍
        capacity = capacity ? capacity * 2 : INIT_CACHE_SIZE;
        if (capacity > MAX_CACHE_SIZE) {
            capacity = MAX_CACHE_SIZE;
        }
        
        // 将旧的缓存释放,清空缓存,然后设置最新的mask值
        reallocate(oldCapacity, capacity, true);
    }

    bucket_t *b = buckets();
    mask_t m = capacity - 1;
    
    // 通过 sel&mask 计算出索引(哈希算法)
    mask_t begin = cache_hash(sel, m);
    mask_t i = begin;

    do {
        // 通过索引找到的该SEL为空,那么就插入bucket_t
        if (fastpath(b[i].sel() == 0)) {
            incrementOccupied();
            b[i].set<Atomic, Encoded>(b, sel, imp, cls());
            return;
        }
        
        // 用索引从bucket里面取sel和传进来的sel做比较,如果一样证明已经存有,直接返回
        if (b[i].sel() == sel) {
            return;
        }
        
        // 从散列表里查找,如果上述条件不成立(索引冲突),那么通过cache_next计算出新的索引再查找插入
    } while (fastpath((i = cache_next(i, m)) != begin));

    bad_cache(receiver, (SEL)sel);
#endif // !DEBUG_TASK_THREADS
}

下面是cache_t::insert的一些详细调用解析

当存储空间已满时,会进行扩容,并且将旧的缓存全部释放清空,然后设置最新的mask值mask值是散列表的存储容量-1,也正好对应散列表的索引值

void cache_t::reallocate(mask_t oldCapacity, mask_t newCapacity, bool freeOld) {
    bucket_t *oldBuckets = buckets();
    bucket_t *newBuckets = allocateBuckets(newCapacity);

    ASSERT(newCapacity > 0);
    ASSERT((uintptr_t)(mask_t)(newCapacity-1) == newCapacity-1);

    setBucketsAndMask(newBuckets, newCapacity - 1);
   
    // 将旧的缓存和mask释放
    if (freeOld) {
        collect_free(oldBuckets, oldCapacity);
    }
}

cache_hash的哈希算法就是将mask进行一次位运算,所得的索引值只会小于等于mask值

static inline mask_t cache_hash(SEL sel, mask_t mask) {
    uintptr_t value = (uintptr_t)sel;
#if CONFIG_USE_PREOPT_CACHES
    value ^= value >> 7;
#endif
    return (mask_t)(value & mask);
}

如果计算出的索引在散列表中已经有了缓存数据,那么就通过cache_next更新下索引值,再去对应的位置插入缓存数据

通过源码可以看到计算方式如下:

有冲突的索引如果不为0就直接索引值减1,然后再根据新的索引值去散列表中对应插入

如果冲突的索引为0,那么直接就将mask赋值给新的索引值,再去对应查找插入

#if CACHE_END_MARKER
static inline mask_t cache_next(mask_t i, mask_t mask) {
    return (i+1) & mask;
}
#elif __arm64__
// arm64架构下如果索引非0,就是i-1,索引为0返回mask
static inline mask_t cache_next(mask_t i, mask_t mask) {
    return i ? i-1 : mask;
}

缓存的数据在散列表中都对应着一定的空间,所以这套查找算法就是利用了空间换时间,来增加效率

方法调用的底层结构

我们先将下面的代码通过Clang的命令生成C++代码,如下所示

@interface Person : NSObject

- (void)test;
+ (void)test;
@end

@implementation Person

- (void)test
{
    NSLog(@"%s", __func__);
}

+ (void)test
{
    NSLog(@"%s", __func__);
}
@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
    	Person *person = [[Person alloc] init];

     	[person test];
		[Person test];
    }
    return 0;
}

// 转换成C++文件后的两个调用方法为:
((void (*)(id, SEL))(void *)objc_msgSend)((id)person, sel_registerName("test"));
((void (*)(id, SEL))(void *)objc_msgSend)((id)objc_getClass("Person"), sel_registerName("test"));

