本文是基于objc4-818来进行编写的

_objc_init

void _objc_init(void)
{
    static bool initialized = false;
    if (initialized) return;
    initialized = true;
    
    // fixme defer initialization until an objc-using image is found?
    environ_init();
    tls_init();
    static_init();
    runtime_init();
    exception_init();
#if __OBJC2__
    cache_t::init();
#endif
    _imp_implementationWithBlock_init();

    _dyld_objc_notify_register(&map_images, load_images, unmap_image);

#if __OBJC2__
    didCallDyldNotifyRegister = true;
#endif 
}

• environ_init()
  读取影响运行时的环境变量。
• tls_init()
  关于线程key的绑定 - 比如每线程数据的析构函数
• static_init()
  运行C++静态构造函数。在dyld调用我们的静态构造函数之前，libc 会调用_objc_init()，因此我们必须自己做
• runtime_init()
  runtime运行时环境初始化
• exception_init()
  初始化libobjc的异常处理系统
• cache_t::init()
  准备缓存，缓存初始化
• _imp_implementationWithBlock_init()
  启动回调机制。通常这不会做什么，因为所有的初始化都
  是惰性的，但是对于某些进程，我们会迫不及待地加载trampolines dylib
• _dyld_objc_notify_register(&map_images, load_images, unmap_image)
  dyld通过map_images、load_images和unmap_image将macho中的类信息加载到内存，并加载类信息

_dyld_objc_notify_register(&map_images, load_images, unmap_image)

我们知道代码编译后会产生macho文件，macho文件中就存储了所有的符号，程序的运行，就是符号的调用结果。
代码 → 编译 → Macho → 内存，我们的程序就能运行起来了

• map_images
  管理文件和动态库中的符号(class、selector、category、……)
• load_images
  加载load方法

map_images

这里的map_images前面加了&符号，是引用类型，内部产生变化，外界会跟着一起变化

• map_images源码

void
map_images(unsigned count, const char * const paths[],
           const struct mach_header * const mhdrs[])
{
    mutex_locker_t lock(runtimeLock);
    return map_images_nolock(count, paths, mhdrs);
}

• map_images_nolock源码

void 
map_images_nolock(unsigned mhCount, const char * const mhPaths[],
                  const struct mach_header * const mhdrs[])
{
    // 省略准备代码

    // Find all images with Objective-C metadata. 找出images中所有Objective-C元数据
    hCount = 0;

    // Count classes. Size various table based on the total.
    int totalClasses = 0;  //类的个数
    int unoptimizedTotalClasses = 0; // 未优化的Classes
    {
      // 省略计算totalClasses、unoptimizedTotalClasses、hCount的个数的代码
    }

    if (hCount > 0) {
       // 加载镜像文件
        _read_images(hList, hCount, totalClasses, unoptimizedTotalClasses);
    }

    firstTime = NO;
    
    // Call image load funcs after everything is set up.调用镜像加载功能
    for (auto func : loadImageFuncs) {
        for (uint32_t i = 0; i < mhCount; i++) {
            func(mhdrs[i]);
        }
    }
}

这部分代码，主要做一系列的准备工作，其目的是找出hCount、totalClasses，unoptimizedTotalClasses为read_image做准备。

_read_images

_read_images主要有以下的几部分

1. 条件控制进行的一次加载
2. 修复预编译阶段的@selector的混乱问题
3. 错误混乱的类处理
4. 修复重映射一些没有被镜像文件加载进来的类
5. 修复一些消息
6. 当类里面有协议时：readProtocol 读取协议
7. 修复没有被加载的协议
8. 分类处理
9. 类的加载处理
10. 没有被处理的类，优化那些被侵犯的类

条件控制进行的一次加载

if (!doneOnce) { // 这里只会执行一次
        doneOnce = YES; 
        launchTime = YES;

        // ……省略各种系统判断和支持
        // namedClasses
        // Preoptimized classes don't go in this table.
        // 4/3 is NXMapTable's load factor
        int namedClassesSize = 
            (isPreoptimized() ? unoptimizedTotalClasses : totalClasses) * 4 / 3;
        gdb_objc_realized_classes =
            NXCreateMapTable(NXStrValueMapPrototype, namedClassesSize);

        ts.log("IMAGE TIMES: first time tasks");
    }

这里doneOnce只会进来一次，我们可以看到进入这个if条件之后doneOnce就被改变为YES了，然后获取到namedClasses的大小，然后创建NXMapTable哈希表来快速存储，根据官方注释创建的哈希表的大小为namedClassesSize的4/3倍。

• gdb_objc_realized_classes
  查看gdb_objc_realized_classes的源码得知，gdb_objc_realized_classes的真正类型是NXMapTable，根据注释，我们知道gdb_objc_realized_classes实际上是不存在与dyld共享缓存的命名列表中，无论其是否实现，这个列表排除了懒加载类，这个列表的类必须通过getClass来获取

// This is a misnomer: gdb_objc_realized_classes is actually a list of 
// named classes not in the dyld shared cache, whether realized or not.
// This list excludes lazily named classes, which have to be looked up
// using a getClass hook.
NXMapTable *gdb_objc_realized_classes;  // exported for debuggers in objc-gdb.h

修复预编译阶段的@selector的混乱问题

// Fix up @selector references
    static size_t UnfixedSelectors;
    {
        mutex_locker_t lock(selLock);
        for (EACH_HEADER) {
            if (hi->hasPreoptimizedSelectors()) continue;

            bool isBundle = hi->isBundle();
            //通过_getObjc2SelectorRefs拿到Mach-O中的静态段__objc_selrefs
            SEL *sels = _getObjc2SelectorRefs(hi, &count);
            UnfixedSelectors += count;
            for (i = 0; i < count; i++) {
                const char *name = sel_cname(sels[i]);
                //注册sel操作，即将sel添加到
                SEL sel = sel_registerNameNoLock(name, isBundle);
                //当sel与sels[i]地址不一致时，需要调整为一致的
                if (sels[i] != sel) {
                    sels[i] = sel;
                }
            }
        }
    }
    ts.log("IMAGE TIMES: fix up selector references");

