iOS底層原理（五）Runtime（下）-有解無憂

動態方法決議

如果訊息發送階段不成功，那么就會進入到動態方法決議階段

【第一步】 我們還是先從objc原始碼里找到函式resolveMethod_locked來看，分別對應著類物件和元類物件做了不同的呼叫處理

static NEVER_INLINE IMP
resolveMethod_locked(id inst, SEL sel, Class cls, int behavior) {

    runtimeLock.assertLocked();
    ASSERT(cls->isRealized());

    runtimeLock.unlock();

    // 不是元類物件
    if (! cls->isMetaClass()) {
        // try [cls resolveInstanceMethod:sel]
        resolveInstanceMethod(inst, sel, cls);
    } 
    else { // 是元類物件
        // try [nonMetaClass resolveClassMethod:sel]
        // and [cls resolveInstanceMethod:sel]
        resolveClassMethod(inst, sel, cls);
        
        // 這句印證了在元類物件里找類方法找不到，會去類物件里找同名的物件方法
        if (!lookUpImpOrNilTryCache(inst, sel, cls)) {
            resolveInstanceMethod(inst, sel, cls);
        }
    }

    // chances are that calling the resolver have populated the cache
    // so attempt using it
    return lookUpImpOrForwardTryCache(inst, sel, cls, behavior);
}

注意： 能呼叫到這里，說明已經找到基類的元類物件了，如果還是沒有，那么就會去基類的類物件里找同名的物件方法，正好印證了之前分析的元類物件的superclass指標指向類物件的原理

【第二步】 如果是類物件則會進入resolveInstanceMethod函式中，會走訊息發送的流程去查找是否有實作resolveInstanceMethod方法，如果沒有實作則回傳；如果有實作就發送訊息呼叫resolveInstanceMethod方法，并且再次走訊息發送流程查找是否有實作對應的實體方法

static void resolveInstanceMethod(id inst, SEL sel, Class cls) {

    runtimeLock.assertUnlocked();
    ASSERT(cls->isRealized());
    SEL resolve_sel = @selector(resolveInstanceMethod:);

    // 發送訊息的容錯處理
    // 會走訊息發送的流程去找是否有實作resolveInstanceMethod方法，如果有實作才會往下執行
    if (!lookUpImpOrNilTryCache(cls, resolve_sel, cls->ISA(/*authenticated*/true))) {
        // Resolver not implemented.
        return;
    }

    // 因為已經有實作resolveInstanceMethod，所以發送訊息呼叫resolveInstanceMethod
    BOOL (*msg)(Class, SEL, SEL) = (typeof(msg))objc_msgSend;
    bool resolved = msg(cls, resolve_sel, sel);

    // Cache the result (good or bad) so the resolver doesn't fire next time.
    // +resolveInstanceMethod adds to self a.k.a. cls
    // 再次查找是否有實作對應的實體方法
    IMP imp = lookUpImpOrNilTryCache(inst, sel, cls);
    
    // 拿到resolveInstanceMethod的呼叫回傳值，只是為了是否列印，無其他意義
    if (resolved  &&  PrintResolving) {
        if (imp) {
            _objc_inform("RESOLVE: method %c[%s %s] "
                         "dynamically resolved to %p", 
                         cls->isMetaClass() ? '+' : '-', 
                         cls->nameForLogging(), sel_getName(sel), imp);
        }
        else {
            // Method resolver didn't add anything?
            _objc_inform("RESOLVE: +[%s resolveInstanceMethod:%s] returned YES"
                         ", but no new implementation of %c[%s %s] was found",
                         cls->nameForLogging(), sel_getName(sel), 
                         cls->isMetaClass() ? '+' : '-', 
                         cls->nameForLogging(), sel_getName(sel));
        }
    }
}

下面是resolveInstanceMethod的一些詳細呼叫決議

1.多次呼叫lookUpImpOrNilTryCache的方法實作，內部會再次呼叫_lookUpImpTryCache函式

IMP lookUpImpOrNilTryCache(id inst, SEL sel, Class cls, int behavior)
{
    return _lookUpImpTryCache(inst, sel, cls, behavior | LOOKUP_NIL);
}