发现函数调用最后都是转化为objc_msgSend,尤其我们可以推断出方法的调用本质就是objc_msgSend消息发送

由于sel_registerName@selector返回值都是SEL,我们通过打印两个方法的地址是一样的,可以确定两个方法是可以等同的

NSLog(@"%p, %p", @selector(test), sel_registerName("test"));
// 打印结果都是0x100003f66

我们对两个C++函数简化之后,就得到以下两个方法

objc_msgSend(person, @selector(test));
// 消息接收者(receiver):person
// 消息名称:test

objc_msgSend([Person class], @selector(test));
// 消息接收者(receiver):[Person class]
// 消息名称:test

而且第一个参数分别可以写为person[Person class],也可以称为消息的接收者

第二个参数都是testSEL就是消息的名称

方法调用的执行流程

objc_msgSend的执行流程可以分为3大阶段

  • 消息发送
  • 动态方法解析
  • 消息转发

消息发送

我们在objc源码里全局搜索关键字objc_msgSend可以发现,消息发送的入口一开始是在objc-msg-arm64.s中通过汇编来实现第一步的

下面我们开始分析源码

【第一步】 这里主要就是判断receiver是否有值,然后对应的跳转,isa指针ISA_MASK进行位运算获取到Class数据,并且要先去查找是否有缓存方法,如果没有则要去更深的Class数据中查找了

// MARK: _objc_msgSend的实现:汇编入口(ENTRY是入口的意思)
	ENTRY _objc_msgSend
    // 无窗口
	UNWIND _objc_msgSend, NoFrame
    
    // p0寄存器里存储的值(也就是参数receiver)和0做对比(cmp是比较的意思)
	cmp	p0, #0               // nil check and tagged pointer check
// 支持TAGGED_POINTERS的流程
#if SUPPORT_TAGGED_POINTERS
    // 如果小于等于0,则跳转LNilOrTagged
	b.le	LNilOrTagged     //  (MSB tagged pointer looks negative)
#else
    // 如果等于0,则跳转LReturnZero
	b.eq	LReturnZero
#endif
    // 根据对象拿出isa ,即从x0寄存器指向的地址 取出 isa,存入 p13寄存器
	ldr	p13, [x0]		// p13 = isa
    // 在64位架构下通过 p16 = isa(p13) & ISA_MASK,拿出shiftcls信息,得到class信息
	GetClassFromIsa_p16 p13, 1, x0	// p16 = class
LGetIsaDone:
	// calls imp or objc_msgSend_uncached
    // 如果从缓存中找不到,则跳转__objc_msgSend_uncached
	CacheLookup NORMAL, _objc_msgSend, __objc_msgSend_uncached

#if SUPPORT_TAGGED_POINTERS
LNilOrTagged:
    // 如果等于0,则跳转LReturnZero
	b.eq	LReturnZero  // nil check
	GetTaggedClass
	b	LGetIsaDone
// SUPPORT_TAGGED_POINTERS
#endif

LReturnZero:
    // 下面几个寄存器都归零
	// x0 is already zero
	mov	x1, #0
	movi	d0, #0
	movi	d1, #0
	movi	d2, #0
	movi	d3, #0
	ret

	END_ENTRY _objc_msgSend


	ENTRY _objc_msgLookup
	UNWIND _objc_msgLookup, NoFrame
	cmp	p0, #0			// nil check and tagged pointer check
#if SUPPORT_TAGGED_POINTERS
	b.le	LLookup_NilOrTagged	//  (MSB tagged pointer looks negative)
#else
	b.eq	LLookup_Nil
#endif
	ldr	p13, [x0]		// p13 = isa
	GetClassFromIsa_p16 p13, 1, x0	// p16 = class
LLookup_GetIsaDone:
	// returns imp
	CacheLookup LOOKUP, _objc_msgLookup, __objc_msgLookup_uncached