主要是通过通过_getObjc2SelectorRefs拿到Mach_O中的静态段__objc_selrefs，遍历列表调用sel_registerNameNoLock将SEL添加到namedSelectors哈希表中

• _getObjc2SelectorRefs
  _getObjc2*，从Mach_O中读取所需信息

//      function name                 content type     section name
GETSECT(_getObjc2SelectorRefs,        SEL,             "__objc_selrefs"); 
GETSECT(_getObjc2MessageRefs,         message_ref_t,   "__objc_msgrefs"); 
GETSECT(_getObjc2ClassRefs,           Class,           "__objc_classrefs");
GETSECT(_getObjc2SuperRefs,           Class,           "__objc_superrefs");
GETSECT(_getObjc2ClassList,           classref_t const,      "__objc_classlist");
GETSECT(_getObjc2NonlazyClassList,    classref_t const,      "__objc_nlclslist");
GETSECT(_getObjc2CategoryList,        category_t * const,    "__objc_catlist");
GETSECT(_getObjc2CategoryList2,       category_t * const,    "__objc_catlist2");
GETSECT(_getObjc2NonlazyCategoryList, category_t * const,    "__objc_nlcatlist");
GETSECT(_getObjc2ProtocolList,        protocol_t * const,    "__objc_protolist");
GETSECT(_getObjc2ProtocolRefs,        protocol_t *,    "__objc_protorefs");
GETSECT(getLibobjcInitializers,       UnsignedInitializer, "__objc_init_func");

• sel_registerNameNoLock && __sel_registerName
  通过sel_registerNameNoLock → __sel_registerName探索，如果!name则返回为0的SEL，search_builtins→_dyld_get_objc_selector，然后去_dyld中查找，如果找到了，则返回result(SEL)，没有则做inset，即将sel插入namedSelectors哈希表中

SEL sel_registerNameNoLock(const char *name, bool copy) {
    return __sel_registerName(name, 0, copy);  // NO lock, maybe copy
}

static SEL __sel_registerName(const char *name, bool shouldLock, bool copy) 
{
    SEL result = 0;

    if (shouldLock) selLock.assertUnlocked();
    else selLock.assertLocked();

    if (!name) return (SEL)0;

    result = search_builtins(name);
    if (result) return result;
    
    conditional_mutex_locker_t lock(selLock, shouldLock);
    auto it = namedSelectors.get().insert(name);
    if (it.second) {
        // No match. Insert.
        *it.first = (const char *)sel_alloc(name, copy);
    }
    return (SEL)*it.first;
}

错误混乱的类处理

//3、错误混乱的类处理
// Discover classes. Fix up unresolved future classes. Mark bundle classes.
bool hasDyldRoots = dyld_shared_cache_some_image_overridden();
//读取类：readClass
for (EACH_HEADER) {
    if (! mustReadClasses(hi, hasDyldRoots)) {
        // Image is sufficiently optimized that we need not call readClass()
        continue;
    }
    //从编译后的类列表中取出所有类，即从Mach-O中获取静态段__objc_classlist，是一个classref_t类型的指针
    classref_t const *classlist = _getObjc2ClassList(hi, &count);

    bool headerIsBundle = hi->isBundle();
    bool headerIsPreoptimized = hi->hasPreoptimizedClasses();

    for (i = 0; i < count; i++) {
        Class cls = (Class)classlist[i];//此时获取的cls只是一个地址
        Class newCls = readClass(cls, headerIsBundle, headerIsPreoptimized); //读取类，经过这步后，cls获取的值才是一个名字
        //经过调试，并未执行if里面的流程
        //初始化所有懒加载的类需要的内存空间，但是懒加载类的数据现在是没有加载到的，连类都没有初始化
        if (newCls != cls  &&  newCls) {
            // Class was moved but not deleted. Currently this occurs 
            // only when the new class resolved a future class.
            // Non-lazily realize the class below.
            //将非懒加载的类添加到数组中
            resolvedFutureClasses = (Class *)
                realloc(resolvedFutureClasses, 
                        (resolvedFutureClassCount+1) * sizeof(Class));
            resolvedFutureClasses[resolvedFutureClassCount++] = newCls;
        }
    }
}
ts.log("IMAGE TIMES: discover classes");

从Mach_O中获取所有的类，遍历所有的类，处理错误混乱的类，从最后的注释可知，这里处理的都只是非懒加载类

• cls
  这里我们看到了异常熟悉的cls，但：
  • 再没有经过readClass之前，即Class cls = (Class)classlist[i]时，这里的cls只是一个地址
  • 经过readClass之后，cls就转变为一个类名称了

修复重映射一些没有被镜像文件加载进来的类

    // Fix up remapped classes
    // Class list and nonlazy class list remain unremapped.
    // Class refs and super refs are remapped for message dispatching.
    
    if (!noClassesRemapped()) {
        for (EACH_HEADER) {
            Class *classrefs = _getObjc2ClassRefs(hi, &count);
            for (i = 0; i < count; i++) {
                remapClassRef(&classrefs[i]);
            }
            // fixme why doesn't test future1 catch the absence of this?
            classrefs = _getObjc2SuperRefs(hi, &count);
            for (i = 0; i < count; i++) {
                remapClassRef(&classrefs[i]);
            }
        }
    }

    ts.log("IMAGE TIMES: remap classes");

如果有重新映射的类，分别读取Mach_O中__objc_classrefs和__objc_superrefs的符号信息，通过remapClass来达到修复和重新映射的目的。

修复一些消息

主要是通过_getObjc2MessageRefs获取Mach-O的静态段 __objc_msgrefs，并遍历通过fixupMessageRef将函数指针进行注册，并fix为新的函数指针