2.在_lookUpImpTryCache中，會先去快取中查找，如果沒有還是會走訊息發送流程的呼叫函式lookUpImpOrForward，詳細分析請查看上篇文章

static IMP _lookUpImpTryCache(id inst, SEL sel, Class cls, int behavior)
{
    runtimeLock.assertUnlocked();

    if (slowpath(!cls->isInitialized())) {
        // see comment in lookUpImpOrForward
        return lookUpImpOrForward(inst, sel, cls, behavior);
    }

    // 查看是否有快取
    IMP imp = cache_getImp(cls, sel);
    if (imp != NULL) goto done;
#if CONFIG_USE_PREOPT_CACHES
    if (fastpath(cls->cache.isConstantOptimizedCache(/* strict */true))) {
        imp = cache_getImp(cls->cache.preoptFallbackClass(), sel);
    }
#endif
    if (slowpath(imp == NULL)) {
        return lookUpImpOrForward(inst, sel, cls, behavior);
    }

done:
    if ((behavior & LOOKUP_NIL) && imp == (IMP)_objc_msgForward_impcache) {
        return nil;
    }
    return imp;
}

【第二步】 如果是元類物件則會進入resolveClassMethod函式中，同類物件的動態方法決議大體相似；先會走訊息發送的流程去查找是否有實作resolveClassMethod方法，如果沒有實作則回傳；如果有實作就發送訊息呼叫

static void resolveClassMethod(id inst, SEL sel, Class cls)
{
    runtimeLock.assertUnlocked();
    ASSERT(cls->isRealized());
    ASSERT(cls->isMetaClass());

    if (!lookUpImpOrNilTryCache(inst, @selector(resolveClassMethod:), cls)) {
        // Resolver not implemented.
        return;
    }

    Class nonmeta;
    {
        mutex_locker_t lock(runtimeLock);
        nonmeta = getMaybeUnrealizedNonMetaClass(cls, inst);
        // +initialize path should have realized nonmeta already
        if (!nonmeta->isRealized()) {
            _objc_fatal("nonmeta class %s (%p) unexpectedly not realized",
                        nonmeta->nameForLogging(), nonmeta);
        }
    }
    BOOL (*msg)(Class, SEL, SEL) = (typeof(msg))objc_msgSend;
    bool resolved = msg(nonmeta, @selector(resolveClassMethod:), sel);

    // Cache the result (good or bad) so the resolver doesn't fire next time.
    // +resolveClassMethod adds to self->ISA() a.k.a. cls
    IMP imp = lookUpImpOrNilTryCache(inst, sel, cls);

    if (resolved  &&  PrintResolving) {
        if (imp) {
            _objc_inform("RESOLVE: method %c[%s %s] "
                         "dynamically resolved to %p", 
                         cls->isMetaClass() ? '+' : '-', 
                         cls->nameForLogging(), sel_getName(sel), imp);
        }
        else {
            // Method resolver didn't add anything?
            _objc_inform("RESOLVE: +[%s resolveClassMethod:%s] returned YES"
                         ", but no new implementation of %c[%s %s] was found",
                         cls->nameForLogging(), sel_getName(sel), 
                         cls->isMetaClass() ? '+' : '-', 
                         cls->nameForLogging(), sel_getName(sel));
        }
    }
}

為了驗證原始碼實作，我們還是先創建示例代碼來看

1.創建一個Person類，添加test物件方法，并實作resolveInstanceMethod方法，然后動態添加一個other函式

@interface Person : NSObject

- (void)test;
@end

@implementation Person

- (void)other
{
    NSLog(@"%s", __func__);
}

+ (BOOL)resolveInstanceMethod:(SEL)sel
{
    if (sel == @selector(test)) {
        // 獲取其他方法
        Method method = class_getInstanceMethod(self, @selector(other));

        // 動態添加test方法的實作
        class_addMethod(self, sel,
                        method_getImplementation(method),
                        method_getTypeEncoding(method));

        // 回傳YES代表有動態添加方法
        return YES;
    }
    return [super resolveInstanceMethod:sel];
}
@end

知識點： Method的底層實作struct method_t型別，所以可以理解為等價于struct method_t *

2.在main函式中呼叫[person test]，運行程式可以發現，控制臺會列印other函式已經被呼叫

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        Person *person = [[Person alloc] init];
        [person test];
    }
    return 0;
}