#if SUPPORT_TAGGED_POINTERS
LLookup_NilOrTagged:
	b.eq	LLookup_Nil	// nil check
	GetTaggedClass
	b	LLookup_GetIsaDone
// SUPPORT_TAGGED_POINTERS
#endif

LLookup_Nil:
	adr	x17, __objc_msgNil
	SignAsImp x17
	ret

	END_ENTRY _objc_msgLookup

	
	STATIC_ENTRY __objc_msgNil

	// x0 is already zero
	mov	x1, #0
	movi	d0, #0
	movi	d1, #0
	movi	d2, #0
	movi	d3, #0
	ret
	
	END_ENTRY __objc_msgNil


	ENTRY _objc_msgSendSuper
	UNWIND _objc_msgSendSuper, NoFrame

	ldp	p0, p16, [x0]		// p0 = real receiver, p16 = class
	b L_objc_msgSendSuper2_body

	END_ENTRY _objc_msgSendSuper

下面是_objc_msgSend的一些详细调用解析

GetClassFromIsa_p16里是isa指针进行&ISA_MASK的运算过程

// MARK: GetClassFromIsa_p16
// 宏
.macro GetClassFromIsa_p16 src, needs_auth, auth_address /* note: auth_address is not required if !needs_auth */

#if SUPPORT_INDEXED_ISA
	// 将isa的值存入p16寄存器
	mov	p16, \src			// optimistically set dst = src
	tbz	p16, #ISA_INDEX_IS_NPI_BIT, 1f	// done if not non-pointer isa
	// isa in p16 is indexed
    // 将_objc_indexed_classes所在的页的基址 读入x10寄存器
	adrp	x10, _objc_indexed_classes@PAGE
    // x10 = x10 + _objc_indexed_classes(page中的偏移量)(x10基址 根据 偏移量 进行 内存偏移)
	add	x10, x10, _objc_indexed_classes@PAGEOFF
    // 从p16的第ISA_INDEX_SHIFT位开始,提取 ISA_INDEX_BITS 位 到 p16寄存器,剩余的高位用0补充
	ubfx	p16, p16, #ISA_INDEX_SHIFT, #ISA_INDEX_BITS  // extract index
	ldr	p16, [x10, p16, UXTP #PTRSHIFT]	// load class from array
1:

#elif __LP64__
.if \needs_auth == 0 // _cache_getImp takes an authed class already
	mov	p16, \src
.else
	// 64-bit packed isa
	ExtractISA p16, \src, \auth_address
.endif
#else
	// 32-bit raw isa
	mov	p16, \src

#endif

.endmacro

CacheLookup里进行缓存查找的过程,主要就是SEL & MASK得出一个索引,根据索引去buckets散列表中取对应的方法数据

// MARK: CacheLookup
.macro CacheLookup Mode, Function, MissLabelDynamic, MissLabelConstant
	//
	// Restart protocol:
	//
	//   As soon as we're past the LLookupStart\Function label we may have
	//   loaded an invalid cache pointer or mask.
	//
	//   When task_restartable_ranges_synchronize() is called,
	//   (or when a signal hits us) before we're past LLookupEnd\Function,
	//   then our PC will be reset to LLookupRecover\Function which forcefully
	//   jumps to the cache-miss codepath which have the following
	//   requirements:
	//
	//   GETIMP:
	//     The cache-miss is just returning NULL (setting x0 to 0)
	//
	//   NORMAL and LOOKUP:
	//   - x0 contains the receiver
	//   - x1 contains the selector
	//   - x16 contains the isa
	//   - other registers are set as per calling conventions
	//

	mov	x15, x16			// stash the original isa
LLookupStart\Function:
	// p1 = SEL, p16 = isa
    // mac os或者模拟器
#if CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16_BIG_ADDRS
	ldr	p10, [x16, #CACHE]  // p10 = mask|buckets
	lsr	p11, p10, #48  // p11 = mask
	and	p10, p10, #0xffffffffffff	// p10 = buckets
	and	w12, w1, w11			// x12 = _cmd & mask