#if SUPPORT_FIXUP
    //修复一些消息
    // Fix up old objc_msgSend_fixup call sites
    for (EACH_HEADER) {
        // _getObjc2MessageRefs 获取Mach-O的静态段 __objc_msgrefs
        message_ref_t *refs = _getObjc2MessageRefs(hi, &count);
        if (count == 0) continue;

        if (PrintVtables) {
            _objc_inform("VTABLES: repairing %zu unsupported vtable dispatch "
                         "call sites in %s", count, hi->fname());
        }
        //经过调试，并未执行for里面的流程
        //遍历将函数指针进行注册，并fix为新的函数指针
        for (i = 0; i < count; i++) {
            fixupMessageRef(refs+i);
        }
    }

    ts.log("IMAGE TIMES: fix up objc_msgSend_fixup");
#endif

当类里面有协议时：readProtocol 读取协议

//当类里面有协议时：readProtocol 读取协议
// Discover protocols. Fix up protocol refs. 发现协议。修正协议引用
// 遍历所有协议列表，并且将协议列表加载到Protocol的哈希表中
for (EACH_HEADER) {
    extern objc_class OBJC_CLASS_$_Protocol;
    //cls = Protocol类，所有协议和对象的结构体都类似，isa都对应Protocol类
    Class cls = (Class)&OBJC_CLASS_$_Protocol;
    ASSERT(cls);
    //获取protocol哈希表 -- protocol_map
    NXMapTable *protocol_map = protocols();
    bool isPreoptimized = hi->hasPreoptimizedProtocols();

    // Skip reading protocols if this is an image from the shared cache
    // and we support roots
    // Note, after launch we do need to walk the protocol as the protocol
    // in the shared cache is marked with isCanonical() and that may not
    // be true if some non-shared cache binary was chosen as the canonical
    // definition
    if (launchTime && isPreoptimized && cacheSupportsProtocolRoots) {
        if (PrintProtocols) {
            _objc_inform("PROTOCOLS: Skipping reading protocols in image: %s",
                         hi->fname());
        }
        continue;
    }

    bool isBundle = hi->isBundle();
    //通过_getObjc2ProtocolList 获取到Mach-O中的静态段__objc_protolist协议列表，
    //即从编译器中读取并初始化protocol
    protocol_t * const *protolist = _getObjc2ProtocolList(hi, &count);
    for (i = 0; i < count; i++) {
        //通过添加protocol到protocol_map哈希表中
        readProtocol(protolist[i], cls, protocol_map, 
                     isPreoptimized, isBundle);
    }
}

ts.log("IMAGE TIMES: discover protocols");

创建协议表protocol_map，类型为NXMapTable。即NXMapTable *protocol_map = protocols();，protocols()的源码如下

static NXMapTable *protocols(void)
{
    static NXMapTable *protocol_map = nil;
    
    runtimeLock.assertLocked();

    INIT_ONCE_PTR(protocol_map, 
                  NXCreateMapTable(NXStrValueMapPrototype, 16), 
                  NXFreeMapTable(v) );

    return protocol_map;
}

获取macho中的协议列表，循环遍历通过readProtocol将协议写入protocol_map哈希表

        protocol_t * const *protolist = _getObjc2ProtocolList(hi, &count);
        for (i = 0; i < count; i++) {
            readProtocol(protolist[i], cls, protocol_map, 
                         isPreoptimized, isBundle);
        }

修复没有被加载的协议

    // Fix up @protocol references
    // Preoptimized images may have the right 
    // answer already but we don't know for sure.
    for (EACH_HEADER) {
        // At launch time, we know preoptimized image refs are pointing at the
        // shared cache definition of a protocol.  We can skip the check on
        // launch, but have to visit @protocol refs for shared cache images
        // loaded later.
        if (launchTime && hi->isPreoptimized())
            continue;
        protocol_t **protolist = _getObjc2ProtocolRefs(hi, &count);
        for (i = 0; i < count; i++) {
            remapProtocolRef(&protolist[i]);
        }
    }

    ts.log("IMAGE TIMES: fix up @protocol references");

获取macho中静态段__objc_protorefs的内容，通过remapProtocolRef来修复未加载的协议。

分类的处理

    // Discover categories. Only do this after the initial category
    // attachment has been done. For categories present at startup,
    // discovery is deferred until the first load_images call after
    // the call to _dyld_objc_notify_register completes. rdar://problem/53119145
    if (didInitialAttachCategories) {
        for (EACH_HEADER) {
            load_categories_nolock(hi);
        }
    }

    ts.log("IMAGE TIMES: discover categories");

发现分类。只有在分类的初始化才能这样做。对于在启动时出现的类别，发现延迟到对_dyld_objc_notify_register的调用完成后的第一次load_images调用

类的加载处理

    // Category discovery MUST BE Late to avoid potential races
    // when other threads call the new category code before
    // this thread finishes its fixups.

    // +load handled by prepare_load_methods()

    // Realize non-lazy classes (for +load methods and static instances)
    for (EACH_HEADER) {
        classref_t const *classlist = hi->nlclslist(&count);
        for (i = 0; i < count; i++) {
            Class cls = remapClass(classlist[i]);
            if (!cls) continue;

            addClassTableEntry(cls);

            if (cls->isSwiftStable()) {
                if (cls->swiftMetadataInitializer()) {
                    _objc_fatal("Swift class %s with a metadata initializer "
                                "is not allowed to be non-lazy",
                                cls->nameForLogging());
                }
                // fixme also disallow relocatable classes
                // We can't disallow all Swift classes because of
                // classes like Swift.__EmptyArrayStorage
            }
            realizeClassWithoutSwift(cls, nil);
        }
    }

    ts.log("IMAGE TIMES: realize non-lazy classes");

加载非懒加载类

• classref_t const *classlist = hi->nlclslist(&count)，获取macho中非懒加载类表
• 通过remapClass来判断当前非懒加载类的指针是否已经存在
  • 如果不存在，则通过addClassTableEntry加当前非懒加载类插入类表，通过realizeClassWithoutSwift实现当前的类

