首地址偏移
从上一篇文章《OC中对象的本质》中可以知道类的源码如下：
struct objc_class : objc_object {
// Class ISA; //继承 objc_object 的ISA
Class superclass; // superclass
cache_t cache; // formerly cache pointer and vtable
class_data_bits_t bits; // class_rw_t * plus custom rr/alloc flags
}
本次我们具体探究class_data_bits_t bits;
我们可以通过首地址+指针偏移来获取到bits
先看下ISA是结构体指针8字节，superclass也是一样的8字节，cache是cache_t类型的，我们具体分析一下，先看下他的结构，如下：
typedef unsigned long uintptr_t;//8字节
typedef uint32_t mask_t; // x86_64 & arm64 asm are less efficient with 16-bits
struct cache_t {
private:
explicit_atomic<uintptr_t> _bucketsAndMaybeMask;//8 上面给出定义了
union {
struct {
explicit_atomic<mask_t> _maybeMask;//4 上面给出定义了
#if __LP64__
uint16_t _flags;//2
#endif
uint16_t _occupied;//2
};
explicit_atomic<preopt_cache_t *> _originalPreoptCache;//一看里面是<XXXX *>，就是指针，8字节
};
// 下面省略静态变量定义和一些函数，因为这些并不在结构体内存储，只有成员变量在结构体内存储。所以不占用结构体空间，没有大小，就省略掉了。
}
根据我们上次的文章《联合体和位域》可知：cache_t这个结构体的大小就是8+4+2+2=16或者是8+8=16两种情况。所以，不管那种情况，大小都是16字节；
综上：想获取bits的值，就是首地址偏移8+8+16=32字节。
我们先定义一个类，如下：
@interface ELPerson : NSObject
{
NSString *elname;
}
@property(nonatomic,copy)NSString *name;//8
@property(nonatomic,copy)NSString *nickName;//8
- (void)sayNB;
+ (void)say666;
@end
class_rw_t分析
我们先分析一下源码，然后再lldb调试验证结果:
我们发现在class_data_bits_t这个结构体里面有个class_rw_t这个结构体里面看到我们熟悉的method_array_t、property_array_t、protocol_array_t这些里面会不会存储着methods、properties呢？带着这些疑问，我们开始了探索
properties存储
(lldb)x/4gx ELPerson.class //先获取ELPerson类的指针地址
0x100008258: 0x0000000100008230 0x0000000100357140
0x100008268: 0x000000010034f390 0x0000802c00000000
(lldb)p (class_data_bits_t \*)0x100008278 //前面已经分析过了。直接+32位。就是0x100008258+0x20
(class_data_bits_t *) $1 = 0x0000000100008278
(lldb)p $1->data()
(class_rw_t *) $2 = 0x000000010220bbd0 //获取class_rw_t结构体
(lldb)p $2->properties() //获取properties()
(const property_array_t) $3 = { //可以对着源码看到里面的结构了
list_array_tt<property_t, property_list_t, RawPtr> = {
= {
list = {
ptr = 0x00000001000081e8
}
arrayAndFlag = 4295000552
}
}
}
(lldb)p $3.list
(const RawPtr<property_list_t>) $4 = {
ptr = 0x00000001000081e8
}
(lldb)p $4.ptr
(property_list_t *const) $5 = 0x00000001000081e8
(lldb)p *$5
(property_list_t) $6 = {
entsize_list_tt<property_t, property_list_t, 0, PointerModifierNop> = (entsizeAndFlags = 16, count = 2) //里面有两个属性，下面全部打印出来
}
(lldb) p $6.get(0) //get()方法是C++,array里面的默认方法
(property_t) $7 = (name = "name", attributes = "T@\"NSString\",C,N,V_name")
(lldb)p $6.get(1)
(property_t) $8 = (name = "nickName", attributes = "T@\"NSString\",C,N,V_nickName")
小结：properties的存储信息在 objc_class -> bits:(class_data_bits_t 类型) ->data():(class_rw_t 类型)->properties()里面
