iOS Objective-C底层 part3:live^reference

本文阅读的objc源码

一提到ARC内的引用(reference),条件反射式想起的就是weak+retainCount+retain+release等一堆词.

retain+release是对retainCount的操作不必多说.
weak的功能:通过weak指针能获取到某个对象,却不增加对象的retainCount,对象销毁,weak指针自动置为nil.

那么这些weak+retainCount是靠怎么实现的呢?
答案:
weak 靠对象优化的isa与SideTables结实使用
retainCount 靠对象优化的isa与SideTables结实使用

优化的isa在前面已经提过,里面的9个字段各有用处,忘了请戳.

1. SideTables

SideTables.png

SideTables是一个全局的Hash表,以对象的地址为Key能拿到对应的SideTable.SideTable就是管理retainCount和weak指针指向的最小单位.

SideTable:

spinlock_t slock;//操作retainCount和weak指针指向的操作比较频繁,slock是保证操作的线程安全的
RefcountMap refcnts;//管理retainCount
weak_table_t weak_table;//管理weak指针指向

1.1 RefcountMap

二层过滤

很奇怪吧!保存一个对象的retainCount随便弄块内存空间不就完事了吗?还用一个Map干嘛?我们又得回到开始:SideTables是一个全局的Hash表,是Hash表就会有冲突(关于Hash表有不明白的请戳).当不同地址的两个对象对应同一个SideTable时,这时就需要RefcountMap应用对象地址来做第二层过滤.所以你看到RefcountMap refcnts到存储retainCount的内存之间要用一个find()方法.

存储

在找到真正存储对象retainCount的64位空间后还要注意:

#define SIDE_TABLE_WEAKLY_REFERENCED (1UL<<0)
#define SIDE_TABLE_DEALLOCATING      (1UL<<1)

64位的倒数第一位标记当前对象是否被weak指针指向(1:有weak指针指向);
64位的倒数第二位标记当前对象是否正在销毁状态(1:处在正在销毁状态);
其他的62位都可以用于存储retainCount.

1.2 weak_table_t

二层过滤

也是因为Hash表冲突,weak_table_t有一个weak_entry_t数组,也就是说在进入weak_table_t也需要通过遍历才能确定真正管理某个对象weak指针指向的weak_entry_t.

struct weak_entry_t {
    DisguisedPtr<objc_object> referent;
    union {
        struct {
            weak_referrer_t *referrers;
            uintptr_t        out_of_line_ness : 2;
            uintptr_t        num_refs : PTR_MINUS_2;
            uintptr_t        mask;
            uintptr_t        max_hash_displacement;
        };
        struct {
            // out_of_line_ness field is low bits of inline_referrers[1]
            weak_referrer_t  inline_referrers[WEAK_INLINE_COUNT];
        };
    };
};

referent==>对象地址,用于weak_entry_t 数组遍历时的比对;

联合体内struct1->weak_referrer_t *referrers;
联合体内struct2->inline_referrers[WEAK_INLINE_COUNT]
weak变量的指针个数不超过4个用inline_referrers,
weak变量的指针个数超过4个用referrers.

到此为止,SideTables的结构已经介绍完毕,weak与retainCount的实现会在后面再做具体说明(retainCount的实现需要SideTables以外的东西,难度有点大,先给您提个醒).

2. retainCount的实现

上面已经说过Sidetables->Sidetable sidetable->RefcountMap refcnts来保存对象的retainCount.但是在对象的最开始阶段不用以上方案,只有retainCount大到一定程度才会用以上方案.具体如下:

首先,让我们回到类对象的isa上( arm64版本)

union isa_t 
{
    Class cls;
    uintptr_t bits;
struct {
        uintptr_t nonpointer : 1;
        uintptr_t has_assoc : 1;
        uintptr_t has_cxx_dtor : 1;
        uintptr_t shiftcls : 33;
        uintptr_t magic : 6;
        uintptr_t weakly_referenced : 1;
        uintptr_t deallocating : 1;
        uintptr_t has_sidetable_rc : 1;
        uintptr_t extra_rc : 19;
    };
}

目标锁定:has_sidetable_rc(1位)+extra_rc(19位).这就是一个对象存储retainCount的两个字段.
刚开始isa.has_sidetable_rc则等于0,retainCount会存在isa.extra_rc上,isa.extra_rc有19位,可以存储2^20-1= 1048575.
当retainCount大到超出isa.extra_rc的显示范围,会借助Sidetable来继续记录retainCount,而一旦启用Sidetable来继续记录retainCount,isa.has_sidetable_rc则等于1.