没有被处理的类，优化那些被侵犯的类

// Realize newly-resolved future classes, in case CF manipulates them
    if (resolvedFutureClasses) {
        for (i = 0; i < resolvedFutureClassCount; i++) {
            Class cls = resolvedFutureClasses[i];
            if (cls->isSwiftStable()) {
                _objc_fatal("Swift class is not allowed to be future");
            }
            //实现类
            realizeClassWithoutSwift(cls, nil);
            cls->setInstancesRequireRawIsaRecursively(false/*inherited*/);
        }
        free(resolvedFutureClasses);
    }

    ts.log("IMAGE TIMES: realize future classes");

    if (DebugNonFragileIvars) {
        //实现所有类
        realizeAllClasses();
    }

readClass

读取类，我们在混乱类的处理中，通过readClass，我们由一个地址得到了类的名称。其源码如下：

/***********************************************************************
* readClass
* Read a class and metaclass as written by a compiler.
* Returns the new class pointer. This could be: 
* - cls
* - nil  (cls has a missing weak-linked superclass)
* - something else (space for this class was reserved by a future class)
*
* Note that all work performed by this function is preflighted by 
* mustReadClasses(). Do not change this function without updating that one.
*
* Locking: runtimeLock acquired by map_images or objc_readClassPair
**********************************************************************/
Class readClass(Class cls, bool headerIsBundle, bool headerIsPreoptimized)
{
    // 获取类名
    const char *mangledName = cls->nonlazyMangledName();
    
    const char *practiseName = "Person";
    if (strcmp(mangledName, practiseName) == 0) { 
        printf("-------- %s", mangledName);
    }
    
    // 当前类的父类中若有丢失的weak-linked类，则返回nil
    if (missingWeakSuperclass(cls)) {
        // No superclass (probably weak-linked). 
        // Disavow any knowledge of this subclass.
        if (PrintConnecting) {
            _objc_inform("CLASS: IGNORING class '%s' with "
                         "missing weak-linked superclass", 
                         cls->nameForLogging());
        }
        addRemappedClass(cls, nil);
        cls->setSuperclass(nil);
        return nil;
    }
    
    cls->fixupBackwardDeployingStableSwift();

    // 判断是不是后期需要处理的类
    // 正常情况下，不会走到popFutureNamedClass，因为这是专门针对未来待处理的类的操作
    // 通过断点调试，不会走到if流程里面，因此也不会对ro、rw进行操作
    Class replacing = nil;
    if (mangledName != nullptr) {
        if (Class newCls = popFutureNamedClass(mangledName)) {
            // This name was previously allocated as a future class.
            // Copy objc_class to future class's struct.
            // Preserve future's rw data block.

            if (newCls->isAnySwift()) {
                _objc_fatal("Can't complete future class request for '%s' "
                            "because the real class is too big.",
                            cls->nameForLogging());
            }

            //读取class的data，设置ro、rw
            //经过调试，并不会走到这里
            class_rw_t *rw = newCls->data();
            const class_ro_t *old_ro = rw->ro();
            memcpy(newCls, cls, sizeof(objc_class));

            // Manually set address-discriminated ptrauthed fields
            // so that newCls gets the correct signatures.
            newCls->setSuperclass(cls->getSuperclass());
            newCls->initIsa(cls->getIsa());

            rw->set_ro((class_ro_t *)newCls->data());
            newCls->setData(rw);
            freeIfMutable((char *)old_ro->getName());
            free((void *)old_ro);

            addRemappedClass(cls, newCls);

            replacing = cls;
            cls = newCls;
        }
    }
    
    //判断是否类是否已经加载到内存
    if (headerIsPreoptimized  &&  !replacing) {
        // class list built in shared cache
        // fixme strict assert doesn't work because of duplicates
        // ASSERT(cls == getClass(name));
        ASSERT(mangledName == nullptr || getClassExceptSomeSwift(mangledName));
    } else {
        if (mangledName) { //some Swift generic classes can lazily generate their names
            //加载共享缓存中的类
            addNamedClass(cls, mangledName, replacing);
        } else {
            Class meta = cls->ISA();
            const class_ro_t *metaRO = meta->bits.safe_ro();
            ASSERT(metaRO->getNonMetaclass() && "Metaclass with lazy name must have a pointer to the corresponding nonmetaclass.");
            ASSERT(metaRO->getNonMetaclass() == cls && "Metaclass nonmetaclass pointer must equal the original class.");
        }
        //插入表，即相当于从mach-O文件 读取到 内存 中
        addClassTableEntry(cls);
    }

    // for future reference: shared cache never contains MH_BUNDLEs
    if (headerIsBundle) {
        cls->data()->flags |= RO_FROM_BUNDLE;
        cls->ISA()->data()->flags |= RO_FROM_BUNDLE;
    }
    
    return cls;
}

• 通过cls->nonlazyMangledName()获取类名

    // Get the class's mangled name, or NULL if the class has a lazy
    // name that hasn't been created yet.
    const char *nonlazyMangledName() const {
        return bits.safe_ro()->getName();
    }

从注释我们知道，这里获取的是非懒加载类的类名，如果是懒加载类则会返回NULL，这里与之前版本的源码有所区别

• 当前类的父类中若有丢失的weak-linked类，则返回nil
• 判断是不是后期需要处理的类，在正常情况下，不会走到popFutureNamedClass，因为这是专门针对未来待处理的类的操作，也可以通过断点调试，可知不会走到if流程里面，因此也不会对ro、rw进行操作
  • data是macho中的数据，并不存在class内存中
  • ro的赋值是从macho中的data强转而来
  • rw中的ro是从ro复制过去的
• 通过addNamedClass将当前类添加到已经创建好的gdb_objc_realized_classes哈希表，该表用于存放所有类

/***********************************************************************
* addNamedClass 加载共享缓存中的类 插入表
* Adds name => cls to the named non-meta class map. 将name=> cls添加到命名的非元类映射
* Warns about duplicate class names and keeps the old mapping.
* Locking: runtimeLock must be held by the caller
**********************************************************************/
static void addNamedClass(Class cls, const char *name, Class replacing = nil)
{
    runtimeLock.assertLocked();
    Class old;
    if ((old = getClassExceptSomeSwift(name))  &&  old != replacing) {
        inform_duplicate(name, old, cls);

