1.Block的類型

全局Block(NSGlobalBlock)

  void (^block)(void) = ^{
        NSLog(@"------");
    };
    NSLog(@"%@",block);
//打印結果<__NSGlobalBlock__: 0x10bb2d030>

block 內部沒有引用外部變量的 Block 類型都是 NSGlobalBlock 類型，存儲于全局數據區，由系統管理其內存，retain、copy、release操作都無效。如果只引用全局變量和靜態變量也是全局Block。

堆Block(NSMallocBlock)

 int a = 10;
    void (^block)(void) = ^{
        NSLog(@"----%d",a);
    };
    NSLog(@"%@",block);
打印結果
<__NSMallocBlock__: 0x60000179d950>

NSMallocBlock只需要對NSStackBlock進行copy操作就可以獲取

棧Block(NSStackBlock)

之前我們通過

int a= 10;
 NSLog(@"%@",^{
        NSLog(@"----%d",a);
    });

可以得出StackBlock，但是現在不行了，我們可以通過下面方式得出StackBlock

    int a = 10;
    void ( __weak ^block)(void) = ^{
        NSLog(@"----%d",a);
    };

    // block_copy
    NSLog(@"%@",block);
打印結果是
<__NSStackBlock__: 0x7ffeed6d53f8>

2.Block的循環引用和解決

循環引用

在ViewController聲明兩個屬性

typedef void(^MyVoidBlock)(void);
@property (nonatomic, copy) MyVoidBlock myVoidBlock;
@property (nonatomic, copy) NSString *name;
  self.name = @"iOS";
    self.myVoidBlock = ^{
        NSLog(@"%@",self.name);
    };

我們會看到有warning ：Capturing 'self' strongly in this block is likely to lead to a retain cycle
提示循環引用，當我們退出ViewController時，dealloc沒有被調用

BlockRetain.png

循環引用的解決

1.__weak和__strong

   __weak typeof(self) weakSelf = self;
    self.myVoidBlock = ^{
        NSLog(@"%@",weakSelf.name);
    };
    self.myVoidBlock();

當我們退出VC時，delloc方法確實走到了，說明循環引用解決了。但是如果block內存在耗時操作，當我們VC退出后，才會調用weakSelf呢？

    __weak typeof(self) weakSelf = self;
    self.myVoidBlock = ^{
        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
            NSLog(@"%@",weakSelf.name);

        });
    };
    self.myVoidBlock();
-(void)dealloc {
    NSLog(@"%s",__func__);
}

dealloc確實走了，但是我們的打印名字出現了問題

 -[ViewController dealloc]
(null)

這明顯不是我們希望的，我們希望打印完名字之后對象再被釋放。

  self.name = @"iOS";
    __weak typeof(self) weakSelf = self;
    self.myVoidBlock = ^{
        __strong typeof(weakSelf)  strongSelf = weakSelf;
        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
            NSLog(@"%@",strongSelf.name);

        });
    };
    self.myVoidBlock();

打印按照我們的預期打印。
2.__block解決循環引用

   __block ViewController *vc = self;
    self.myVoidBlock = ^{
        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
            NSLog(@"%@",vc.name);
            vc = nil;
        });
    };
    self.myVoidBlock();

打印結果正常

iOS
-[ViewController dealloc]

但是如果block沒被調用則ViewController對象不會被釋放
3.作為參數解決循環引用

    self.myVoidBlock = ^(ViewController *vc){
        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
            NSLog(@"%@",vc.name);

        });
    };
    self.myVoidBlock(self);

打印結果正常

3.Block的底層原理

1.匯編看Block底層

image.png

在block前面打斷點，看匯編

image.png

我們看到關鍵信息objc_retainBlock，在objc源碼中看出objc_retainBlock底層實現時
_Block_copy。下符號斷點objc_retainBlock研究
1.全局block

  void(^block)(void) = ^{
        NSLog(@"----");
    };