下面再打印一下methods
methods存储
(lldb)p $2->methods() //接上面打印
(const method_array_t) $9 = { //可以对着源码看到里面的结构了
list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> = {
= {
list = {
ptr = 0x00000001000080e8
}
arrayAndFlag = 4295000296
}
}
}
(lldb)p $9.list.ptr
(method_list_t *const) $10 = 0x00000001000080e8
(lldb)p *$10
(method_list_t) $11 = {
entsize_list_tt<method_t, method_list_t, 4294901763, method_t::pointer_modifier> = (entsizeAndFlags = 27, count = 6)//看到里面有6个方法，下面全部打印出来
}
(lldb) p $11.get(0) //这个地方直接get()打印不出来我们想要的结果了，下面分析
(method_t) $12 = {}
(lldb) p $11.get(0).big()
(method_t::big) $13 = {
name = "sayNB"
types = 0x0000000100003f7f "v16@0:8"
imp = 0x0000000100003d10 (KCObjcBuild`-[ELPerson sayNB])
}
(lldb) p $11.get(1).big()
(method_t::big) $14 = {
name = ".cxx_destruct"
types = 0x0000000100003f7f "v16@0:8"
imp = 0x0000000100003e00 (KCObjcBuild`-[ELPerson .cxx_destruct])
}
(lldb) p $11.get(2).big()
(method_t::big) $15 = {
name = "name"
types = 0x0000000100003f93 "@16@0:8"
imp = 0x0000000100003d40 (KCObjcBuild`-[ELPerson name])
}
(lldb) p $11.get(3).big()
(method_t::big) $16 = {
name = "setName:"
types = 0x0000000100003f9b "v24@0:8@16"
imp = 0x0000000100003d70 (KCObjcBuild`-[ELPerson setName:])
}
**(lldb)** **p $11.get(4).big()**
(method_t::big) $17 = {
name = "setNickName:"
types = 0x0000000100003f9b "v24@0:8@16"
imp = 0x0000000100003dd0 (KCObjcBuild`-[ELPerson setNickName:])
}
(lldb) p $11.get(5).big()
(method_t::big) $18 = {
name = "nickName"
types = 0x0000000100003f93 "@16@0:8"
imp = 0x0000000100003da0 (KCObjcBuild`-[ELPerson nickName])
}
小结：methods的存储信息在 objc_class -> bits:(class_data_bits_t 类型) ->data():(class_rw_t 类型)->methods()里面
method_t 和property_t调用get()分析
struct property_t {
const char *name;
const char *attributes; //这个里面有name和attributes可以输出相关的信息
};
struct method_t { //这个里面什么都没有，但是里面有一个big结构体，它的里面有信息。可以通过big()获取
struct big {
SEL name;
const char *types;
MethodListIMP imp;
};
big &big() const {
ASSERT(!isSmall());
return *(struct big *)this;
}
ivars存储
我们继续找一下成员变量的存储位置，因为在属性的列表里面并没有看到成员变量的信息
(lldb) p $2->ro() //接上面我们打印一下ro()
(const class_ro_t *) $19 = 0x00000001000080a0
(lldb) p *$19
(const class_ro_t) $20 = { //看一下他里面的结构信息
flags = 388
instanceStart = 8
instanceSize = 32
reserved = 0
= {
ivarLayout = 0x0000000100003f27 "\x03"
nonMetaclass = 0x0000000100003f27
}
name = {
std::__1::atomic<const char *> = "ELPerson" {
Value = 0x0000000100003f1e "ELPerson"
}
}
baseMethodList = 0x00000001000080e8
baseProtocols = 0x0000000000000000
ivars = 0x0000000100008180 //我越看越像，打印它试试
weakIvarLayout = 0x0000000000000000