        // getMaybeUnrealizedNonMetaClass uses name lookups.
        // Classes not found by name lookup must be in the
        // secondary meta->nonmeta table.
        addNonMetaClass(cls);
    } else {
        //添加到gdb_objc_realized_classes哈希表
        NXMapInsert(gdb_objc_realized_classes, name, cls);
    }
    ASSERT(!(cls->data()->flags & RO_META));

    // wrong: constructed classes are already realized when they get here
    // ASSERT(!cls->isRealized());
}

• 通过addClassTableEntry，将初始化的类添加到allocatedClasses表，allocatedClasses在_objc_init中的runtime_init就创建了。

/***********************************************************************
* addClassTableEntry
* Add a class to the table of all classes. If addMeta is true,
* automatically adds the metaclass of the class as well.
* Locking: runtimeLock must be held by the caller.
**********************************************************************/
static void
addClassTableEntry(Class cls, bool addMeta = true)
{
    runtimeLock.assertLocked();

    // This class is allowed to be a known class via the shared cache or via
    // data segments, but it is not allowed to be in the dynamic table already.
    auto &set = objc::allocatedClasses.get();

    ASSERT(set.find(cls) == set.end());

    if (!isKnownClass(cls))
        set.insert(cls);
    if (addMeta)
        addClassTableEntry(cls->ISA(), false);
}

总结
所以综上所述，readClass的主要作用就是将macho中的非懒加载类读取到内存，即插入表中，但是目前的类仅有两个信息：地址以及名称，而macho的其中的data数据还未读取出来

realizeClassWithoutSwift

realizeClassWithoutSwift中有ro，rw的相关操作，realizeClassWithoutSwift的作用是实现类，将类的data加载到内存中

1. 读取data数据

// fixme verify class is not in an un-dlopened part of the shared cache?
//读取class的data()，以及ro/rw创建
auto ro = (const class_ro_t *)cls->data(); //读取类结构的bits属性、//ro -- clean memory，在编译时就已经确定了内存
auto isMeta = ro->flags & RO_META; //判断元类
if (ro->flags & RO_FUTURE) {
    // This was a future class. rw data is already allocated.
    rw = cls->data(); //dirty memory 进行赋值
    ro = cls->data()->ro();
    ASSERT(!isMeta);
    cls->changeInfo(RW_REALIZED|RW_REALIZING, RW_FUTURE);
} else { //此时将数据读取进来了，也赋值完毕了
    // Normal class. Allocate writeable class data.
    rw = objc::zalloc<class_rw_t>(); //申请开辟zalloc -- rw
    rw->set_ro(ro);//rw中的ro设置为临时变量ro
    rw->flags = RW_REALIZED|RW_REALIZING|isMeta;
    cls->setData(rw);//将cls的data赋值为rw形式
}

读取class的data数据，赋值rw，ro

• ro表示readOnly，即只读，其在编译时就已经确定了内存，包含类名称、方法、协议和实例变量的信息，由于是只读的，所以属于Clean Memory，而Clean Memory是指加载后不会发生更改的内存
• rw 表示 readWrite，即可读可写，由于其动态性，可能会往类中添加属性、方法、添加协议，在2020的WWDC的对内存优化的说明Advancements in the Objective-C runtime - WWDC 2020 - Videos - Apple Developer中，提到rw，其实在rw中只有10%的类真正的更改了它们的方法，所以有了rwe，即类的额外信息。对于那些确实需要额外信息的类，可以分配rwe扩展记录中的一个，并将其滑入类中供其使用。其中rw就属于dirty memory，而 dirty memory是指在进程运行时会发生更改的内存，类结构一经使用就会变成 ditry memory，因为运行时会向它写入新数据，例如创建一个新的方法缓存，并从类中指向它

2. 确定类的继承链，及isa链

• supercls = realizeClassWithoutSwift(remapClass(cls->getSuperclass()), nil)确定父类
• metacls = realizeClassWithoutSwift(remapClass(cls->ISA()), nil)确定元类

    // 调用realizeClassWithoutSwift查找父类和元类
    supercls = realizeClassWithoutSwift(remapClass(cls->getSuperclass()), nil);
    metacls = realizeClassWithoutSwift(remapClass(cls->ISA()), nil);

• 在realizeClassWithoutSwift的开头有如下代码，通过对查找类是否已实现的判断，来防止无限循环找下的情况发生

    // 如果没有找到，则返回nil
    // 如果类以初始化，则返回cls
    if (!cls) return nil;
    if (cls->isRealized()) {
        validateAlreadyRealizedClass(cls);
        return cls;
    }

• 如果类没有找到，则返回nil，我们知道即NSObject的父类是nil，元类是通过isa来确定其继承关系，rootmatecls的isa指向的还是自己，所以这里元类不会返回nil
• 判断当前的cls是否已实现

    // Locking: To prevent concurrent realization, hold runtimeLock.
    bool isRealized() const {
        return !isStubClass() && (data()->flags & RW_REALIZED);
    }

这里我们可以知道，判断一个类是否已经完成实现，其实就是在看其是否已近完成了rw的实现

• 如果类已实现，验证其实现，并返回该类

static void validateAlreadyRealizedClass(Class cls) {
    ASSERT(cls->isRealized());
#if TARGET_OS_OSX
    class_rw_t *rw = cls->data();
    size_t rwSize = malloc_size(rw);

    // Note: this check will need some adjustment if class_rw_t's
    // size changes to not match the malloc bucket.
    if (rwSize != sizeof(class_rw_t))
        _objc_fatal("realized class %p has corrupt data pointer %p", cls, rw);
#endif
}

这里我们再次验证了判断类的实现其实就是在对其的rw进行验证

• 如果没有实现，则会回到这里的第一步读取data数据

• 完成当前需要实现类的父类及元类的重新映射

    // Update superclass and metaclass in case of remapping
    // 重新映射并设置父类和初始化其元类
    cls->setSuperclass(supercls);
    cls->initClassIsa(metacls);