總結

從示例代碼我們可以知道，利用Runtime的訊息發送機制來動態增加一些方法的實作和呼叫

整個動態方法分析的流程可以用下圖表述

-w796

訊息轉發

如果沒有進行動態分析的代碼實作，就會進入到訊息轉發階段

訊息轉發的原始碼由于是不開源的，所以我們只能通過一些其他的方法來分析其內部的實作

實作步驟

1.首先我們先通過方法崩潰的日志列印來查看訊息轉發都對應呼叫了哪些方法

我們注釋掉Person.m檔案里的resolveInstanceMethod實作，再次運行程式發現，程式崩潰并列印經典錯誤資訊

-[Person test]: unrecognized selector sent to instance 0x1018331d0
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[Person test]: unrecognized selector sent to instance 0x1018331d0'
*** First throw call stack:
(
	0   CoreFoundation                      0x00007fff204a16af __exceptionPreprocess + 242
	1   libobjc.A.dylib                     0x00007fff201d93c9 objc_exception_throw + 48
	2   CoreFoundation                      0x00007fff20523c85 -[NSObject(NSObject) __retain_OA] + 0
	3   CoreFoundation                      0x00007fff2040906d ___forwarding___ + 1467
	4   CoreFoundation                      0x00007fff20408a28 _CF_forwarding_prep_0 + 120
	
	6   libdyld.dylib                       0x00007fff2034a631 start + 1
	7   ???                                 0x0000000000000001 0x0 + 1
)

從上面的呼叫堆疊列印資訊我們可以看出，系統會先去呼叫CoreFoundation框架中的___forwarding___

2.我們可以通過逆向工具Hopper對CoreFoundation框架進行反匯編，通過一系列操作，可以得到__forwarding_prep_0___的偽代碼

原始碼分析

下面是偽代碼的實作

// 偽代碼的實作
int __forwarding__(void *frameStackPointer, int isStret) {
    id receiver = *(id *)frameStackPointer;
    SEL sel = *(SEL *)(frameStackPointer + 8);
    const char *selName = sel_getName(sel);
    Class receiverClass = object_getClass(receiver);

    // 呼叫 forwardingTargetForSelector:
    if (class_respondsToSelector(receiverClass, @selector(forwardingTargetForSelector:))) {
        id forwardingTarget = [receiver forwardingTargetForSelector:sel];
        if (forwardingTarget && forwardingTarget != receiver) {
            if (isStret == 1) {
                int ret;
                objc_msgSend_stret(&ret,forwardingTarget, sel, ...);
                return ret;
            }
            return objc_msgSend(forwardingTarget, sel, ...);
        }
    }

    // 僵尸物件
    const char *className = class_getName(receiverClass);
    const char *zombiePrefix = "_NSZombie_";
    size_t prefixLen = strlen(zombiePrefix); // 0xa
    if (strncmp(className, zombiePrefix, prefixLen) == 0) {
        CFLog(kCFLogLevelError,
              @"*** -[%s %s]: message sent to deallocated instance %p",
              className + prefixLen,
              selName,
              receiver);
        <breakpoint-interrupt>
    }

    // 呼叫 methodSignatureForSelector 獲取方法簽名后再呼叫 forwardInvocation
    if (class_respondsToSelector(receiverClass, @selector(methodSignatureForSelector:))) {
        NSMethodSignature *methodSignature = [receiver methodSignatureForSelector:sel];
        if (methodSignature) {
            BOOL signatureIsStret = [methodSignature _frameDescriptor]->returnArgInfo.flags.isStruct;
            if (signatureIsStret != isStret) {
                CFLog(kCFLogLevelWarning ,
                      @"*** NSForwarding: warning: method signature and compiler disagree on struct-return-edness of '%s'.  Signature thinks it does%s return a struct, and compiler thinks it does%s.",
                      selName,
                      signatureIsStret ? "" : not,
                      isStret ? "" : not);
            }
            if (class_respondsToSelector(receiverClass, @selector(forwardInvocation:))) {
                NSInvocation *invocation = [NSInvocation _invocationWithMethodSignature:methodSignature frame:frameStackPointer];

