在使用delegate時候, 尤其是自定義delegate的時候, 都會自覺不自覺的加上weak屬性, 系統(tǒng)的delegate也是這樣寫的,
@property(nullable,nonatomic,weak) id<UIScrollViewDelegate>, 當(dāng)然, 這樣寫的一個主要原因是為了防止循環(huán)引用, 但是在iOS8.x的系統(tǒng)上delegate并不是weak屬性, 而是__unsafe_unretained.
先來說下__unsafe_unretained和weak的區(qū)別
先上段代碼
__unsafe_unretained id obj0 = nil;
{
id obj1 = [[NSObject alloc] init];
obj0 = obj1;
NSLog(@"obj1: %@", obj1);
}
NSLog(@"obj0: %@", obj0);
__weak id obj0 = nil;
{
id obj1 = [[NSObject alloc] init];
obj0 = obj1;
NSLog(@"obj1: %@", obj1);
}
NSLog(@"obj0: %@", obj0);
__unsafe_unretained從名字上就可以看出來, 不安全, 賦值的時候引用計數(shù)不增加, 也就是obj0被賦值為obj1的地址, 但是出了obj1的作用域, obj1被釋放了, 而obj0并不釋放, 而是依舊持有, 這樣就會造成不安全!
而使用weak的時候, 出了obj1的作用域, obj1被釋放, obj0引用計數(shù)為0被釋放, 隨即會把obj0置為nil.
崩潰堆棧&&場景重現(xiàn)
0 libobjc.A.dylib!objc_msgSend + 0x10
1 UIKit!-[UIScrollView(UIScrollViewInternal) _delegateScrollViewAnimationEnded] + 0x40
2 UIKit!-[UIScrollView(UIScrollViewInternal) _scrollViewAnimationEnded:finished:] + 0xcc
3 UIKit!-[UIAnimator stopAnimation:] + 0x1f4
4 UIKit!-[UIAnimator(Static) _advanceAnimationsOfType:withTimestamp:] + 0x14c
5 QuartzCore!CA::Display::DisplayLinkItem::dispatch() + 0x1c
6 QuartzCore!CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 0x140
7 IOKit!IODispatchCalloutFromCFMessage + 0x174
8 CoreFoundation!__CFMachPortPerform + 0xb0
9 CoreFoundation!__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 0x34
大體上意思就是, 在scrollView滑動結(jié)束的時候, 會繼續(xù)使用delegate, 而此時的delegate已經(jīng)釋放了, 在iOS9+系統(tǒng)上, 是沒有問題的, 因為delegate是weak的, 釋放了立即置空, 不存在安全隱患, 而iOS9-, 則不行, 因為是__unsafe_unretained的, 所以, 釋放了, 但不置空, 這就造成了野指針崩潰.
重現(xiàn)代碼
#import "ScrollViewController.h"
@interface ScrollViewController ()<UIScrollViewDelegate>
@property (nonatomic, weak) UIScrollView *scrollView;
@property (nonatomic, weak) UIView *leftView;
@property (nonatomic, weak) UIView *centerView;
@property (nonatomic, weak) UIView *rightView;
@property (nonatomic, assign) NSInteger currentPage;
@end
@implementation ScrollViewController
- (void)dealloc {
NSLog(@"dealloc");
}
- (void)viewDidLoad {
[super viewDidLoad];
UIScrollView *scrollView = [[UIScrollView alloc] init];
scrollView.delegate = self;
[self.view addSubview:scrollView];
UIView *leftView = [[UIView alloc] init];
leftView.backgroundColor = UIColor.redColor;
[scrollView addSubview:leftView];
UIView *centerView = [[UIView alloc] init];
centerView.backgroundColor = UIColor.blueColor;
[scrollView addSubview:centerView];
UIView *rightView = [[UIView alloc] init];
rightView.backgroundColor = UIColor.greenColor;
[scrollView addSubview:rightView];
self.scrollView = scrollView;
self.leftView = leftView;
self.centerView = centerView;
self.rightView = rightView;
self.currentPage = 1;
}
- (void)viewDidLayoutSubviews {
CGFloat W = self.view.frame.size.width;
CGFloat H = self.view.frame.size.height;
self.scrollView.frame = self.view.bounds;
self.scrollView.contentSize = CGSizeMake(3*W, H);
self.leftView.frame = CGRectMake(0, 0, W, H);
self.centerView.frame = CGRectMake(W, 0, W, H);
self.rightView.frame = CGRectMake(2*W, 0, W, H);
[super viewDidLayoutSubviews];
}
#pragma mark - UIScrollViewDelegate
- (void)scrollViewWillBeginDragging:(UIScrollView *)scrollView {
NSLog(@"scrollViewWillBeginDragging");
[self.navigationController popViewControllerAnimated:NO];
}
- (void)scrollViewWillEndDragging:(UIScrollView *)scrollView withVelocity:(CGPoint)velocity