• setSuperclass重新映射父类

    void setSuperclass(Class newSuperclass) {
#if ISA_SIGNING_SIGN_MODE == ISA_SIGNING_SIGN_ALL
        superclass = (Class)ptrauth_sign_unauthenticated((void *)newSuperclass, ISA_SIGNING_KEY, ptrauth_blend_discriminator(&superclass, ISA_SIGNING_DISCRIMINATOR_CLASS_SUPERCLASS));
#else
        superclass = newSuperclass;
#endif
    }

• initClassIsa给当前类设置元类

• 如果supercls存在，则将cls加入父类的子类列表中
• 如果supercls不存在，则将cls作为根类

    // 将类链接到父类的子类列表
    // Connect this class to its superclass's subclass lists
    if (supercls) {
        addSubclass(supercls, cls);
    } else {
        addRootClass(cls);
    }

3. 通过methodizeClass修复类的方法列表、协议列表、属性列表

/***********************************************************************
* methodizeClass
* Fixes up cls's method list, protocol list, and property list.
* Attaches any outstanding categories.
* Locking: runtimeLock must be held by the caller
**********************************************************************/
static void methodizeClass(Class cls, Class previously)
{
    runtimeLock.assertLocked();

    bool isMeta = cls->isMetaClass();
    auto rw = cls->data();
    auto ro = rw->ro();
    auto rwe = rw->ext();

    // Methodizing for the first time
    if (PrintConnecting) {
        _objc_inform("CLASS: methodizing class '%s' %s", 
                     cls->nameForLogging(), isMeta ? "(meta)" : "");
    }

    // Install methods and properties that the class implements itself.
    method_list_t *list = ro->baseMethods();
    if (list) {
        prepareMethodLists(cls, &list, 1, YES, isBundleClass(cls), nullptr);
        if (rwe) rwe->methods.attachLists(&list, 1);
    }

    property_list_t *proplist = ro->baseProperties;
    if (rwe && proplist) {
        rwe->properties.attachLists(&proplist, 1);
    }

    protocol_list_t *protolist = ro->baseProtocols;
    if (rwe && protolist) {
        rwe->protocols.attachLists(&protolist, 1);
    }

    // Root classes get bonus method implementations if they don't have 
    // them already. These apply before category replacements.
    if (cls->isRootMetaclass()) {
        // root metaclass
        addMethod(cls, @selector(initialize), (IMP)&objc_noop_imp, "", NO);
    }

    // Attach categories.
    if (previously) {
        if (isMeta) {
            objc::unattachedCategories.attachToClass(cls, previously,
                                                     ATTACH_METACLASS);
        } else {
            // When a class relocates, categories with class methods
            // may be registered on the class itself rather than on
            // the metaclass. Tell attachToClass to look for those.
            objc::unattachedCategories.attachToClass(cls, previously,
                                                     ATTACH_CLASS_AND_METACLASS);
        }
    }
    objc::unattachedCategories.attachToClass(cls, cls,
                                             isMeta ? ATTACH_METACLASS : ATTACH_CLASS);

#if DEBUG
    // Debug: sanity-check all SELs; log method list contents
    for (const auto& meth : rw->methods()) {
        if (PrintConnecting) {
            _objc_inform("METHOD %c[%s %s]", isMeta ? '+' : '-', 
                         cls->nameForLogging(), sel_getName(meth.name()));
        }
        ASSERT(sel_registerName(sel_getName(meth.name())) == meth.name());
    }
#endif
}

将ro的方法列表加到rw中

1. 从ro中获取到方法列表

    // Install methods and properties that the class implements itself.
    method_list_t *list = ro->baseMethods();
    if (list) {
        prepareMethodLists(cls, &list, 1, YES, isBundleClass(cls), nullptr);
        if (rwe) rwe->methods.attachLists(&list, 1);
    }

2. 调用prepareMethodLists将方法写入方法列表

static void 
fixupMethodList(method_list_t *mlist, bool bundleCopy, bool sort)
{
    runtimeLock.assertLocked();
    ASSERT(!mlist->isFixedUp());

    // fixme lock less in attachMethodLists ?
    // dyld3 may have already uniqued, but not sorted, the list
    if (!mlist->isUniqued()) {
        mutex_locker_t lock(selLock);
    
        // Unique selectors in list.
        for (auto& meth : *mlist) {
            const char *name = sel_cname(meth.name());
            meth.setName(sel_registerNameNoLock(name, bundleCopy));
        }
    }

    // Sort by selector address.
    // Don't try to sort small lists, as they're immutable.
    // Don't try to sort big lists of nonstandard size, as stable_sort
    // won't copy the entries properly.
    if (sort && !mlist->isSmallList() && mlist->entsize() == method_t::bigSize) {
        method_t::SortBySELAddress sorter;
        std::stable_sort(&mlist->begin()->big(), &mlist->end()->big(), sorter);
    }
    
    // Mark method list as uniqued and sorted.
    // Can't mark small lists, since they're immutable.
    if (!mlist->isSmallList()) {
        mlist->setFixedUp();
    }
}


static void 
prepareMethodLists(Class cls, method_list_t **addedLists, int addedCount,
                   bool baseMethods, bool methodsFromBundle, const char *why)
{
    runtimeLock.assertLocked();

    if (addedCount == 0) return;
    // 省略部分代码
    // Add method lists to array.
    // Reallocate un-fixed method lists.
    // The new methods are PREPENDED to the method list array.

    for (int i = 0; i < addedCount; i++) {
        method_list_t *mlist = addedLists[i];
        ASSERT(mlist);

        // Fixup selectors if necessary
        if (!mlist->isFixedUp()) {
            fixupMethodList(mlist, methodsFromBundle, true/*sort*/);
        }
    }
    // 省略部分代码
}

3. 调用fixupMethodList通过SELAddress对方法进行排序

static void 
fixupMethodList(method_list_t *mlist, bool bundleCopy, bool sort)
{
    runtimeLock.assertLocked();
    ASSERT(!mlist->isFixedUp());