                [receiver forwardInvocation:invocation];

                void *returnValue = https://www.cnblogs.com/funkyRay/p/NULL;
                [invocation getReturnValue:&value];
                return returnValue;
            } else {
                CFLog(kCFLogLevelWarning ,
                      @"*** NSForwarding: warning: object %p of class '%s' does not implement forwardInvocation: -- dropping message",
                      receiver,
                      className);
                return 0;
            }
        }
    }

    SEL *registeredSel = sel_getUid(selName);

    // selector 是否已經在 Runtime 注冊過
    if (sel != registeredSel) {
        CFLog(kCFLogLevelWarning ,
              @"*** NSForwarding: warning: selector (%p) for message '%s' does not match selector known to Objective C runtime (%p)-- abort",
              sel,
              selName,
              registeredSel);
    } // doesNotRecognizeSelector
    else if (class_respondsToSelector(receiverClass,@selector(doesNotRecognizeSelector:))) {
        [receiver doesNotRecognizeSelector:sel];
    }
    else {
        CFLog(kCFLogLevelWarning ,
              @"*** NSForwarding: warning: object %p of class '%s' does not implement doesNotRecognizeSelector: -- abort",
              receiver,
              className);
    }

    // The point of no return.
    kill(getpid(), 9);
}

1.首先會查看是否實作forwardingTargetForSelector方法，如果實作了該方法并且回傳值不為nil，那么會呼叫objc_msgSend進行訊息發送流程；如果該方法未實作或者回傳值為nil，就會呼叫方法簽名methodSignatureForSelector

2.如果methodSignatureForSelector的回傳值不為nil，那么就會呼叫forwardInvocation，如果該方法未實作或者回傳值為nil，那么就會呼叫doesNotRecognizeSelector，doesNotRecognizeSelector里就會進行崩潰報錯

3.如果forwardInvocation未實作，也會進行崩潰報錯

4.為了驗證上述原始碼分析，在增加一個Cat類，并實作test方法

@interface Cat: NSObject

- (void)test;
@end

@implementation Cat

- (void)test {
    NSLog(@"%s", __func__);
}
@end

在Person.mm檔案里對應實作這三個函式，并分別回傳nil或者注釋掉函式實作，然后運行程式發現，和上述分析相同

@implementation Person

//+ (BOOL)resolveInstanceMethod:(SEL)sel
//{
//    class_addMethod(<#Class  _Nullable __unsafe_unretained cls#>, <#SEL  _Nonnull name#>, <#IMP  _Nonnull imp#>, <#const char * _Nullable types#>)
//}

- (id)forwardingTargetForSelector:(SEL)aSelector
{
    NSLog(@"%s", __func__);

    if (aSelector == @selector(test)) {
        // objc_msgSend([[Cat alloc] init], aSelector)
        return nil;
        //[[Cat alloc] init];
        //[[NSObject alloc] init];
    }

    return [super forwardingTargetForSelector:aSelector];
}

// 方法簽名：回傳值型別、引數型別
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector
{
    NSLog(@"%s", __func__);
    
    if (aSelector == @selector(test)) {
        return [NSMethodSignature signatureWithObjCTypes:"v16@0:8"];
    }
    
    return [super methodSignatureForSelector:aSelector];
}

// NSInvocation封裝了一個方法呼叫，包括：方法呼叫者、方法名、方法引數
//    anInvocation.target 方法呼叫者
//    anInvocation.selector 方法名
//    [anInvocation getArgument:NULL atIndex:0]
- (void)forwardInvocation:(NSInvocation *)anInvocation
{
    NSLog(@"%s", __func__);
//    anInvocation.target = [[Cat alloc] init];
//    [anInvocation invoke]; 執行方法

    [anInvocation invokeWithTarget:[[Cat alloc] init]];
   // [anInvocation invokeWithTarget:[[NSObject alloc] init]];
}

@end

方法簽名methodSignatureForSelector回傳值的多種寫法

// 省略types型別位元組大小
[NSMethodSignature signatureWithObjCTypes:"i@:i"]

// 用默認的aSelector傳遞
[[[Cat alloc] init] methodSignatureForSelector:aSelector];

forwardInvocation會通過NSInvocation型別的引數拿到整個方法的呼叫者、方法名以及方法引數

// 更改呼叫者物件
[anInvocation invokeWithTarget:[[Cat alloc] init]];

