Runtime：objc_msgSend

夜景

目录
一，基本流程
二，消息发送
三，动态方法解析
四，消息转发

一，基本流程

1，方法的调用都会转换为objc_msgSend函数的调用，通常称为消息机制

// OC代码
[person eat];
// 底层代码（用clang进行转换）
((void (*)(id, SEL))(void *)objc_msgSend)((id)person, sel_registerName("eat"));
// 简化代码
objc_msgSend(person, @selector(eat)); // person为消息接收者，eat为消息名称

2，objc_msgSend执行流程

执行流程

二，消息发送

1，底层代码（源码下载地址）

IMP lookUpImpOrForward(Class cls, SEL sel, id inst, 
                       bool initialize, bool cache, bool resolver)
{
    IMP imp = nil;
    bool triedResolver = NO;

 retry:    
    runtimeLock.assertLocked();

    // Try this class's cache.
    // 查找自身的缓存
    imp = cache_getImp(cls, sel);
    if (imp) goto done;

    // Try this class's method lists.
    // 查找自身的方法列表
    {
        Method meth = getMethodNoSuper_nolock(cls, sel);
        if (meth) {
            // 找到就放入自身的缓存中
            log_and_fill_cache(cls, meth->imp, sel, inst, cls);
            imp = meth->imp;
            goto done;
        }
    }

    // Try superclass caches and method lists.
    // 查找父类的缓存和方法列表
    {
        unsigned attempts = unreasonableClassCount();
        // 遍历父类
        for (Class curClass = cls->superclass;
             curClass != nil;
             curClass = curClass->superclass)
        {
            // Halt if there is a cycle in the superclass chain.
            if (--attempts == 0) {
                _objc_fatal("Memory corruption in class list.");
            }
            
            // Superclass cache.
            // 查找父类的缓存
            imp = cache_getImp(curClass, sel);
            if (imp) {
                if (imp != (IMP)_objc_msgForward_impcache) {
                    // Found the method in a superclass. Cache it in this class.
                    // 找到就放入自身的缓存中
                    log_and_fill_cache(cls, imp, sel, inst, curClass);
                    goto done;
                }
                else {
                    // Found a forward:: entry in a superclass.
                    // Stop searching, but don't cache yet; call method 
                    // resolver for this class first.
                    break;
                }
            }
            
            // Superclass method list.
            // 查找父类的方法列表
            Method meth = getMethodNoSuper_nolock(curClass, sel);
            if (meth) {
                // 找到就放入自身的缓存中
                log_and_fill_cache(cls, meth->imp, sel, inst, curClass);
                imp = meth->imp;
                goto done;
            }
        }
    }

    // 这里省略了动态方法解析和消息转发的代码

 done:
    runtimeLock.unlock();

    return imp;
}

2，图解

消息发送

3，说明

• 如果调用实例方法，就在class对象的缓存和方法列表中查找；如果调用类方法，就在meta-class对象中查找

• 方法列表指的是class_rw_t里的methods

• 如果方法列表已排序，就用二分查找法；如果没有排序，就用顺序查找法

三，动态方法解析

1，实例代码

// Person
@interface Person : NSObject
- (void)eat;
@end

@implementation Person
- (void)run {
    NSLog(@"Person run");
}
// 添加实例方法需实现此方法，添加类方法需实现resolveClassMethod
+ (BOOL)resolveInstanceMethod:(SEL)sel {
    if (sel == @selector(eat)) {
        Method runMethod = class_getInstanceMethod(self, @selector(run));
        // 动态添加eat的实现
        class_addMethod(self,
                        @selector(eat),
                        method_getImplementation(runMethod),
                        method_getTypeEncoding(runMethod));
        return YES;
    }
    return [super resolveInstanceMethod:sel];
}
@end

// 使用
Person *person = [Person new];
[person eat];

// 打印
Person run

2，底层代码

IMP lookUpImpOrForward(Class cls, SEL sel, id inst,
                       bool initialize, bool cache, bool resolver)
{
    IMP imp = nil;
    bool triedResolver = NO;
    
    // 这里省略了消息发送的代码

    // No implementation found. Try method resolver once.
    // triedResolver为NO，未动态方法解析
    if (resolver  &&  !triedResolver) {
        runtimeLock.unlock();
        // 调用resolveInstanceMethod或resolveClassMethod
        resolveMethod(cls, sel, inst);
        runtimeLock.lock();
        // Don't cache the result; we don't hold the lock so it may have
        // changed already. Re-do the search from scratch instead.
        // 标记已动态方法解析
        triedResolver = YES;
        // 重新执行消息发送
        goto retry;
    }
    
