iOS内存管理方案有：
-
MRC和ARC -
Tagged Pointer:专门用来处理小对象，例如NSNumber、NSDate、小NSString等 -
Nonpointer_isa:非指针类型的isa，主要是用来优化64位地址 -
SideTables:散列表，在散列表中主要有两个表，分别是引用计数表、弱引用表
Tagged Pointer
在学习Tagged Pointer前建议先去看下2020WWDC里面关于小对象类型的更新介绍
- 普通对象：通过
指针地址找到内存 - 小对象类型：是
指针+值的形式，这样不用去访问内存从而就能获取到值，这样的话效率会高很多
我们现在源码中搜索 TaggedPointer看过2020WWDC的应该会对playload比较敏感，而且decoded这个注释我们猜测小对象类型实际上是通过加密、解密的方式进行存储和读取
image.png
最终我们找到_objc_makeTaggedPointer这个方法，在这个方法中调用了_objc_encodeTaggedPointer方法，也就是对小对象类型进行加密
// 小对象类型加密
static inline void * _Nonnull
_objc_encodeTaggedPointer(uintptr_t ptr)
{
// 通过 异或的方式进行加密
uintptr_t value = (objc_debug_taggedpointer_obfuscator ^ ptr);
#if OBJC_SPLIT_TAGGED_POINTERS
// 如果 满足下面条件就不进行加密
if ((value & _OBJC_TAG_NO_OBFUSCATION_MASK) == _OBJC_TAG_NO_OBFUSCATION_MASK)
return (void *)ptr;
uintptr_t basicTag = (value >> _OBJC_TAG_INDEX_SHIFT) & _OBJC_TAG_INDEX_MASK;
uintptr_t permutedTag = _objc_basicTagToObfuscatedTag(basicTag);
value &= ~(_OBJC_TAG_INDEX_MASK << _OBJC_TAG_INDEX_SHIFT);
value |= permutedTag << _OBJC_TAG_INDEX_SHIFT;
#endif
return (void *)value;
}
/// 小对象类型解密
static inline uintptr_t
_objc_decodeTaggedPointer_noPermute(const void * _Nullable ptr)
{
uintptr_t value = (uintptr_t)ptr;
#if OBJC_SPLIT_TAGGED_POINTERS
// 如果满足下述条件 则不需要解密
if ((value & _OBJC_TAG_NO_OBFUSCATION_MASK) == _OBJC_TAG_NO_OBFUSCATION_MASK)
return value;
#endif
return value ^ objc_debug_taggedpointer_obfuscator;
}
static inline uintptr_t
_objc_decodeTaggedPointer(const void * _Nullable ptr)
{
// 解密
uintptr_t value = _objc_decodeTaggedPointer_noPermute(ptr);
#if OBJC_SPLIT_TAGGED_POINTERS
uintptr_t basicTag = (value >> _OBJC_TAG_INDEX_SHIFT) & _OBJC_TAG_INDEX_MASK;
value &= ~(_OBJC_TAG_INDEX_MASK << _OBJC_TAG_INDEX_SHIFT);
value |= _objc_obfuscatedTagToBasicTag(basicTag) << _OBJC_TAG_INDEX_SHIFT;
#endif
return value;
}
static inline void * _Nonnull
_objc_makeTaggedPointer(objc_tag_index_t tag, uintptr_t value)
{
// PAYLOAD_LSHIFT and PAYLOAD_RSHIFT are the payload extraction shifts.
// They are reversed here for payload insertion.
// ASSERT(_objc_taggedPointersEnabled());
if (tag <= OBJC_TAG_Last60BitPayload) {
// ASSERT(((value << _OBJC_TAG_PAYLOAD_RSHIFT) >> _OBJC_TAG_PAYLOAD_LSHIFT) == value);
uintptr_t result =
(_OBJC_TAG_MASK |
((uintptr_t)tag << _OBJC_TAG_INDEX_SHIFT) |
((value << _OBJC_TAG_PAYLOAD_RSHIFT) >> _OBJC_TAG_PAYLOAD_LSHIFT));
return _objc_encodeTaggedPointer(result);
} else {
// ASSERT(tag >= OBJC_TAG_First52BitPayload);
// ASSERT(tag <= OBJC_TAG_Last52BitPayload);
// ASSERT(((value << _OBJC_TAG_EXT_PAYLOAD_RSHIFT) >> _OBJC_TAG_EXT_PAYLOAD_LSHIFT) == value);
uintptr_t result =
(_OBJC_TAG_EXT_MASK |
((uintptr_t)(tag - OBJC_TAG_First52BitPayload) << _OBJC_TAG_EXT_INDEX_SHIFT) |
((value << _OBJC_TAG_EXT_PAYLOAD_RSHIFT) >> _OBJC_TAG_EXT_PAYLOAD_LSHIFT));
return _objc_encodeTaggedPointer(result);
}
}
由上述代码发现在加密和解密方法中都调用objc_debug_taggedpointer_obfuscator这个东西和value进行异或运算,所谓的异或运算就是两段二进制进行运算，相同为0，不相同为1。
objc_debug_taggedpointer_obfuscator其实就是个随机数，他是在类的加载阶段生成的
image.png
看到
_read_images方法是不是很熟悉，这是我们前面讲类的加载篇章讲解的，接下来进入到initializeTaggedPointerObfuscator来看下
static void
initializeTaggedPointerObfuscator(void)
{
if (!DisableTaggedPointerObfuscation) {
// Pull random data into the variable, then shift away all non-payload bits.