baseProperties = 0x00000001000081e8
_swiftMetadataInitializer_NEVER_USE = {}
}
(lldb)p $20.ivars
(const ivar_list_t *const) $21 = 0x0000000100008180
(lldb) p *$21
(const ivar_list_t) $22 = {
entsize_list_tt<ivar_t, ivar_list_t, 0, PointerModifierNop> = (entsizeAndFlags = 32, count = 3) //里面有3个成员变量，全部打印出来
}
(lldb) p $22.get(0)
(ivar_t) $23 = {
offset = 0x0000000100008218
name = 0x0000000100003f30 "elname" //我们要找的就是他，终于找出来了
type = 0x0000000100003f87 "@\"NSString\""
alignment_raw = 3
size = 8
}
(lldb) p $22.get(1)
(ivar_t) $24 = {
offset = 0x0000000100008220
name = 0x0000000100003f37 "_name"
type = 0x0000000100003f87 "@\"NSString\""
alignment_raw = 3
size = 8
}
(lldb) p $22.get(2)
(ivar_t) $25 = {
offset = 0x0000000100008228
name = 0x0000000100003f3d "_nickName"
type = 0x0000000100003f87 "@\"NSString\""
alignment_raw = 3
size = 8
}
小结：ivar的存储信息在 objc_class -> bits:(class_data_bits_t 类型) ->data():(class_rw_t 类型)->ro()里面，并且可以看出：属性也生成了带下划线的成员变量和set、get方法
即：@property = ivar + setter + getter
类方法存储
(lldb) x/4gx object_getClass(ELPerson.class) //获取ELPerson的元类
0x100008230: 0x00000001003570f0 0x00000001003570f0
0x100008240: 0x0000000101089940 0x0002e03500000003
(lldb) p (class_data_bits_t \*)0x100008250**
(class_data_bits_t *) $28 = 0x0000000100008250
(lldb)p $28->data()
(class_rw_t *) $31 = 0x000000010220bbb0
(lldb)p $31->methods() //获取里面的方法l列表
(const method_array_t) $32 = {
list_array_tt<method_t, method_list_t, method_list_t_authed_ptr> = {
= {
list = {
ptr = 0x0000000100008080
}
arrayAndFlag = 4295000192
}
}
}
(lldb) p $32.list.ptr
(method_list_t *const) $33 = 0x0000000100008080
(lldb)p *$33
(method_list_t) $34 = {
entsize_list_tt<method_t, method_list_t, 4294901763, method_t::pointer_modifier> = (entsizeAndFlags = 27, count = 1)
}
(lldb) p $34.get(0).big()
(method_t::big) $36 = { //就是我们要找的类方法
name = "say666"
types = 0x0000000100003f7f "v16@0:8"
imp = 0x0000000100003ce0 (KCObjcBuild`+[ELPerson say666])
}
小结：类方法不存在本类中，存在元类的方法列表中
扩展data()方法的实现
我们先看源码
#define FAST_DATA_MASK 0x00007ffffffffff8UL
class_rw_t* data() const {
return (class_rw_t *)(bits & FAST_DATA_MASK);
}
这个地方意味着，我们也可以用bits与上FAST_DATA_MASK来实现
(lldb) x/6gx ELPerson.class //此处打印6个出来。因为前面有32位，bits有8位
0x100008258: 0x0000000100008230 0x0000000100357140
0x100008268: 0x000000010034f390 0x0000802c00000000
0x100008278: 0x0000000100648da4 0x00000001000ac920
(lldb) p (class_data_bits_t \*)0x100008278
(class_data_bits_t *) $1 = 0x0000000100008278
(lldb) p $1->data()
(class_rw_t *) $2 = 0x0000000100648da0
(lldb) p/x 0x0000000100648da4 & 0x00007ffffffffff8
(long) $3 = 0x0000000100648da0 //我们发现$2和$3完全一样，自己实现正确