    // 这里省略了消息转发的代码

 done:
    runtimeLock.unlock();

    return imp;
}

3，图解

动态方法解析

4，说明

• 手动实现resolveInstanceMethod或resolveClassMethod，并且在其中动态添加方法，是动态方法解析的关键

• 动态添加的方法会存入class_rw_t里的methods中，所以需要重新执行消息发送

• 在消息发送过程中能否找到方法取决于是否有动态添加方法

四，消息转发

1，不开源

IMP lookUpImpOrForward(Class cls, SEL sel, id inst,
                       bool initialize, bool cache, bool resolver)
{
    IMP imp = nil;
    bool triedResolver = NO;
    
    // 这里省略了消息发送和动态方法解析的代码
    
    // No implementation found, and method resolver didn't help.
    // Use forwarding.

    // 无法查看内部具体实现
    imp = (IMP)_objc_msgForward_impcache;
    cache_fill(cls, sel, imp, inst);

 done:
    runtimeLock.unlock();

    return imp;
}

2，第一个阶段

• 实例代码

// Person
@interface Person : NSObject
- (void)eat;
@end

@implementation Person
- (id)forwardingTargetForSelector:(SEL)aSelector {
    if (aSelector == @selector(eat)) {
        // 将eat转发给Dog去处理
        Dog *dog = [Dog new];
        return dog;
    }
    return [super forwardingTargetForSelector:aSelector];
}
@end

// Dog
@interface Dog : NSObject
- (void)eat;
@end

@implementation Dog
- (void)eat {
    NSLog(@"Dog eat");
}
@end

// 使用
Person *person = [Person new];
[person eat];

// 打印
Dog eat

• 伪底层代码

if (class_respondsToSelector(receiverClass, @selector(forwardingTargetForSelector:))) {
    id forwardingTarget = [receiver forwardingTargetForSelector:sel];
    if (forwardingTarget && forwardingTarget != receiver) {
        // forwardingTarget是返回的dog，sel是eat
        return objc_msgSend(forwardingTarget, sel, ...);
    }
}

3，第二阶段

• 实例代码

@implementation Person
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
    if (aSelector == @selector(eat)) {
        // 返回eat的方法签名，告知系统需要转发eat，系统就会调用forwardInvocation
        return [[Dog new] methodSignatureForSelector:@selector(eat)];
    }
    return [super methodSignatureForSelector:aSelector];
}
- (void)forwardInvocation:(NSInvocation *)anInvocation {
    // 将eat转发给Dog去处理
    Dog *dog = [Dog new];
    [anInvocation invokeWithTarget:dog];
}
@end

// 打印
Dog eat

• 伪底层代码

if (class_respondsToSelector(receiverClass, @selector(methodSignatureForSelector:))) {
    // 调用methodSignatureForSelector
    NSMethodSignature *methodSignature = [receiver methodSignatureForSelector:sel];
    if (methodSignature && class_respondsToSelector(receiverClass, @selector(forwardInvocation:))) {
        NSInvocation *invocation = [NSInvocation _invocationWithMethodSignature:methodSignature frame:frameStackPointer];
        // 调用forwardInvocation
        [receiver forwardInvocation:invocation];
        void *returnValue = NULL;
        [invocation getReturnValue:&value];
        return returnValue;
    }
}

4，图解

消息转发

5，说明

• forwardInvocation只要实现了就不会抛出异常，即使在该方法中什么也不做

• 如果转发的是类方法，需要将上面三个方法改成类方法，另外target也要设置为类对象

// 类方法
+ (id)forwardingTargetForSelector:(SEL)aSelector {
    if (aSelector == @selector(eat)) {
        // 类对象
        return [Dog class];
    }
    return [super forwardingTargetForSelector:aSelector];
}

• NSInvocation是对将被转发消息的封装

// Person
@interface Person : NSObject
- (int)eat:(int)food;
@end

@implementation Person
- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
    if (aSelector == @selector(eat:)) {
        return [[Dog new] methodSignatureForSelector:@selector(eat:)];
    }
    return [super methodSignatureForSelector:aSelector];
}
- (void)forwardInvocation:(NSInvocation *)anInvocation {
    NSLog(@"消息接收者---%@", anInvocation.target);
    NSLog(@"消息---%@", NSStringFromSelector(anInvocation.selector));
    int argument;
    [anInvocation getArgument:&argument atIndex:2]; // 系统默认会添加两个参数
    NSLog(@"参数---%d", argument);
    int returnValue;
    [anInvocation getReturnValue:&returnValue];
    NSLog(@"返回值---%d", returnValue);
}
@end

// 使用
Person *person = [Person new];
[person eat:1];

// 打印
消息接收者---<Person: 0x100613070>
消息---eat:
参数---1
返回值---0