arc4random_buf(&objc_debug_taggedpointer_obfuscator,
sizeof(objc_debug_taggedpointer_obfuscator));
objc_debug_taggedpointer_obfuscator &= ~_OBJC_TAG_MASK;
#if OBJC_SPLIT_TAGGED_POINTERS
// The obfuscator doesn't apply to any of the extended tag mask or the no-obfuscation bit.
objc_debug_taggedpointer_obfuscator &= ~(_OBJC_TAG_EXT_MASK | _OBJC_TAG_NO_OBFUSCATION_MASK);
// Shuffle the first seven entries of the tag permutator.
int max = 7;
for (int i = max - 1; i >= 0; i--) {
int target = arc4random_uniform(i + 1);
swap(objc_debug_tag60_permutations[I],
objc_debug_tag60_permutations[target]);
}
#endif
} else {
// Set the obfuscator to zero for apps linked against older SDKs,
// in case they're relying on the tagged pointer representation.
objc_debug_taggedpointer_obfuscator = 0;
}
}
由上述代码可知这里对DisableTaggedPointerObfuscation进行了判断，如果为false则对objc_debug_taggedpointer_obfuscator这个地址指向的内存进行空间开辟和随机数赋值。否则objc_debug_taggedpointer_obfuscator为0
DisableTaggedPointerObfuscation是下述代码，这里先记一下，后面要用
OPTION( DisableTaggedPointerObfuscation, OBJC_DISABLE_TAG_OBFUSCATION, "disable obfuscation of tagged pointers")
【注意】下述讲解全部基于arm64架构下，x86架构下会有所不同
通过上述讲解，知道了小对象类型其实就是通过对对象进行加密解密的过程，接下来我们实践一下
首先DisableTaggedPointerObfuscation这个东西是用来定义是否要加密,这个地方我们改成不加密的方式
image.png
首先我们发现这里的NSString为NSTaggedPointerString类型
image.png
这里将
指针地址打印成二进制的形式
image.png
接下来我们验证下
image.png
enum
#endif
{
// 60-bit payloads
OBJC_TAG_NSAtom = 0,
OBJC_TAG_1 = 1,
OBJC_TAG_NSString = 2,
OBJC_TAG_NSNumber = 3,
OBJC_TAG_NSIndexPath = 4,
OBJC_TAG_NSManagedObjectID = 5,
OBJC_TAG_NSDate = 6,
// 60-bit reserved
OBJC_TAG_RESERVED_7 = 7,
// 52-bit payloads
OBJC_TAG_Photos_1 = 8,
OBJC_TAG_Photos_2 = 9,
OBJC_TAG_Photos_3 = 10,
OBJC_TAG_Photos_4 = 11,
OBJC_TAG_XPC_1 = 12,
OBJC_TAG_XPC_2 = 13,
OBJC_TAG_XPC_3 = 14,
OBJC_TAG_XPC_4 = 15,
OBJC_TAG_NSColor = 16,
OBJC_TAG_UIColor = 17,
OBJC_TAG_CGColor = 18,
OBJC_TAG_NSIndexSet = 19,
OBJC_TAG_NSMethodSignature = 20,
OBJC_TAG_UTTypeRecord = 21,
// When using the split tagged pointer representation
// (OBJC_SPLIT_TAGGED_POINTERS), this is the first tag where
// the tag and payload are unobfuscated. All tags from here to
// OBJC_TAG_Last52BitPayload are unobfuscated. The shared cache
// builder is able to construct these as long as the low bit is
// not set (i.e. even-numbered tags).
OBJC_TAG_FirstUnobfuscatedSplitTag = 136, // 128 + 8, first ext tag with high bit set
OBJC_TAG_Constant_CFString = 136,
OBJC_TAG_First60BitPayload = 0,
OBJC_TAG_Last60BitPayload = 6,
OBJC_TAG_First52BitPayload = 8,
OBJC_TAG_Last52BitPayload = 263,
OBJC_TAG_RESERVED_264 = 264
};
- 上述代码是源码中的
对象类型对应的枚举值，我们打印出的为2,是个字符串没问题。 - 字符串长度也是2
-
115在ASSIC中代表s -
104在ASSIC中代表h
【结论】由上述证明小对象类型的值、对象类型都存储在指针地址里面
接下来看一个案例
- (void)taggedPointerDemo {
self.queue = dispatch_queue_create("com.cooci.cn", DISPATCH_QUEUE_CONCURRENT);
for (int i = 0; i<10000; i++) {
dispatch_async(self.queue, ^{
self.nameStr = [NSString stringWithFormat:@"sh"];
NSLog(@"%@",self.nameStr);
});
}
}
- (void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event{
NSLog(@"来了");
for (int i = 0; i<1000000; i++) {
dispatch_async(self.queue, ^{
self.nameStr = [NSString stringWithFormat:@"测试小对象类型taggedPointer"];
NSLog(@"%@",self.nameStr);
});
}
}
我们发现这里发生了崩溃
image.png
这里的NSString为小对象类型
image.png
这里的
NSString为正常的NSString
image.png
这里发生崩溃的原因是因为，这里启用了
多线程,导致NSString的release 和retain发生混乱
我们来看下retain和release的源码,发现这里对小对象类型进行了判断，如果是小对象类型直接return
image.png
image.png
由此可见小对象类型对运行效率会大大的提升
image.png