// 64位真机
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16
    // 从x16(即isa)中取出cache 存入p11寄存器
	ldr	p11, [x16, #CACHE]			// p11 = mask|buckets
#if CONFIG_USE_PREOPT_CACHES

// 下面几个是通过位运算& mask得出索引存入p12
#if __has_feature(ptrauth_calls)
	tbnz	p11, #0, LLookupPreopt\Function
	and	p10, p11, #0x0000ffffffffffff	// p10 = buckets
#else
	and	p10, p11, #0x0000fffffffffffe	// p10 = buckets
	tbnz	p11, #0, LLookupPreopt\Function
#endif
	eor	p12, p1, p1, LSR #7
	and	p12, p12, p11, LSR #48		// x12 = (_cmd ^ (_cmd >> 7)) & mask
#else
	and	p10, p11, #0x0000ffffffffffff	// p10 = buckets
	and	p12, p1, p11, LSR #48		// x12 = _cmd & mask
#endif // CONFIG_USE_PREOPT_CACHES

// 非64位真机
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_LOW_4
	ldr	p11, [x16, #CACHE]				// p11 = mask|buckets
	and	p10, p11, #~0xf			// p10 = buckets
	and	p11, p11, #0xf			// p11 = maskShift
	mov	p12, #0xffff
	lsr	p11, p12, p11			// p11 = mask = 0xffff >> p11
	and	p12, p1, p11			// x12 = _cmd & mask
#else
#error Unsupported cache mask storage for ARM64.
#endif

    // #define PTRSHIFT 3
    // LSL #(1+PTRSHIFT)-- 实际含义就是得到一个bucket占用的内存大小
	add	p13, p10, p12, LSL #(1+PTRSHIFT)
						// p13 = buckets + ((_cmd & mask) << (1+PTRSHIFT))

						// do {
// 从x13(即p13)中取出 bucket 分别将imp和sel 存入 p17(存储imp) 和 p9(存储sel)
1:	ldp	p17, p9, [x13], #-BUCKET_SIZE	//     {imp, sel} = *bucket--

    // 比较 sel 与 p1(传入的参数cmd)
	cmp	p9, p1				//     if (sel != _cmd) {
    // ne == not equal,请跳转至 3f
	b.ne	3f				//         scan more
						//     } else {
    // 如果相等 即CacheHit 缓存命中,直接返回imp
2:	CacheHit \Mode				// hit:    call or return imp
						//     }
3:	cbz	p9, \MissLabelDynamic		//     if (sel == 0) goto Miss;
	cmp	p13, p10			// } while (bucket >= buckets)
	b.hs	1b

	// wrap-around:
	//   p10 = first bucket
	//   p11 = mask (and maybe other bits on LP64)
	//   p12 = _cmd & mask
	//
	// A full cache can happen with CACHE_ALLOW_FULL_UTILIZATION.
	// So stop when we circle back to the first probed bucket
	// rather than when hitting the first bucket again.
	//
	// Note that we might probe the initial bucket twice
	// when the first probed slot is the last entry.


#if CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16_BIG_ADDRS
	add	p13, p10, w11, UXTW #(1+PTRSHIFT)
						// p13 = buckets + (mask << 1+PTRSHIFT)
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_HIGH_16
	add	p13, p10, p11, LSR #(48 - (1+PTRSHIFT))
						// p13 = buckets + (mask << 1+PTRSHIFT)
						// see comment about maskZeroBits
#elif CACHE_MASK_STORAGE == CACHE_MASK_STORAGE_LOW_4
	add	p13, p10, p11, LSL #(1+PTRSHIFT)
						// p13 = buckets + (mask << 1+PTRSHIFT)
#else
#error Unsupported cache mask storage for ARM64.
#endif
	add	p12, p10, p12, LSL #(1+PTRSHIFT)
						// p12 = first probed bucket