2.1 retainCount在哪里

很确切的说对象的isa内的has_sidetable_rc+extra_rc只保存"多余"的retainCount,

- (NSUInteger)retainCount {
    return ((id)self)->rootRetainCount();
}

inline uintptr_t objc_object::rootRetainCount() {
    isa_t bits = LoadExclusive(&isa.bits);
    uintptr_t rc = 1 + bits.extra_rc;
    if (bits.has_sidetable_rc) {
        rc += sidetable_getExtraRC_nolock();
    }
    return rc;
}

由上可以得到retainCount的组成:

1
extra_rc //中存储的值
sidetable_getExtraRC_nolock //Sidetable存储的值

这样只保存"多余"的retainCount,可以免去很多不必要的操作(如:对象初始化完成后就不必对retainCount操作,在对象存储着的retainCount等于0的情况下,再release一次直接调用dealloc也不必再操作retainCount).

2.2 加retainCount retain

retain的调用栈:

retain.png

ALWAYS_INLINE id 
objc_object::rootRetain(bool tryRetain, bool handleOverflow)
{
    if (isTaggedPointer()) return (id)this;

    bool sideTableLocked = false;
    bool transcribeToSideTable = false;

    isa_t oldisa;
    isa_t newisa;

    do {
        transcribeToSideTable = false;
        oldisa = LoadExclusive(&isa.bits);
        newisa = oldisa;
        if (slowpath(!newisa.nonpointer)) {
            ClearExclusive(&isa.bits);
            if (!tryRetain && sideTableLocked) sidetable_unlock();
            if (tryRetain) return sidetable_tryRetain() ? (id)this : nil;
            else return sidetable_retain();
        }
        // don't check newisa.fast_rr; we already called any RR overrides
        if (slowpath(tryRetain && newisa.deallocating)) {
            ClearExclusive(&isa.bits);
            if (!tryRetain && sideTableLocked) sidetable_unlock();
            return nil;
        }
        uintptr_t carry;
        newisa.bits = addc(newisa.bits, RC_ONE, 0, &carry);  // extra_rc++

        if (slowpath(carry)) {
            // newisa.extra_rc++ overflowed
            if (!handleOverflow) {
                ClearExclusive(&isa.bits);
                return rootRetain_overflow(tryRetain);
            }
            // Leave half of the retain counts inline and 
            // prepare to copy the other half to the side table.
            if (!tryRetain && !sideTableLocked) sidetable_lock();
            sideTableLocked = true;
            transcribeToSideTable = true;
            newisa.extra_rc = RC_HALF;
            newisa.has_sidetable_rc = true;
        }
    } while (slowpath(!StoreExclusive(&isa.bits, oldisa.bits, newisa.bits)));

    if (slowpath(transcribeToSideTable)) {
        // Copy the other half of the retain counts to the side table.
        sidetable_addExtraRC_nolock(RC_HALF);
    }

    if (slowpath(!tryRetain && sideTableLocked)) sidetable_unlock();
    return (id)this;
}

只加isa.extra_rc

这个操作相对简单:
1.oldisa = LoadExclusive(&isa.bits);==>读取isa;
2.newisa.bits = addc(newisa.bits, RC_ONE, 0, &carry);//extra_rc++==>isa.extra_rc加1;
3.StoreExclusive(&isa.bits, oldisa.bits, newisa.bits)==>更新isa.

超出isa.extra_rc的存储范围,启用Sidetable

经过第1步与第2步发现溢出,递归调用rootRetain(bool tryRetain, bool handleOverflow)并将handleOverflow标记为ture;
重复第1步与第2步,溢出,设置isa.extra_rc = RC_HALF;调用StoreExclusive更新isa;

RC_HALF
define RC_HALF (1ULL<<18)
isa.extra_rc占19位,超出范围就是 (1ULL<<19), (1ULL<<19)/2 = (1ULL<<18)
// Copy the other half of the retain counts to the side table.正如注释所说的拿出一半的retaincount让Sidetable存储,另一半还有由isa.extra_rc存储