// 拿到引數資訊，傳遞的是地址值
int age;
[anInvocation getArgument:&age atIndex:2];

// 拿到回傳值資訊
int ret;
[anInvocation getReturnValue:&ret];

注意：

將forwardingTargetForSelector的回傳值改為NSObject物件，發現也一樣會崩潰報錯；說明了如果回傳值的型別也找不到對應的函式實作，會重新走訊息發送的流程然后最后崩潰報錯
forwardInvocation的實作里可以做任何事，只要實作了該函式，就不會崩潰報錯；前提是不會進行未實作方法的invokeWithTarget物件呼叫
以上方法都有物件方法、類方法2個版本

總結

整個訊息轉發分析的流程可以用下圖表述

面試題

1.下面這段代碼的self和super分別對應著是誰，說下原理

@interface Person : NSObject

- (void)run;
@end

@implementation Person

- (void)run {
    NSLog(@"%s", __func__);
}
@end

@interface Student: Person

@end

@implementation Student

- (instancetype)init {

    if (self = [super init]) {
        NSLog(@"[self class] = %@", [self class]); // Student
        NSLog(@"[self superclass] = %@", [self superclass]); // Person

        NSLog(@"[super class] = %@", [super class]); // Student
        NSLog(@"[super superclass] = %@", [super superclass]); // Person
    }
    return self;
}

- (void)run {

    [super run];
}
@end

將這段代碼轉成C++檔案后可以發現，run方法的底層會呼叫objc_msgSendSuper函式

static void _I_MJStudent_run(MJStudent * self, SEL _cmd) {
//    objc_msgSendSuper(__rw_objc_super { self, [Person class]) },
//                      sel_registerName("run")
//                      );
    ((void (*)(__rw_objc_super *, SEL))(void *)objc_msgSendSuper)((__rw_objc_super){(id)self, (id)class_getSuperclass(objc_getClass("Student"))}, sel_registerName("run"));
    NSLog((NSString *)&__NSConstantStringImpl__var_folders_2r__m13fp2x2n9dvlr8d68yry500000gn_T_MJStudent_69ea3c_mi_0);
}

我們還發現其中一個引數是__rw_objc_super的結構體型別，里面的兩個成員正好對著self和class_getSuperclass(objc_getClass("Student"))，也就是Student物件和父類Person物件

struct __rw_objc_super { 
	struct objc_object *object; 
	struct objc_object *superClass; 
	__rw_objc_super(struct objc_object *o, struct objc_object *s) : object(o), superClass(s) {} 
};

我們在objc原始碼的objc-msg-arm64.s檔案里可以查找到關于objc_msgSendSuper函式的實作

ENTRY _objc_msgSendSuper
	UNWIND _objc_msgSendSuper, NoFrame

	ldp	p0, p16, [x0]		// p0 = real receiver, p16 = class
	b L_objc_msgSendSuper2_body

	END_ENTRY _objc_msgSendSuper

	// no _objc_msgLookupSuper

	ENTRY _objc_msgSendSuper2
	UNWIND _objc_msgSendSuper2, NoFrame

#if __has_feature(ptrauth_calls)
	ldp	x0, x17, [x0]		// x0 = real receiver, x17 = class
	add	x17, x17, #SUPERCLASS	// x17 = &class->superclass
	ldr	x16, [x17]		// x16 = class->superclass
	AuthISASuper x16, x17, ISA_SIGNING_DISCRIMINATOR_CLASS_SUPERCLASS
LMsgSendSuperResume:
#else
	ldp	p0, p16, [x0]		// p0 = real receiver, p16 = class
	ldr	p16, [x16, #SUPERCLASS]	// p16 = class->superclass
#endif
L_objc_msgSendSuper2_body:
	CacheLookup NORMAL, _objc_msgSendSuper2, __objc_msgSend_uncached

	END_ENTRY _objc_msgSendSuper2

發現最侄訓呼叫_objc_msgSendSuper2，會根據當前型別的superclass指標去查找父類方法來呼叫；而傳進來的第一個結構體變數的真實型別是objc_super2

struct objc_super2 {
    id receiver;
    Class current_class;
};