在符號斷點處objc_retainBlock，讀取寄存器，

 register read x0
      x0 = 0x0000000102388028  001---Block深入淺出`__block_literal_global
 po 0x0000000102388028
<__NSGlobalBlock__: 0x102388028>
 signature: "v8@?0"
 invoke   : 0x102386288 (/private/var/containers/Bundle/Application/00B30C0F-7E4D-4B6C-B351-9EB5A91223DA/001---Blockê∑±???êμ??á∫.app/001---Blockê∑±???êμ??á∫`__29-[ViewController viewDidLoad]_block_invoke)

2.堆block

  int a= 10;
    void(^block)(void) = ^{
        NSLog(@"----%d",a);
    };

同樣在objc_retainBlock符號斷點處，讀寄存器信息

) register read x0
      x0 = 0x000000016f40b4f8
 po 0x000000016f40b4f8
<__NSStackBlock__: 0x16f40b4f8>
 signature: "v8@?0"
 invoke   : 0x1009f6264 (/private/var/containers/Bundle/Application/A4407F87-FF50-4D6F-AA84-CCA6CDA6BCA6/001---Blockê∑±???êμ??á∫.app/001---Blockê∑±???êμ??á∫`__29-[ViewController viewDidLoad]_block_invoke)

單步調試，在objc_retainBlock返回時讀寄存器

register read x0
      x0 = 0x0000000281e3a0d0
 po 0x0000000281e3a0d0
<__NSMallocBlock__: 0x281e3a0d0>
 signature: "v8@?0"
 invoke   : 0x1009f6264 (/private/var/containers/Bundle/Application/A4407F87-FF50-4D6F-AA84-CCA6CDA6BCA6/001---Blockê∑±???êμ??á∫.app/001---Blockê∑±???êμ??á∫`__29-[ViewController viewDidLoad]_block_invoke)

2.結合源碼看block簽名信息

我們在Block_private.h先查看Block的結構源碼地址

#define BLOCK_DESCRIPTOR_1 1
struct Block_descriptor_1 {
    uintptr_t reserved;
    uintptr_t size;
};

// 可選
#define BLOCK_DESCRIPTOR_2 1
struct Block_descriptor_2 {
    // requires BLOCK_HAS_COPY_DISPOSE
    BlockCopyFunction copy;
    BlockDisposeFunction dispose;
};

#define BLOCK_DESCRIPTOR_3 1
struct Block_descriptor_3 {
    // requires BLOCK_HAS_SIGNATURE
    const char *signature;
    const char *layout;     // contents depend on BLOCK_HAS_EXTENDED_LAYOUT
};
struct Block_layout {
    void *isa;
    volatile int32_t flags; // contains ref count
    int32_t reserved;
    BlockInvokeFunction invoke;
    struct Block_descriptor_1 *descriptor; //
    // imported variables
};

Block_layout是Block的底層實現，
Block_layout中的flags

第1 位，釋放標記，-般常用 BLOCK_NEEDS_FREE 做 位與 操作，一同傳入 Flags ， 告知該 block 可釋放。
低16位，存儲引用計數的值;是一個可選用參數 第24位，低16是否有效的標志，程序根據它來決定是否增加或是減少引用計數位的 值;
第25位，是否擁有拷貝輔助函數(a copy helper function); 第26位，是否擁有 block 析構函數; 第27位，標志是否有垃圾回收;//OS X 第28位，標志是否是全局block;
第30位，與 BLOCK_USE_STRET 相對，判斷是否當前 block 擁有一個簽名。用于 runtime 時動態調用。

我們在Block_descriptor_3看到了關于簽名的內容signature，但是Block_descriptor_3怎么能得到呢
我們在runtime.cpp看到了如下內容

