一、準備工作

• 1、創建工程：macOS -> Command Line Tool

二、開始探究

• 1、以NSObject為例：

#import <Foundation/Foundation.h>

#import <malloc/malloc.h>
#import <objc/runtime.h>

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        NSObject *obj = [[NSObject alloc] init];
        //獲取成員變量ivars占用的字節大小 ==> 8
        NSLog(@"%zu", class_getInstanceSize([NSObject class]));
        //獲取實際分配的內存大小 ==> 16
        NSLog(@"%zu", malloc_size((__bridge const void *)(obj)));
    }
    return 0;
}

將OC轉化為C++：

xcrun -sdk iphoneos clang -arch arm64 -rewrite-objc main.m -o main.cpp

查看內存分布

• a. 方法一：Debug -> Debug Workflow -> View Memory（快捷鍵：Ctrl+Option+Shift+Cmd+M），之后在Address里輸入obj的內存地址后回車。
• b. 方法二：用lldb查看：x/4xg obj_ptr。

分配內存大小

#import <Foundation/Foundation.h>

#import <malloc/malloc.h>
#import <objc/runtime.h>

@interface MZPerson : NSObject

//struct NSObject_IMPL NSObject_IVARS; //8
@property (nonatomic, strong) NSString *name;//8
@property (nonatomic, assign) NSInteger age;//8

/**
 屬性在底層的實現
 struct MZPerson_IMPL {
     struct NSObject_IMPL NSObject_IVARS;
     NSString *_name;
     NSInteger _age;
 };
*/

@end

@implementation MZPerson
@end

@interface MZStudent : MZPerson

//struct MZPerson_IMPL MZPerson_IVARS; //24
@property (nonatomic, assign) double height;//8

/**
 屬性在底層的實現
 struct MZStudent_IMPL {
     struct MZPerson_IMPL MZPerson_IVARS;
     double _height;
 };
 */

@end

@implementation MZStudent
@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        MZPerson *person = [[MZPerson alloc] init];
        MZStudent *student = [[MZStudent alloc] init];
        
        NSLog(@"MZPerson: %zd", class_getInstanceSize(MZPerson.class));//實際占用24
        NSLog(@"MZPerson: %zd", malloc_size((__bridge const void *)(person)));//分配內存大小必須是16的倍數, 32
        NSLog(@"MZStudent: %zd", class_getInstanceSize(MZStudent.class));//實際占用32
        NSLog(@"MZStudent: %zd", malloc_size((__bridge const void *)(student)));//分配內存大小必須是16的倍數, 32
    }
    return 0;
}

考察isa和superclass

isa與superclass 1.png

#import <Foundation/Foundation.h>

@interface MZPerson : NSObject

+ (void)test;

@end

@implementation MZPerson
@end

//NSObject的分類
@interface NSObject (MZExtension)

+ (void)test;

@end

@implementation NSObject (MZExtension)
// 在這個方法沒有被注釋的時候，會調用該方法；注釋之后，調用`-test`方法
//+ (void)test {
//    NSLog(@"%s", __func__);
//}

- (void)test {
    NSLog(@"%s", __func__);
}

@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        [MZPerson test];
    }
    return 0;
}

//打印：-[NSObject(MZExtension) test]

解析：首先要知道類方法存儲在元類里。當在MZPerson元類里找不到test方法時，則元類通過superclass找父類的元類，很顯然，父類的元類是NSObject的元類。我們通過分類，給NSObject添加了+test方法，該方法會存儲在NSObject的元類里，能找到，直接調用該方法，如代碼里注釋所示。當+test的方法被注釋時，NSObject的元類里找不到test方法，NSObject的元類會通過superclass找到它的父類，也就是NSObject。由于NSObject里有一個-test方法，所以就可以直接調用了。
另外：無論是類方法還是實例方法，在底層的調用都是通過 objc_msgSend(obj, sel_registerName("selName")); 這種形式調用的，唯一不同的是調用對象是類還是實例對象而已。

MJ老師整理的ClassInfo類

# if __arm64__
#   define ISA_MASK        0x0000000ffffffff8ULL
# elif __x86_64__
#   define ISA_MASK        0x00007ffffffffff8ULL
# endif

#if __LP64__
typedef uint32_t mask_t;
#else
typedef uint16_t mask_t;
#endif
typedef uintptr_t cache_key_t;

struct bucket_t {
    cache_key_t _key;
    IMP _imp;
};

struct cache_t {
    bucket_t *_buckets;
    mask_t _mask;
    mask_t _occupied;
};

struct entsize_list_tt {
    uint32_t entsizeAndFlags;
    uint32_t count;
};

struct method_t {
    SEL name;
    const char *types;
    IMP imp;
};

struct method_list_t : entsize_list_tt {
    method_t first;
};

struct ivar_t {
    int32_t *offset;
    const char *name;
    const char *type;
    uint32_t alignment_raw;
    uint32_t size;
};

struct ivar_list_t : entsize_list_tt {
    ivar_t first;
};

struct property_t {
    const char *name;
    const char *attributes;
};

struct property_list_t : entsize_list_tt {
    property_t first;
};

struct chained_property_list {
    chained_property_list *next;
    uint32_t count;
    property_t list[0];
};

typedef uintptr_t protocol_ref_t;
struct protocol_list_t {
    uintptr_t count;
    protocol_ref_t list[0];
};

struct class_ro_t {
    uint32_t flags;
    uint32_t instanceStart;
    uint32_t instanceSize;  // instance對象占用的內存空間
#ifdef __LP64__
    uint32_t reserved;
#endif
    const uint8_t * ivarLayout;
    const char * name;  // 類名
    method_list_t * baseMethodList;
    protocol_list_t * baseProtocols;
    const ivar_list_t * ivars;  // 成員變量列表
    const uint8_t * weakIvarLayout;
    property_list_t *baseProperties;
};

struct class_rw_t {
    uint32_t flags;
    uint32_t version;
    const class_ro_t *ro;
    method_list_t * methods;    // 方法列表
    property_list_t *properties;    // 屬性列表
    const protocol_list_t * protocols;  // 協議列表
    Class firstSubclass;
    Class nextSiblingClass;
    char *demangledName;
};

#define FAST_DATA_MASK          0x00007ffffffffff8UL
struct class_data_bits_t {
    uintptr_t bits;
public:
    class_rw_t* data() {
        return (class_rw_t *)(bits & FAST_DATA_MASK);
    }
};

/* OC對象 */
struct mj_objc_object {
    void *isa;
};

/* 類對象 */
struct mj_objc_class : mj_objc_object {
    Class superclass;
    cache_t cache;
    class_data_bits_t bits;
public:
    class_rw_t* data() {
        return bits.data();
    }
    
    mj_objc_class* metaClass() {
        return (mj_objc_class *)((long long)isa & ISA_MASK);
    }
};

使用：

MJStudent *stu = [[MJStudent alloc] init];
        stu->_weight = 10;
        
        mj_objc_class *studentClass = (__bridge mj_objc_class *)([MJStudent class]);
        mj_objc_class *personClass = (__bridge mj_objc_class *)([MJPerson class]);
        
        class_rw_t *studentClassData = studentClass->data();
        class_rw_t *personClassData = personClass->data();
        
        class_rw_t *studentMetaClassData = studentClass->metaClass()->data();
        class_rw_t *personMetaClassData = personClass->metaClass()->data();

補充常用lldb命令：