操作Sidetable:

bool 
objc_object::sidetable_addExtraRC_nolock(size_t delta_rc)
{
    assert(isa.nonpointer);
    SideTable& table = SideTables()[this];

    size_t& refcntStorage = table.refcnts[this];
    size_t oldRefcnt = refcntStorage;
    // isa-side bits should not be set here
    assert((oldRefcnt & SIDE_TABLE_DEALLOCATING) == 0);
    assert((oldRefcnt & SIDE_TABLE_WEAKLY_REFERENCED) == 0);

    if (oldRefcnt & SIDE_TABLE_RC_PINNED) return true;

    uintptr_t carry;
    size_t newRefcnt = 
        addc(oldRefcnt, delta_rc << SIDE_TABLE_RC_SHIFT, 0, &carry);
    if (carry) {
        refcntStorage =
            SIDE_TABLE_RC_PINNED | (oldRefcnt & SIDE_TABLE_FLAG_MASK);
        return true;
    }
    else {
        refcntStorage = newRefcnt;
        return false;
    }
}

SideTable& table = SideTables()[this];==>SideTables以对象地址为Key获取对应的SideTable;
size_t& refcntStorage = table.refcnts[this];==>SideTable table->RefcountMap refcnts内用对象的地址获取对应的对象的retainCount(即:refcntStorage);
最后两位是有意义的标志位(前面说SideTables已经交代过了),所以加的时候要左移两位(SIDE_TABLE_RC_SHIFT),将加好的newRefcnt存回refcntStorage.

当然操作Sidetable也有判断溢出,不过返回真假出去已经没人管了.

2.3 减retainCount release

release.png

只减isa.extra_rc

1.oldisa = LoadExclusive(&isa.bits);==>读取isa;
2.newisa.bits = subc(newisa.bits, RC_ONE, 0, &carry);//extra_rc--==>isa.extra_rc减1;
3.StoreExclusive(&isa.bits, oldisa.bits, newisa.bits)==>更新isa.

由Sidetable中借位,再减

减isa.extra_rc剪到溢出,跳转到underflow,看isa.has_sidetable_rc是否为1,为0直接去做dealloc方面的工作(dealloc的具体实现后面也会细说).为1则递归调用rootRelease(bool performDealloc, bool handleUnderflow)并将handleUnderflow标记为ture;
重复以上流程后,向Sidetable借位,借出RC_HALF,然后将借出的-1赋给isa.extra_rc,保存.

3. weak的实现

对于weak的实现,我们先来个卡通版的理解:
全局维护了一个weak表，用于存储指向对象的所有weak指针.存储方式:Key是对象的地址,Value是weak变量的指针的数组

NSObject * object = [[NSObject alloc]init];
__weak NSObject * weak_object1 = object;
__weak NSObject * weak_object2 = object;
    
NSLog(@"strong-point-to-%@",object);
NSLog(@"weak1-point-to-%@",weak_object1);
NSLog(@"weak2-point-to-%@",weak_object2);
    
NSLog(@"strong-point-address-%p",&object);
NSLog(@"weak1-point-address-%p",&weak_object1);
NSLog(@"weak2-point-address-%p",&weak_object2);

打印:
strong-point-to-<NSObject: 0x61800000a9a0>
weak1-point-to-<NSObject: 0x61800000a9a0>
weak2-point-to-<NSObject: 0x61800000a9a0>
strong-point-address-0x7fff56c7d9e8
weak1-point-address-0x7fff56c7d9e0
weak2-point-address-0x7fff56c7d9d8

Key	Value
0x61800000a9a0	@[0x7fff56c7d9e8,0x7fff56c7d9e0,0x7fff56c7d9d8]

1.这样的绑定,当然可以让weak变量的指针顺利的拿到对应的对象,而且没有增加对象的引用计数.
2.当作为Key的对象地址上的对象销毁的时候也会主动将作为Value的weak变量的指针的数组内的每个地址都指向nil.

对象的isa.weakly_referenced的作用就是对对象自身有没有被weak变量的指针指向的标记:
当对象被weak变量的指针指向的时候isa.weakly_referenced=1,否则isa.weakly_referenced=0.
这样的标记是为了在对象销毁时判断要不要进行获取对象对应的weak变量的指针的数组并做置为nil的操作.具体实现dealloc篇章内会说.

当然以上是个卡通版的理解.具体集合Sidetables就是:
1.依据对象地址,在Sidetables拿到对应的Sidetable

2.而在Sidetable sidetable->weak_table_t weak_table->weak_entry_t *weak_entries通过遍历比对找到对应的weak_entry_t.

3.在weak_entry_t内的weak_referrer_t *referrers或者weak_referrer_t inline_referrers[WEAK_INLINE_COUNT];
前面已经讲过:
weak变量的指针个数不超过4个用inline_referrers,
weak变量的指针个数超过4个用referrers.

文章参考:
objc源码
 iOS管理对象内存的数据结构以及操作算法--SideTables、RefcountMap、weak_table_t

iOS Objective-C底层 part3:live^reference