#if 0
static struct Block_descriptor_1 * _Block_descriptor_1(struct Block_layout *aBlock)
{
    return aBlock->descriptor;
}
#endif

static struct Block_descriptor_2 * _Block_descriptor_2(struct Block_layout *aBlock)
{
    if (! (aBlock->flags & BLOCK_HAS_COPY_DISPOSE)) return NULL;
    uint8_t *desc = (uint8_t *)aBlock->descriptor;
    desc += sizeof(struct Block_descriptor_1);
    return (struct Block_descriptor_2 *)desc;
}

static struct Block_descriptor_3 * _Block_descriptor_3(struct Block_layout *aBlock)
{
    if (! (aBlock->flags & BLOCK_HAS_SIGNATURE)) return NULL;
    uint8_t *desc = (uint8_t *)aBlock->descriptor;
    desc += sizeof(struct Block_descriptor_1);
    if (aBlock->flags & BLOCK_HAS_COPY_DISPOSE) {
        desc += sizeof(struct Block_descriptor_2);
    }
    return (struct Block_descriptor_3 *)desc;
}

Block_descriptor_3的讀取，先通過flags判斷是否存在，然后再通過內存平移得到

WeChatc302e0e43c7ea2fd4cc095c666b593f7.png

我們通過拿到的字符串簽名，查看[NSMethodSignature signatureWithObjCTypes:"v8@?0"]

<NSMethodSignature: 0x80bccfb625c2193f>
    number of arguments = 1
    frame size = 224
    is special struct return? NO
    return value: -------- -------- -------- --------
        type encoding (v) 'v'
        flags {}
        modifiers {}
        frame {offset = 0, offset adjust = 0, size = 0, size adjust = 0}
        memory {offset = 0, size = 0}
    argument 0: -------- -------- -------- --------
        type encoding (@) '@?'
        flags {isObject, isBlock}
        modifiers {}
        frame {offset = 0, offset adjust = 0, size = 8, size adjust = 0}
        memory {offset = 0, size = 8}

3.Block的三層Copy

我們分析__block的對象類型

   __block NSString *lg_name = [NSString stringWithFormat:@"cooci"];
        void (^block1)(void) = ^{ // block_copy
            lg_name = @"LG_Cooci";
            NSLog(@"LG_Block - %@",lg_name);
            
            // block 內存
        };
        block1();

經過clang編譯后block的結構是

struct __main_block_impl_0 {
  struct __block_impl impl;
  struct __main_block_desc_0* Desc;
  __Block_byref_lg_name_0 *lg_name; // by ref
  __main_block_impl_0(void *fp, struct __main_block_desc_0 *desc, __Block_byref_lg_name_0 *_lg_name, int flags=0) : lg_name(_lg_name->__forwarding) {
    impl.isa = &_NSConcreteStackBlock;
    impl.Flags = flags;
    impl.FuncPtr = fp;
    Desc = desc;
  }
};

通過clang查看編譯后的cpp，再結合block源碼
1.第一層copy。
我們知道我們創建的Block在引用外部變量的情況下是棧block，但是通過變量持有就變成堆block。因為經過了objc_retainBlock，底層實現_Block_copy。
因為是從棧到堆，我們只研究棧copy

void *_Block_copy(const void *arg) {
 struct Block_layout *result =
            (struct Block_layout *)malloc(aBlock->descriptor->size);
        if (!result) return NULL;
        memmove(result, aBlock, aBlock->descriptor->size); // bitcopy first

        // reset refcount
        result->flags &= ~(BLOCK_REFCOUNT_MASK|BLOCK_DEALLOCATING);    // XXX not needed
        result->flags |= BLOCK_NEEDS_FREE | 2;  // logical refcount 1
        _Block_call_copy_helper(result, aBlock);
        // Set isa last so memory analysis tools see a fully-initialized object.
        result->isa = _NSConcreteMallocBlock;
        return result;
}

我們看到重新malloc一個Block,并且memmove，可知也把lg_namecopy進去了，這是第一次copy
2.第二層copy
在_Block_copy中我們看到_Block_call_copy_helper

static void _Block_call_copy_helper(void *result, struct Block_layout *aBlock)
{
    struct Block_descriptor_2 *desc = _Block_descriptor_2(aBlock);
    if (!desc) return;