						// do {
4:	ldp	p17, p9, [x13], #-BUCKET_SIZE	//     {imp, sel} = *bucket--
	cmp	p9, p1				//     if (sel == _cmd)
	b.eq	2b				//         goto hit
	cmp	p9, #0				// } while (sel != 0 &&
	ccmp	p13, p12, #0, ne		//     bucket > first_probed)
	b.hi	4b

LLookupEnd\Function:
LLookupRecover\Function:
	b	\MissLabelDynamic

#if CONFIG_USE_PREOPT_CACHES
#if CACHE_MASK_STORAGE != CACHE_MASK_STORAGE_HIGH_16
#error config unsupported
#endif
LLookupPreopt\Function:
#if __has_feature(ptrauth_calls)
	and	p10, p11, #0x007ffffffffffffe	// p10 = buckets
	autdb	x10, x16			// auth as early as possible
#endif

	// x12 = (_cmd - first_shared_cache_sel)
	adrp	x9, _MagicSelRef@PAGE
	ldr	p9, [x9, _MagicSelRef@PAGEOFF]
	sub	p12, p1, p9

	// w9  = ((_cmd - first_shared_cache_sel) >> hash_shift & hash_mask)
#if __has_feature(ptrauth_calls)
	// bits 63..60 of x11 are the number of bits in hash_mask
	// bits 59..55 of x11 is hash_shift

	lsr	x17, x11, #55			// w17 = (hash_shift, ...)
	lsr	w9, w12, w17			// >>= shift

	lsr	x17, x11, #60			// w17 = mask_bits
	mov	x11, #0x7fff
	lsr	x11, x11, x17			// p11 = mask (0x7fff >> mask_bits)
	and	x9, x9, x11			// &= mask
#else
	// bits 63..53 of x11 is hash_mask
	// bits 52..48 of x11 is hash_shift
	lsr	x17, x11, #48			// w17 = (hash_shift, hash_mask)
	lsr	w9, w12, w17			// >>= shift
	and	x9, x9, x11, LSR #53		// &=  mask
#endif

	ldr	x17, [x10, x9, LSL #3]		// x17 == sel_offs | (imp_offs << 32)
	cmp	x12, w17, uxtw

.if \Mode == GETIMP
	b.ne	\MissLabelConstant		// cache miss
	sub	x0, x16, x17, LSR #32		// imp = isa - imp_offs
	SignAsImp x0
	ret
.else
	b.ne	5f				// cache miss
	sub	x17, x16, x17, LSR #32		// imp = isa - imp_offs
.if \Mode == NORMAL
	br	x17
.elseif \Mode == LOOKUP
	orr x16, x16, #3 // for instrumentation, note that we hit a constant cache
	SignAsImp x17
	ret
.else
.abort  unhandled mode \Mode
.endif

5:	ldursw	x9, [x10, #-8]			// offset -8 is the fallback offset
	add	x16, x16, x9			// compute the fallback isa
	b	LLookupStart\Function		// lookup again with a new isa
.endif
#endif // CONFIG_USE_PREOPT_CACHES

.endmacro

【第二步】 上述一系列操作如果没有取到方法缓存,那么就会进到__objc_msgSend_uncached

// MARK: __objc_msgSend_uncached
STATIC_ENTRY __objc_msgSend_uncached
UNWIND __objc_msgSend_uncached, FrameWithNoSaves

// THIS IS NOT A CALLABLE C FUNCTION
// Out-of-band p15 is the class to search
    
// 跳转到MethodTableLookup
MethodTableLookup
TailCallFunctionPointer x17

END_ENTRY __objc_msgSend_uncached


STATIC_ENTRY __objc_msgLookup_uncached
UNWIND __objc_msgLookup_uncached, FrameWithNoSaves

