一、准备工作

• 1、创建工程：macOS -> Command Line Tool

二、开始探究

• 1、以NSObject为例：

#import <Foundation/Foundation.h>

#import <malloc/malloc.h>
#import <objc/runtime.h>

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        NSObject *obj = [[NSObject alloc] init];
        //获取成员变量ivars占用的字节大小 ==> 8
        NSLog(@"%zu", class_getInstanceSize([NSObject class]));
        //获取实际分配的内存大小 ==> 16
        NSLog(@"%zu", malloc_size((__bridge const void *)(obj)));
    }
    return 0;
}

将OC转化为C++：

xcrun -sdk iphoneos clang -arch arm64 -rewrite-objc main.m -o main.cpp

查看内存分布

• a. 方法一：Debug -> Debug Workflow -> View Memory（快捷键：Ctrl+Option+Shift+Cmd+M），之后在Address里输入obj的内存地址后回车。
• b. 方法二：用lldb查看：x/4xg obj_ptr。

分配内存大小

#import <Foundation/Foundation.h>

#import <malloc/malloc.h>
#import <objc/runtime.h>

@interface MZPerson : NSObject

//struct NSObject_IMPL NSObject_IVARS; //8
@property (nonatomic, strong) NSString *name;//8
@property (nonatomic, assign) NSInteger age;//8

/**
 属性在底层的实现
 struct MZPerson_IMPL {
     struct NSObject_IMPL NSObject_IVARS;
     NSString *_name;
     NSInteger _age;
 };
*/

@end

@implementation MZPerson
@end

@interface MZStudent : MZPerson

//struct MZPerson_IMPL MZPerson_IVARS; //24
@property (nonatomic, assign) double height;//8

/**
 属性在底层的实现
 struct MZStudent_IMPL {
     struct MZPerson_IMPL MZPerson_IVARS;
     double _height;
 };
 */

@end

@implementation MZStudent
@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        MZPerson *person = [[MZPerson alloc] init];
        MZStudent *student = [[MZStudent alloc] init];
        
        NSLog(@"MZPerson: %zd", class_getInstanceSize(MZPerson.class));//实际占用24
        NSLog(@"MZPerson: %zd", malloc_size((__bridge const void *)(person)));//分配内存大小必须是16的倍数, 32
        NSLog(@"MZStudent: %zd", class_getInstanceSize(MZStudent.class));//实际占用32
        NSLog(@"MZStudent: %zd", malloc_size((__bridge const void *)(student)));//分配内存大小必须是16的倍数, 32
    }
    return 0;
}

考察isa和superclass

isa与superclass 1.png

#import <Foundation/Foundation.h>

@interface MZPerson : NSObject

+ (void)test;

@end

@implementation MZPerson
@end

//NSObject的分类
@interface NSObject (MZExtension)

+ (void)test;

@end

@implementation NSObject (MZExtension)
// 在这个方法没有被注释的时候，会调用该方法；注释之后，调用`-test`方法
//+ (void)test {
//    NSLog(@"%s", __func__);
//}

- (void)test {
    NSLog(@"%s", __func__);
}

@end

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        
        [MZPerson test];
    }
    return 0;
}

//打印：-[NSObject(MZExtension) test]

解析：首先要知道类方法存储在元类里。当在MZPerson元类里找不到test方法时，则元类通过superclass找父类的元类，很显然，父类的元类是NSObject的元类。我们通过分类，给NSObject添加了+test方法，该方法会存储在NSObject的元类里，能找到，直接调用该方法，如代码里注释所示。当+test的方法被注释时，NSObject的元类里找不到test方法，NSObject的元类会通过superclass找到它的父类，也就是NSObject。由于NSObject里有一个-test方法，所以就可以直接调用了。
另外：无论是类方法还是实例方法，在底层的调用都是通过 objc_msgSend(obj, sel_registerName("selName")); 这种形式调用的，唯一不同的是调用对象是类还是实例对象而已。

MJ老师整理的ClassInfo类

# if __arm64__
#   define ISA_MASK        0x0000000ffffffff8ULL
# elif __x86_64__
#   define ISA_MASK        0x00007ffffffffff8ULL
# endif

#if __LP64__
typedef uint32_t mask_t;
#else
typedef uint16_t mask_t;
#endif
typedef uintptr_t cache_key_t;

struct bucket_t {
    cache_key_t _key;
    IMP _imp;
};

struct cache_t {
    bucket_t *_buckets;
    mask_t _mask;
    mask_t _occupied;
};

struct entsize_list_tt {
    uint32_t entsizeAndFlags;
    uint32_t count;
};

struct method_t {
    SEL name;
    const char *types;
    IMP imp;
};

struct method_list_t : entsize_list_tt {
    method_t first;
};

struct ivar_t {
    int32_t *offset;
    const char *name;
    const char *type;
    uint32_t alignment_raw;
    uint32_t size;
};

struct ivar_list_t : entsize_list_tt {
    ivar_t first;
};

struct property_t {
    const char *name;
    const char *attributes;
};

struct property_list_t : entsize_list_tt {
    property_t first;
};

struct chained_property_list {
    chained_property_list *next;
    uint32_t count;
    property_t list[0];
};

typedef uintptr_t protocol_ref_t;
struct protocol_list_t {
    uintptr_t count;
    protocol_ref_t list[0];
};

struct class_ro_t {
    uint32_t flags;
    uint32_t instanceStart;
    uint32_t instanceSize;  // instance对象占用的内存空间
#ifdef __LP64__
    uint32_t reserved;
#endif
    const uint8_t * ivarLayout;
    const char * name;  // 类名
    method_list_t * baseMethodList;
    protocol_list_t * baseProtocols;
    const ivar_list_t * ivars;  // 成员变量列表
    const uint8_t * weakIvarLayout;
    property_list_t *baseProperties;
};

struct class_rw_t {
    uint32_t flags;
    uint32_t version;
    const class_ro_t *ro;
    method_list_t * methods;    // 方法列表
    property_list_t *properties;    // 属性列表
    const protocol_list_t * protocols;  // 协议列表
    Class firstSubclass;
    Class nextSiblingClass;
    char *demangledName;
};

#define FAST_DATA_MASK          0x00007ffffffffff8UL
struct class_data_bits_t {
    uintptr_t bits;
public:
    class_rw_t* data() {
        return (class_rw_t *)(bits & FAST_DATA_MASK);
    }
};

/* OC对象 */
struct mj_objc_object {
    void *isa;
};

/* 类对象 */
struct mj_objc_class : mj_objc_object {
    Class superclass;
    cache_t cache;
    class_data_bits_t bits;
public:
    class_rw_t* data() {
        return bits.data();
    }
    
    mj_objc_class* metaClass() {
        return (mj_objc_class *)((long long)isa & ISA_MASK);
    }
};

使用：

MJStudent *stu = [[MJStudent alloc] init];
        stu->_weight = 10;
        
        mj_objc_class *studentClass = (__bridge mj_objc_class *)([MJStudent class]);
        mj_objc_class *personClass = (__bridge mj_objc_class *)([MJPerson class]);
        
        class_rw_t *studentClassData = studentClass->data();
        class_rw_t *personClassData = personClass->data();
        
        class_rw_t *studentMetaClassData = studentClass->metaClass()->data();
        class_rw_t *personMetaClassData = personClass->metaClass()->data();

补充常用lldb命令：