    (*desc->copy)(result, aBlock); // do fixup
}

我們發現了 (*desc->copy)(result, aBlock)，在clang下看一下desc的結構

static struct __main_block_desc_0 {
  size_t reserved;
  size_t Block_size;
  void (*copy)(struct __main_block_impl_0*, struct __main_block_impl_0*);
  void (*dispose)(struct __main_block_impl_0*);
} __main_block_desc_0_DATA = { 0, sizeof(struct __main_block_impl_0), __main_block_copy_0, __main_block_dispose_0};

(*desc->copy)在我們實例中的實現是__main_block_copy_0，

static void __main_block_copy_0(struct __main_block_impl_0*dst, struct __main_block_impl_0*src) {
_Block_object_assign((void*)&dst->lg_name, (void*)src->lg_name, 8/*BLOCK_FIELD_IS_BYREF*/);
}

在源碼中查看_Block_object_assign實現，我們只看__blcok 對象的內容

void _Block_object_assign(void *destArg, const void *object, const int flags) {
    const void **dest = (const void **)destArg;
     case BLOCK_FIELD_IS_BYREF:
        /*******
         // copy the onstack __block container to the heap
         // Note this __weak is old GC-weak/MRC-unretained.
         // ARC-style __weak is handled by the copy helper directly.
         __block ... x;
         __weak __block ... x;
         [^{ x; } copy];
         ********/
            
        *dest = _Block_byref_copy(object);
        break;
}

查看_Block_byref_copy主要代碼

 struct Block_byref *copy = (struct Block_byref *)malloc(src->size);
        copy->isa = NULL;
        // byref value 4 is logical refcount of 2: one for caller, one for stack
        copy->flags = src->flags | BLOCK_BYREF_NEEDS_FREE | 4;
        
        // 問題 - block 內部 持有的 Block_byref 鎖持有的對象 是不是同一個
        copy->forwarding = copy; // patch heap copy to point to itself
        src->forwarding = copy;  // patch stack to point to heap copy
        
        copy->size = src->size;

        if (src->flags & BLOCK_BYREF_HAS_COPY_DISPOSE) {
            // Trust copy helper to copy everything of interest
            // If more than one field shows up in a byref block this is wrong XXX
            struct Block_byref_2 *src2 = (struct Block_byref_2 *)(src+1);
            struct Block_byref_2 *copy2 = (struct Block_byref_2 *)(copy+1);
            copy2->byref_keep = src2->byref_keep;
            copy2->byref_destroy = src2->byref_destroy;

            if (src->flags & BLOCK_BYREF_LAYOUT_EXTENDED) {
                struct Block_byref_3 *src3 = (struct Block_byref_3 *)(src2+1);
                struct Block_byref_3 *copy3 = (struct Block_byref_3*)(copy2+1);
                copy3->layout = src3->layout;
            }

            (*src2->byref_keep)(copy, src);

我們看到struct Block_byref *copy = (struct Block_byref *)malloc(src->size);這是第二層copy。
3.第三層copy
在_Block_byref_copy中我們看到src2->byref_keep，查看clang下代碼

struct __Block_byref_lg_name_0 {
  void *__isa;
__Block_byref_lg_name_0 *__forwarding;
 int __flags;
 int __size;
 void (*__Block_byref_id_object_copy)(void*, void*);
 void (*__Block_byref_id_object_dispose)(void*);  // 5*8 = 40
 NSString *lg_name;
};

看源碼關于byref的定義

struct Block_byref {
    void *isa;
    struct Block_byref *forwarding;
    volatile int32_t flags; // contains ref count
    uint32_t size;
};

struct Block_byref_2 {
    // requires BLOCK_BYREF_HAS_COPY_DISPOSE
    BlockByrefKeepFunction byref_keep; // 結構體 __block  對象
    BlockByrefDestroyFunction byref_destroy;
};

可知src2->byref_keep，在clang中調用的是__Block_byref_id_object_copy，看到賦值是__Block_byref_id_object_copy_131

static void __Block_byref_id_object_copy_131(void *dst, void *src) {
    _Block_object_assign((char*)dst + 40, *(void * *) ((char*)src + 40), 131);
}