    // Sort by selector address.
    // Don't try to sort small lists, as they're immutable.
    // Don't try to sort big lists of nonstandard size, as stable_sort
    // won't copy the entries properly.
    if (sort && !mlist->isSmallList() && mlist->entsize() == method_t::bigSize) {
        method_t::SortBySELAddress sorter;
        std::stable_sort(&mlist->begin()->big(), &mlist->end()->big(), sorter);
    }
   
}

4. 如果rwe存在，则调用attachLists将list写入rwe中

如果有属性且存在rwe，将属性列表写入rwe

    property_list_t *proplist = ro->baseProperties;
    if (rwe && proplist) {
        rwe->properties.attachLists(&proplist, 1);
    }

如果有协议且存在rwe，将协议列表写入rwe

    protocol_list_t *protolist = ro->baseProtocols;
    if (rwe && protolist) {
        rwe->protocols.attachLists(&protolist, 1);
    }

添加分类

void attachToClass(Class cls, Class previously, int flags)
{
    runtimeLock.assertLocked();
    ASSERT((flags & ATTACH_CLASS) ||
           (flags & ATTACH_METACLASS) ||
           (flags & ATTACH_CLASS_AND_METACLASS));
    
    auto &map = get();
    auto it = map.find(previously);//找到一个分类进来一次，即一个个加载分类，不要混乱

    if (it != map.end()) {//这里会走进来：当主类没有实现load，分类开始加载，迫使主类加载，会走到if流程里面
        category_list &list = it->second;
        if (flags & ATTACH_CLASS_AND_METACLASS) {//判断是否是元类
            int otherFlags = flags & ~ATTACH_CLASS_AND_METACLASS;
            attachCategories(cls, list.array(), list.count(), otherFlags | ATTACH_CLASS);//实例方法
            attachCategories(cls->ISA(), list.array(), list.count(), otherFlags | ATTACH_METACLASS);//类方法
        } else {
            //如果不是元类，则只走一次 attachCategories
            attachCategories(cls, list.array(), list.count(), flags);
        }
        map.erase(it);
    }
}

attachCategories将分类的方法、属性、协议添加到主类中

// Attach method lists and properties and protocols from categories to a class.
// Assumes the categories in cats are all loaded and sorted by load order, 
// oldest categories first.
static void
attachCategories(Class cls, const locstamped_category_t *cats_list, uint32_t cats_count,
                 int flags)
{
    if (slowpath(PrintReplacedMethods)) {
        printReplacements(cls, cats_list, cats_count);
    }
    if (slowpath(PrintConnecting)) {
        _objc_inform("CLASS: attaching %d categories to%s class '%s'%s",
                     cats_count, (flags & ATTACH_EXISTING) ? " existing" : "",
                     cls->nameForLogging(), (flags & ATTACH_METACLASS) ? " (meta)" : "");
    }

    /*
     * Only a few classes have more than 64 categories during launch.
     * This uses a little stack, and avoids malloc.
     *
     * Categories must be added in the proper order, which is back
     * to front. To do that with the chunking, we iterate cats_list
     * from front to back, build up the local buffers backwards,
     * and call attachLists on the chunks. attachLists prepends the
     * lists, so the final result is in the expected order.
     */
    constexpr uint32_t ATTACH_BUFSIZ = 64;
    method_list_t   *mlists[ATTACH_BUFSIZ];
    property_list_t *proplists[ATTACH_BUFSIZ];
    protocol_list_t *protolists[ATTACH_BUFSIZ];

    uint32_t mcount = 0;
    uint32_t propcount = 0;
    uint32_t protocount = 0;
    bool fromBundle = NO;
    bool isMeta = (flags & ATTACH_METACLASS);
    auto rwe = cls->data()->extAllocIfNeeded();

    for (uint32_t i = 0; i < cats_count; i++) {
        auto& entry = cats_list[i];

        method_list_t *mlist = entry.cat->methodsForMeta(isMeta);
        if (mlist) {
            if (mcount == ATTACH_BUFSIZ) {
                prepareMethodLists(cls, mlists, mcount, NO, fromBundle, __func__);
                rwe->methods.attachLists(mlists, mcount);
                mcount = 0;
            }
            mlists[ATTACH_BUFSIZ - ++mcount] = mlist;
            fromBundle |= entry.hi->isBundle();
        }

        property_list_t *proplist =
            entry.cat->propertiesForMeta(isMeta, entry.hi);
        if (proplist) {
            if (propcount == ATTACH_BUFSIZ) {
                rwe->properties.attachLists(proplists, propcount);
                propcount = 0;
            }
            proplists[ATTACH_BUFSIZ - ++propcount] = proplist;
        }

        protocol_list_t *protolist = entry.cat->protocolsForMeta(isMeta);
        if (protolist) {
            if (protocount == ATTACH_BUFSIZ) {
                rwe->protocols.attachLists(protolists, protocount);
                protocount = 0;
            }
            protolists[ATTACH_BUFSIZ - ++protocount] = protolist;
        }
    }

    if (mcount > 0) {
        prepareMethodLists(cls, mlists + ATTACH_BUFSIZ - mcount, mcount,
                           NO, fromBundle, __func__);
        rwe->methods.attachLists(mlists + ATTACH_BUFSIZ - mcount, mcount);
        if (flags & ATTACH_EXISTING) {
            flushCaches(cls, __func__, [](Class c){
                // constant caches have been dealt with in prepareMethodLists
                // if the class still is constant here, it's fine to keep
                return !c->cache.isConstantOptimizedCache();
            });
        }
    }

    rwe->properties.attachLists(proplists + ATTACH_BUFSIZ - propcount, propcount);

    rwe->protocols.attachLists(protolists + ATTACH_BUFSIZ - protocount, protocount);
}

通过上述源码，我们可以发现这里操作的都是rwe，rwe = cls->data()->extAllocIfNeeded()，在本类中也有rwe，但是我们发现，本类的属性及协议会存在rwe中，如果存在rwe，则方法列表也会添加到rwe中。