targetContentOffset:(inout CGPoint *)targetContentOffset {
NSLog(@"scrollViewWillEndDragging");
float width = scrollView.bounds.size.width;
CGFloat scrolledOffset = targetContentOffset->x - width * self.currentPage;
if (scrolledOffset > 0 && scrolledOffset >= width / 2) {
self.currentPage = self.currentPage + 1;
[self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES];
} else if (scrolledOffset < 0 && fabs(scrolledOffset) >= width / 2) {
self.currentPage = self.currentPage - 1;
[self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES];
}
}
@end
好的, 在scrollView開始滑動的時候就釋放調(diào)當(dāng)前的ViewController, 這時候由于系統(tǒng)持有scrollView在做動畫, 并沒有立即釋放, 當(dāng)動畫結(jié)束后, 系統(tǒng)釋放scrollView, 然后來到dealloc, self被釋放, 但是問題的關(guān)鍵是這句代碼
[self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES];
這里scrollview會在整個做動畫scrollViewWillBeginDragging, scrollViewWillEndDragging, scrollViewDidEndDragging等, 被系統(tǒng)強引用, 所以這里都是沒問題的, 不會崩潰, 但是在里面再去做animated動畫, 就很危險了, 因為這時候self即將被釋放, 到時候, delegate將變成野指針, 所以當(dāng)animated動畫結(jié)束的時候會造成崩潰(可能animated結(jié)束的時候系統(tǒng)又用delegate去做了什么事情).
因為控制臺打出的日志顯示
[ScrollViewController respondsToSelector:]: message sent to deallocated instance 0x7ff8324d6900
經(jīng)調(diào)查發(fā)現(xiàn)0x7ff8324d6900這個地址正是delegate原來的地址.
解決辦法
那么這樣一來, 我們是不是可以通過把delegate置空來避免崩潰呢'?
可以:
_scrollView.delegate = nil;
這也是最簡單的解決辦法, _scrollView.delegate置空后面拿delegate干事兒就安全了, 還有一個辦法, hook dealloc, 通常我們再將scrollView后不會去考慮scrollView.delegate的安全性問題, 因為都會覺得, 隨著scrollview的置空delegate也將被置空, 然而并不是(iOS9-不是)!
有關(guān)hook這里就不多表了, 懂的自然懂, 不懂也不是一兩句話就能說明白的, 直接上代碼
+ (void)hookUIScrollViewSetDelegate
{
[MethodsHooker hookMethedClass:NSClassFromString(@"UIScrollView")
hookSEL:@selector(setDelegate:)
originalSEL:@selector(originalSetDelegate:)
myselfSEL:@selector(myselfSetDelegate:)];
}
- (void)myselfSetDelegate:(UIViewController *)delegate
{
if (delegate) {
UIScrollView * __weak weak_self = (UIScrollView *)self;
[delegate setDeallocCallback:^{
weak_self.delegate = nil;
if ([weak_self isKindOfClass:[UITableView class]]) {
((UITableView *)weak_self).editing = NO;
((UITableView *)weak_self).dataSource = nil;
((UITableView *)weak_self).delegate = nil;
} else if ([weak_self isKindOfClass:[UICollectionView class]]) {
((UICollectionView *)weak_self).dataSource = nil;
((UICollectionView *)weak_self).delegate = nil;
}
}];
}
[self originalSetDelegate:delegate];
}
- (void)originalSetDelegate:(id)delegate
{
}
.h
#import <UIKit/UIKit.h>
typedef void (^DeallocCallback)();
@interface UIViewController (Dealloc)
@property (nonatomic, copy) DeallocCallback deallocCallback;
@end
.m
@implementation UIViewController (Dealloc)
+ (void)load
{
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
[self hookSelectorName:@"dealloc" withSelector:@selector(myUIViewControllerDealloc)];
});
}
- (void)myUIViewControllerDealloc
{
DeallocCallback callback = [self deallocCallback];
if (callback) {
callback();
}
[self myUIViewControllerDealloc];
}
- (void)setDeallocCallback:(DeallocCallback)callback
{
objc_setAssociatedObject(self, _cmd, callback, OBJC_ASSOCIATION_COPY_NONATOMIC);
}
- (DeallocCallback)deallocCallback
{
return objc_getAssociatedObject(self, @selector(setDeallocCallback:));
}
@end
這里在給scrollView設(shè)置delegate的時候, 同時為delegate的dealloc方法添加block. 為了執(zhí)行到自己寫的block, 我們還要hook dealloc, 這樣執(zhí)行dealloc會先執(zhí)行我們的block中的代碼, 這里會將delegate置空, 從而完成任務(wù).