_Block_object_assign中

//flag是131 128+3 為BLOCK_BYREF_CALLER和BLOCK_FIELD_IS_OBJECT
void _Block_object_assign(void *destArg, const void *object, const int flags) {
    const void **dest = (const void **)destArg;
   
    switch (os_assumes(flags & BLOCK_ALL_COPY_DISPOSE_FLAGS)) {
     
        case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_OBJECT:
      case BLOCK_BYREF_CALLER | BLOCK_FIELD_IS_BLOCK:
    

        *dest = object;
        break;
}

完成三層copy。
4.Block的銷毀
首先調用_Block_release

void _Block_release(const void *arg) {
    struct Block_layout *aBlock = (struct Block_layout *)arg;
    if (!aBlock) return;
    if (aBlock->flags & BLOCK_IS_GLOBAL) return;
    if (! (aBlock->flags & BLOCK_NEEDS_FREE)) return;

    if (latching_decr_int_should_deallocate(&aBlock->flags)) {
        _Block_call_dispose_helper(aBlock);
        _Block_destructInstance(aBlock);
        free(aBlock);
    }
}
static void _Block_call_dispose_helper(struct Block_layout *aBlock)
{
    struct Block_descriptor_2 *desc = _Block_descriptor_2(aBlock);
    if (!desc) return;

    (*desc->dispose)(aBlock);
}

desc->dispose對應cpp中的__main_block_dispose_0

static void __main_block_dispose_0(struct __main_block_impl_0*src) {_Block_object_dispose((void*)src->lg_name, 8/*BLOCK_FIELD_IS_BYREF*/);}

在Block源碼_Block_object_dispose中 flags為8 BLOCK_FIELD_IS_BYREF

void _Block_object_dispose(const void *object, const int flags) {
    switch (os_assumes(flags & BLOCK_ALL_COPY_DISPOSE_FLAGS)) {
      case BLOCK_FIELD_IS_BYREF | BLOCK_FIELD_IS_WEAK:
      case BLOCK_FIELD_IS_BYREF:
        // get rid of the __block data structure held in a Block
        _Block_byref_release(object);
break;
}
static void _Block_byref_release(const void *arg) {
    struct Block_byref *byref = (struct Block_byref *)arg;

    // dereference the forwarding pointer since the compiler isn't doing this anymore (ever?)
    byref = byref->forwarding;
    
    if (byref->flags & BLOCK_BYREF_NEEDS_FREE) {
        int32_t refcount = byref->flags & BLOCK_REFCOUNT_MASK;
        os_assert(refcount);
        if (latching_decr_int_should_deallocate(&byref->flags)) {
            if (byref->flags & BLOCK_BYREF_HAS_COPY_DISPOSE) {
                struct Block_byref_2 *byref2 = (struct Block_byref_2 *)(byref+1);
                (*byref2->byref_destroy)(byref);
            }
            free(byref);
        }
    }
}

byref2->byref_destroy對應cpp中的__Block_byref_id_object_dispose_131

static void __Block_byref_id_object_dispose_131(void *src) {
 _Block_object_dispose(*(void * *) ((char*)src + 40), 131);
}

為什么用會有src + 40我們來看Block_byref結構

struct __Block_byref_lg_name_0 {
  void *__isa;
__Block_byref_lg_name_0 *__forwarding;
 int __flags;
 int __size;
 void (*__Block_byref_id_object_copy)(void*, void*);
 void (*__Block_byref_id_object_dispose)(void*);
 NSString *lg_name;
};

131等于BLOCK_BYREF_CALLER的128加上BLOCK_FIELD_IS_OBJECT的3
_Block_object_dispose不做處理。

_Block_release===》Block 中desc的dispose====〉_Block_object_dispose

clang -x objective-c -rewrite-objc -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk

clang -rewrite-objc -fobjc-arc -framework Foundation main2.m -o main2.cpp
Xcrun