// THIS IS NOT A CALLABLE C FUNCTION
// Out-of-band p15 is the class to search
	
MethodTableLookup
ret

END_ENTRY __objc_msgLookup_uncached


STATIC_ENTRY _cache_getImp

GetClassFromIsa_p16 p0, 0
CacheLookup GETIMP, _cache_getImp, LGetImpMissDynamic, LGetImpMissConstant

LGetImpMissDynamic:
mov	p0, #0
ret

LGetImpMissConstant:
mov	p0, p2
ret

END_ENTRY _cache_getImp

再进一步跳转到MethodTableLookup,发现最终会调用到C语言函数lookUpImpOrForward

// MARK: MethodTableLookup
.macro MethodTableLookup
	
	SAVE_REGS MSGSEND

	// lookUpImpOrForward(obj, sel, cls, LOOKUP_INITIALIZE | LOOKUP_RESOLVER)
	// receiver and selector already in x0 and x1
	mov	x2, x16
	mov	x3, #3
    // 跳转到C语言函数 lookUpImpOrForward
	bl	_lookUpImpOrForward

	// IMP in x0
	mov	x17, x0

	RESTORE_REGS MSGSEND

.endmacro

    // MARK: __objc_msgSend_uncached
	STATIC_ENTRY __objc_msgSend_uncached
	UNWIND __objc_msgSend_uncached, FrameWithNoSaves

	// THIS IS NOT A CALLABLE C FUNCTION
	// Out-of-band p15 is the class to search
    
    // 跳转到MethodTableLookup
	MethodTableLookup
	TailCallFunctionPointer x17

	END_ENTRY __objc_msgSend_uncached

知识点: C的函数名称对应到汇编中都会在其函数名之前再加上一个_,作为函数名称

【第三步】 跳转到objc-rumtime-new.mmlookUpImpOrForward函数来看,会到当前类的方法列表里查找,如果没有再去父类的方法缓存以及方法列表中查找,直到找到调用为止;如果都没有找到,那么就会进入到方法解析的阶段

NEVER_INLINE
IMP lookUpImpOrForward(id inst, SEL sel, Class cls, int behavior)
{
    // 定义的消息转发
    const IMP forward_imp = (IMP)_objc_msgForward_impcache;
    IMP imp = nil;
    Class curClass;

    runtimeLock.assertUnlocked();
    
    // 判断类是否初始化,如果没有,需要先初始化
    if (slowpath(!cls->isInitialized())) {
       
        behavior |= LOOKUP_NOCACHE;
    }

    // runtimeLock is held during isRealized and isInitialized checking
    // to prevent races against concurrent realization.

    // runtimeLock is held during method search to make
    // method-lookup + cache-fill atomic with respect to method addition.
    // Otherwise, a category could be added but ignored indefinitely because
    // the cache was re-filled with the old value after the cache flush on
    // behalf of the category.

    runtimeLock.lock();

    // We don't want people to be able to craft a binary blob that looks like
    // a class but really isn't one and do a CFI attack.
    //
    // To make these harder we want to make sure this is a class that was
    // either built into the binary or legitimately registered through
    // objc_duplicateClass, objc_initializeClassPair or objc_allocateClassPair.
    checkIsKnownClass(cls);

    cls = realizeAndInitializeIfNeeded_locked(inst, cls, behavior & LOOKUP_INITIALIZE);
    // runtimeLock may have been dropped but is now locked again
    runtimeLock.assertLocked();
    curClass = cls;

    // The code used to lookup the class's cache again right after
    // we take the lock but for the vast majority of the cases
    // evidence shows this is a miss most of the time, hence a time loss.
    //
    // The only codepath calling into this without having performed some
    // kind of cache lookup is class_getInstanceMethod().