我們可以在objc原始碼的NSObject.mm中查看class方法的實作，就是獲取當前呼叫者的型別，那傳進去的self就是當前呼叫者，所以不論是[self class]還是[super class]得到的都是當前呼叫者的型別，也就是Student型別

+ (Class)class {
    return self;
}

- (Class)class {
    return object_getClass(self);
}

而superclass方法的實作就是獲取當前呼叫者型別的父型別別，所以[self superclass]還是[super superclass]得到的都是Person型別

+ (Class)superclass {
    return self->getSuperclass();
}

- (Class)superclass {
    return [self class]->getSuperclass();
}

2.以下代碼能不能執行成功？如果可以，列印結果是什么？

@interface Person : NSObject

@property (copy, nonatomic) NSString *name;
- (void)print;
@end

@implementation Person

- (void)print
{
    NSLog(@"my name is %@", self->_name);
    // 能呼叫成功，輸入結果為 my name is <ViewController: 0x7fcfc2a04720>
}
@end

@interface ViewController ()

@end

@implementation ViewController

- (void)viewDidLoad {
	[super viewDidLoad];
    
   	id cls = [Person class];

   	void *obj = &cls;

   	[(__bridge id)obj print];
}

@end

將上述代碼用下圖來表示關系可以看出，創建一個Person物件Person *person = [[Person alloc] init]等同于obj指向的[Person class]，所以obj可以直接呼叫print函式

然后我們知道viewDidLoad中的幾個區域變數的記憶體地址都是從大到小的排列，所以可以用下圖來表示

而[super viewDidLoad]的本質就是呼叫objc_msgSendSuper2的函式，函式的第一個引數就是一個類似于下面代碼的結構體變數

struct objc_super2 {   self,   [ViewController class]};

所以在記憶體中的分布也就是如下圖所示

Person結構體的本質如下面代碼所示，里面的成員變數也是由低到高來排列；所以self->_name就是在結構體里跳過isa指標找到_name成員變數，也就相等于obj跳過cls找到結構體變數里的self，那么取得值就是ViewController的記憶體地址

struct Person_IMPL
{
   Class isa;
   NSString *_name;
};

3.Runtime的具體應用

利用關聯物件（AssociatedObject）給分類添加屬性遍歷類的所有成員變數（修改textfield的占位文字顏色、字典轉模型、自動歸檔解檔）交換方法實作（交換系統的方法，監聽按鈕多次點擊事件）利用訊息轉發機制解決方法找不到的例外問題
1.替換類

@interface Person: NSObject
- (void)run;
@end

@implementation Person
- (void)run
{
    NSLog(@"%s", __func__);
}
@end

@interface Car: NSObject
- (void)run;
@end

@implementation Car
- (void)run
{
    NSLog(@"%s", __func__);
}
@end

Person *person = [[Person alloc] init];
[person run];
    
object_setClass(person, [Car class]);
[person run];

// 分別輸出 [Person run]，[Car run]

2.判斷是否為類物件

NSLog(@"%d %d %d",
          object_isClass(person),
          object_isClass([Person class]),
          object_isClass(object_getClass([Person class]))
          );

3.動態創建類

void run(id self, SEL _cmd)
{
    NSLog(@"_____ %@ - %@", self, NSStringFromSelector(_cmd));
}

// 創建類
Class newClass = objc_allocateClassPair([NSObject class], "Dog", 0);
class_addIvar(newClass, "_age", 4, 1, @encode(int));
class_addIvar(newClass, "_weight", 4, 1, @encode(int));
class_addMethod(newClass, @selector(run), (IMP)run, "v@:");

// 注冊類
objc_registerClassPair(newClass);

id dog = [[newClass alloc] init];
[dog setValue:@10 forKey:@"_age"];
[dog setValue:@20 forKey:@"_weight"];
[dog run];

// 在不需要這個類時釋放
// objc_disposeClassPair(newClass);

注意： 由于成員變數是只讀屬性，所以必須在注冊類之前添加；為了規范，屬性、成員變數、方法都最好在注冊類之前添加好

4.成員變數相關的用法

// 獲取成員變數資訊
Ivar ageIvar = class_getInstanceVariable([Person class], "_age");
NSLog(@"%s %s", ivar_getName(ageIvar), ivar_getTypeEncoding(ageIvar));