• 如果本类本来就存在rwe，则直接使用
• 如果本类不存在rwe, 则开辟

class_rw_ext_t *extAllocIfNeeded() {
    auto v = get_ro_or_rwe();
    if (fastpath(v.is<class_rw_ext_t *>())) { //判断rwe是否存在
        return v.get<class_rw_ext_t *>();//如果存在，则直接获取
    } else {
        return extAlloc(v.get<const class_ro_t *>());//如果不存在则进行开辟
    }
}

👇//extAlloc源码实现
class_rw_ext_t *
class_rw_t::extAlloc(const class_ro_t *ro, bool deepCopy)
{
    runtimeLock.assertLocked();

    auto rwe = objc::zalloc<class_rw_ext_t>();

    rwe->version = (ro->flags & RO_META) ? 7 : 0;

    method_list_t *list = ro->baseMethods();
    if (list) {
        if (deepCopy) list = list->duplicate();
        rwe->methods.attachLists(&list, 1);
    }

    // See comments in objc_duplicateClass
    // property lists and protocol lists historically
    // have not been deep-copied
    //
    // This is probably wrong and ought to be fixed some day
    property_list_t *proplist = ro->baseProperties;
    if (proplist) {
        rwe->properties.attachLists(&proplist, 1);
    }

    protocol_list_t *protolist = ro->baseProtocols;
    if (protolist) {
        rwe->protocols.attachLists(&protolist, 1);
    }

    set_ro_or_rwe(rwe, ro);
    return rwe;
}

这里我们可以看到首先是加载的本类的baseMethods，然后是baseProperties，再然后是baseProtocols，最后返回rwe

小结
rwe会伴随属性、协议、分类的产生而产生；

attachLists将方法写入rwe

void attachLists(List* const * addedLists, uint32_t addedCount) {
    if (addedCount == 0) return;

    if (hasArray()) {
        // many lists -> many lists
        //计算数组中旧lists的大小
        uint32_t oldCount = array()->count;
        //计算新的容量大小 = 旧数据大小+新数据大小
        uint32_t newCount = oldCount + addedCount;
        //根据新的容量大小，开辟一个数组，类型是 array_t，通过array()获取
        setArray((array_t *)realloc(array(), array_t::byteSize(newCount)));
        //设置数组大小
        array()->count = newCount;
        //旧的数据从 addedCount 数组下标开始 存放旧的lists，大小为 旧数据大小 * 单个旧list大小
        memmove(array()->lists + addedCount, array()->lists, 
                oldCount * sizeof(array()->lists[0]));
        //新数据从数组 首位置开始存储，存放新的lists，大小为 新数据大小 * 单个list大小
        memcpy(
               array()->lists, addedLists, 
               addedCount * sizeof(array()->lists[0]));
    }
    else if (!list  &&  addedCount == 1) {
        // 0 lists -> 1 list
        list = addedLists[0];//将list加入mlists的第一个元素，此时的list是一个一维数组
        validate();
    } 
    else {
        // 1 list -> many lists 有了一个list，有往里加很多list
        //新的list就是分类，来自LRU的算法思维，即最近最少使用
        //获取旧的list
        List* oldList = list;
        uint32_t oldCount = oldList ? 1 : 0;
        //计算容量和 = 旧list个数+新lists的个数
        uint32_t newCount = oldCount + addedCount;
        //开辟一个容量和大小的集合，类型是 array_t，即创建一个数组，放到array中，通过array()获取
        setArray((array_t *)malloc(array_t::byteSize(newCount)));
        //设置数组的大小
        array()->count = newCount;
        //判断old是否存在，old肯定是存在的，将旧的list放入到数组的末尾
        if (oldList) array()->lists[addedCount] = oldList;
        // memcpy（开始位置，放什么，放多大） 是内存平移，从数组起始位置存入新的list
        //其中array()->lists 表示首位元素位置
        memcpy(array()->lists, addedLists, 
               addedCount * sizeof(array()->lists[0]));
    }
}

memmove和memcpy的区别

• 在不知道需要平移的内存大小时，需要memmove进行内存平移，保证安全
• memcpy从原内存地址的起始位置开始拷贝若干个字节到目标内存地址中，速度快
  存储过程
  0-1
  如果还没有数据，将传入的列表加入第一个位置
  1-many
  首先计算出需要的大小，然后之前的旧数据放入末尾，再将添加的数据从0号位置拷贝到array里面
  已经有了很多数据的时候
  首先计算出需要的大小
  接着将旧数据平移到新增数据大小的位置下，进行存放
  最后将添加的数据从0号位置拷贝到array里面

从上述源码就能解释为什么同名的分类的方法会先于本类的方法调用，在上面我们知道，开辟rwe之后，写入顺序是baseMethods → baseProperties → baseProtocols，最后才是分类，所以分类的同名方法会被优先调用

非懒加载类的加载流程

通过上面的分析，我们知道了当执行到realizeClassWithoutSwift的时候，即代表开始加载该类了，我们的非懒加载类的加载流程_dyld_start → _os_object_init → _objc_init → dyld::notifyBatchPartial → map_images → map_images_nolock → _read_images → realizeClassWithoutSwift → methodizeClass。
我们通过自定义的类，并重写了+ (void)load方法来定一个非懒加载类。然后在realizeClassWithoutSwift源码中加入如下代码，来研究自己定义的类来探索。

    const char *mangledName = cls->nonlazyMangledName();
    const char *exploreName = "Person";
    if (strcmp(mangledName, exploreName) == 0) {
        printf("%s------%s\n", __func__, mangledName);
    }

在断点处查看bt，和当前线程的执行记录

非懒加载类的加载流程.png

懒加载类的加载流程

根据上面的经验，我们去点自定义类中的+ (void)load方法，将其变为懒加载类，然后运行

懒加载类的加载流程

非懒加载&懒加载对比

• 懒加载类的加载，需要使用到该类，进行消息发送的时候，才开始加载该类
• 非懒加载类，在map_images到_read_images之后便开始加载到内存中