    // 查找类的缓存
    
    // unreasonableClassCount -- 表示类的迭代的上限
    for (unsigned attempts = unreasonableClassCount();;) {
        if (curClass->cache.isConstantOptimizedCache(/* strict */true)) {
#if CONFIG_USE_PREOPT_CACHES
            // 又会在缓存里找一次,如果找的就返回
            imp = cache_getImp(curClass, sel);
            if (imp) goto done_unlock;
            curClass = curClass->cache.preoptFallbackClass();
#endif
        } else {
            // 当前类方法列表(采用二分法查找)
            Method meth = getMethodNoSuper_nolock(curClass, sel);
            if (meth) { // 如果存在,取出imp,存到缓存中
                imp = meth->imp(false);
                goto done;
            }

            // 当前类 = 当前类的父类,并判断父类是否为nil
            if (slowpath((curClass = curClass->getSuperclass()) == nil)) {
                
                // 未找到方法实现,方法解析器也不行,使用转发
                imp = forward_imp;
                break;
            }
        }

        // 如果父类链中存在循环,则停止
        if (slowpath(--attempts == 0)) {
            _objc_fatal("Memory corruption in class list.");
        }

        // 父类缓存
        imp = cache_getImp(curClass, sel);
        if (slowpath(imp == forward_imp)) {
            // 如果在父类中找到了forward,则停止查找,且不缓存,首先调用此类的方法解析器
            break;
        }
        if (fastpath(imp)) {
            // 如果在父类中,找到了此方法,将其存储到cache中
            goto done;
        }
    }

    // 没有找到方法实现,尝试一次方法解析
    if (slowpath(behavior & LOOKUP_RESOLVER)) {
        behavior ^= LOOKUP_RESOLVER;
        return resolveMethod_locked(inst, sel, cls, behavior);
    }

 done:
    if (fastpath((behavior & LOOKUP_NOCACHE) == 0)) {
#if CONFIG_USE_PREOPT_CACHES
        while (cls->cache.isConstantOptimizedCache(/* strict */true)) {
            cls = cls->cache.preoptFallbackClass();
        }
#endif
        // 将方法填充到缓存中
        log_and_fill_cache(cls, imp, sel, inst, curClass);
    }
 done_unlock:
    // 解锁
    runtimeLock.unlock();
    if (slowpath((behavior & LOOKUP_NIL) && imp == forward_imp)) {
        return nil;
    }
    return imp;
}

下面是lookUpImpOrForward的一些详细调用解析

1.上述函数会根据传进来的类遍历查找,而且每次都要先去_cache_getImp中查找是否有方法缓存,_cache_getImp里又会调用回CacheLookup进一步查找

STATIC_ENTRY _cache_getImp

	GetClassFromIsa_p16 p0, 0
	CacheLookup GETIMP, _cache_getImp, LGetImpMissDynamic, LGetImpMissConstant

LGetImpMissDynamic:
	mov	p0, #0
	ret

LGetImpMissConstant:
	mov	p0, p2
	ret

	END_ENTRY _cache_getImp

2.在getMethodNoSuper_nolock里会找到class_rw_tmethods方法列表里进行遍历查找

static method_t 
*getMethodNoSuper_nolock(Class cls, SEL sel) {

    runtimeLock.assertLocked();

    ASSERT(cls->isRealized());
    // fixme nil cls? 
    // fixme nil sel?

    // 从类对象里拿到class_rw_t的methods
    auto const methods = cls->data()->methods();
    for (auto mlists = methods.beginLists(),
              end = methods.endLists();
         mlists != end;
         ++mlists)
    {
        // <rdar://problem/46904873> getMethodNoSuper_nolock is the hottest
        // caller of search_method_list, inlining it turns
        // getMethodNoSuper_nolock into a frame-less function and eliminates
        // any store from this codepath.
        method_t *m = search_method_list_inline(*mlists, sel);
        if (m) return m;
    }

    return nil;
}

search_method_list_inline里会根据排序来选择是采用二分查找还是线性查找

ALWAYS_INLINE static 
method_t *search_method_list_inline(const method_list_t *mlist, SEL sel) {

    int methodListIsFixedUp = mlist->isFixedUp();
    int methodListHasExpectedSize = mlist->isExpectedSize();
    