// 設定和獲取成員變數的值
Ivar nameIvar = class_getInstanceVariable([Person class], "_name");

Person *person = [[Person alloc] init];
object_setIvar(person, nameIvar, @"123");

// 不能直接傳基本資料型別，所以先轉成指標型別，再變為id型別
object_setIvar(person, ageIvar, (__bridge id)(void *)10);
    NSLog(@"%@ %d", person.name, person.age);

// 獲取所有成員變數資訊
// 成員變數的數量
unsigned int count;
Ivar *ivars = class_copyIvarList([Person class], &count);
for (int i = 0; i < count; i++) {
   // 取出i位置的成員變數
   Ivar ivar = ivars[i];
   NSLog(@"%s %s", ivar_getName(ivar), ivar_getTypeEncoding(ivar));
}
free(ivars);

5.方法實作的置換

void myrun()
{
    NSLog(@"---myrun");
}

Person *person = [[Person alloc] init];
    
class_replaceMethod([Person class], @selector(run), (IMP)myrun, "v");
    
// class_replaceMethod([Person class], @selector(run), imp_implementationWithBlock(^{
//     NSLog(@"123123");
// }), "v");
    
[person run];

將類里的兩個方法實作交換

@implementation Person

- (void)run
{
    NSLog(@"%s", __func__);
}

- (void)test
{
    NSLog(@"%s", __func__);
}

@end

Person *person = [[Person alloc] init];
        
Method runMethod = class_getInstanceMethod([Person class], @selector(run));
Method testMethod = class_getInstanceMethod([Person class], @selector(test));
method_exchangeImplementations(runMethod, testMethod);

[person run];

利用方法交換進行容錯

@interface NSMutableArray (Extension)

@end

@implementation NSMutableArray (Extension)

+ (void)load
{
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        // 類簇：NSString、NSArray、NSDictionary，真實型別是其他型別
        Class cls = NSClassFromString(@"__NSArrayM");
        Method method1 = class_getInstanceMethod(cls, @selector(insertObject:atIndex:));
        Method method2 = class_getInstanceMethod(cls, @selector(ll_insertObject:atIndex:));
        method_exchangeImplementations(method1, method2);
    });
}

- (void)ll_insertObject:(id)anObject atIndex:(NSUInteger)index
{
    if (anObject == nil) return;
    
    [self ll_insertObject:anObject atIndex:index];
}

@end

我們在objc4原始碼里可以看到該方法的實作，就是將兩個函式的IMP交換，并且清空快取

void method_exchangeImplementations(Method m1, Method m2)
{
    if (!m1  ||  !m2) return;

    mutex_locker_t lock(runtimeLock);

    IMP imp1 = m1->imp(false);
    IMP imp2 = m2->imp(false);
    SEL sel1 = m1->name();
    SEL sel2 = m2->name();

    m1->setImp(imp2);
    m2->setImp(imp1);


    // RR/AWZ updates are slow because class is unknown
    // Cache updates are slow because class is unknown
    // fixme build list of classes whose Methods are known externally?

    flushCaches(nil, __func__, [sel1, sel2, imp1, imp2](Class c){
        return c->cache.shouldFlush(sel1, imp1) || c->cache.shouldFlush(sel2, imp2);
    });

    adjustCustomFlagsForMethodChange(nil, m1);
    adjustCustomFlagsForMethodChange(nil, m2);
}

在這個函式里清空快取資料

static void flushCaches(Class cls, const char *func, bool (^predicate)(Class))
{
    runtimeLock.assertLocked();
#if CONFIG_USE_CACHE_LOCK
    mutex_locker_t lock(cacheUpdateLock);
#endif

    const auto handler = ^(Class c) {
        if (predicate(c)) {
            // 清空資料
            c->cache.eraseNolock(func);
        }

        return true;
    };

    if (cls) {
        foreach_realized_class_and_subclass(cls, handler);
    } else {
        foreach_realized_class_and_metaclass(handler);
    }
}

轉載請註明出處，本文鏈接：https://www.uj5u.com/yidong/273577.html

標籤：iOS

上一篇：iOS-宮格拼圖

下一篇：iOS底層原理（五）Runtime（上）