    // 如果排好序的就用二分查找
    if (fastpath(methodListIsFixedUp && methodListHasExpectedSize)) {
        return findMethodInSortedMethodList(sel, mlist);
    } else { // 线性查找,就是一个个找
        // Linear search of unsorted method list
        if (auto *m = findMethodInUnsortedMethodList(sel, mlist))
            return m;
    }

#if DEBUG
    // sanity-check negative results
    if (mlist->isFixedUp()) {
        for (auto& meth : *mlist) {
            if (meth.name() == sel) {
                _objc_fatal("linear search worked when binary search did not");
            }
        }
    }
#endif

    return nil;
}

findMethodInSortedMethodList中进行二分查找

template<class getNameFunc>
ALWAYS_INLINE static method_t *
findMethodInSortedMethodList(SEL key, const method_list_t *list, const getNameFunc &getName) {

    ASSERT(list);

    auto first = list->begin();
    auto base = first;
    decltype(first) probe;

    uintptr_t keyValue = (uintptr_t)key;
    uint32_t count;
    
    for (count = list->count; count != 0; count >>= 1) {
        probe = base + (count >> 1);
        
        uintptr_t probeValue = (uintptr_t)getName(probe);
        
        if (keyValue == probeValue) {
            // `probe` is a match.
            // Rewind looking for the *first* occurrence of this value.
            // This is required for correct category overrides.
            while (probe > first && keyValue == (uintptr_t)getName((probe - 1))) {
                probe--;
            }
            return &*probe;
        }
        
        if (keyValue > probeValue) {
            base = probe + 1;
            count--;
        }
    }
    
    return nil;
}

findMethodInUnsortedMethodList中进行线性查找,也就是一个个往下遍历查找

template<class getNameFunc>
ALWAYS_INLINE static method_t *
findMethodInUnsortedMethodList(SEL sel, const method_list_t *list, const getNameFunc &getName)
{
    for (auto& meth : *list) {
        if (getName(meth) == sel) return &meth;
    }
    return nil;
}

ALWAYS_INLINE static method_t *
findMethodInUnsortedMethodList(SEL key, const method_list_t *list)
{
    if (list->isSmallList()) {
        if (CONFIG_SHARED_CACHE_RELATIVE_DIRECT_SELECTORS && objc::inSharedCache((uintptr_t)list)) {
            return findMethodInUnsortedMethodList(key, list, [](method_t &m) { return m.getSmallNameAsSEL(); });
        } else {
            return findMethodInUnsortedMethodList(key, list, [](method_t &m) { return m.getSmallNameAsSELRef(); });
        }
    } else {
        return findMethodInUnsortedMethodList(key, list, [](method_t &m) { return m.big().name; });
    }
}

3.在log_and_fill_cache里将查找到的方法插入到缓存中,最后调用到objc-cache.mm中的cache_t::insert函数,该函数的详细解析可以查看文章一开始的cache_t部分内容

static void
log_and_fill_cache(Class cls, IMP imp, SEL sel, id receiver, Class implementer) {

#if SUPPORT_MESSAGE_LOGGING
    if (slowpath(objcMsgLogEnabled && implementer)) {
        bool cacheIt = logMessageSend(implementer->isMetaClass(), 
                                      cls->nameForLogging(),
                                      implementer->nameForLogging(), 
                                      sel);
        if (!cacheIt) return;
    }
#endif
    cls->cache.insert(sel, imp, receiver);
}
总结

整个消息发送的流程可以用下图来概述

posted on 2021-04-07 14:43  FunkyRay  阅读(111)  评论(0编辑  收藏  举报