#include "objc-private.h"

#include "NSObject.h"

#include "objc-weak.h"

#include "llvm-DenseMap.h"

#include "NSObject.h"

#include <malloc/malloc.h>

#include <stdint.h>

#include <stdbool.h>

#include <mach/mach.h>

#include <mach-o/dyld.h>

#include <mach-o/nlist.h>

#include <sys/types.h>

#include <sys/mman.h>

#include <libkern/OSAtomic.h>

#include <Block.h>

#include <map>

#include <execinfo.h>

@interface NSInvocation

- (SEL)selector;

#if TARGET_OS_MAC

#define SYMBOL_ELSEWHERE_IN_3(sym, vers, n) \

OBJC_EXPORT const char elsewhere_ ##n __asm__("$ld$hide$os" #vers "$" #sym); const char elsewhere_ ##n = 0

#define SYMBOL_ELSEWHERE_IN_2(sym, vers, n) \

SYMBOL_ELSEWHERE_IN_3(sym, vers, n)

#define SYMBOL_ELSEWHERE_IN(sym, vers) \

SYMBOL_ELSEWHERE_IN_2(sym, vers, __COUNTER__)

#if __OBJC2__

# define NSOBJECT_ELSEWHERE_IN(vers) \

SYMBOL_ELSEWHERE_IN(_OBJC_CLASS_$_NSObject, vers); \

SYMBOL_ELSEWHERE_IN(_OBJC_METACLASS_$_NSObject, vers); \

SYMBOL_ELSEWHERE_IN(_OBJC_IVAR_$_NSObject.isa, vers)

#else

# define NSOBJECT_ELSEWHERE_IN(vers) \

SYMBOL_ELSEWHERE_IN(.objc_class_name_NSObject, vers)

#endif

#if TARGET_OS_IOS

NSOBJECT_ELSEWHERE_IN(5.1);

NSOBJECT_ELSEWHERE_IN(5.0);

NSOBJECT_ELSEWHERE_IN(4.3);

NSOBJECT_ELSEWHERE_IN(4.2);

NSOBJECT_ELSEWHERE_IN(4.1);

NSOBJECT_ELSEWHERE_IN(4.0);

NSOBJECT_ELSEWHERE_IN(3.2);

NSOBJECT_ELSEWHERE_IN(3.1);

NSOBJECT_ELSEWHERE_IN(3.0);

NSOBJECT_ELSEWHERE_IN(2.2);

NSOBJECT_ELSEWHERE_IN(2.1);

NSOBJECT_ELSEWHERE_IN(2.0);

#elif TARGET_OS_OSX

NSOBJECT_ELSEWHERE_IN(10.7);

NSOBJECT_ELSEWHERE_IN(10.6);

NSOBJECT_ELSEWHERE_IN(10.5);

NSOBJECT_ELSEWHERE_IN(10.4);

NSOBJECT_ELSEWHERE_IN(10.3);

NSOBJECT_ELSEWHERE_IN(10.2);

NSOBJECT_ELSEWHERE_IN(10.1);

NSOBJECT_ELSEWHERE_IN(10.0);

#else

// NSObject has always been in libobjc on these platforms.

#endif

#endif

static id defaultBadAllocHandler(Class cls)

{

_objc_fatal("attempt to allocate object of class '%s' failed",

cls->nameForLogging());

}

static id(*badAllocHandler)(Class) = &defaultBadAllocHandler;

static id callBadAllocHandler(Class cls)

{

// fixme add re-entrancy protection in case allocation fails inside handler

return (*badAllocHandler)(cls);

}

void _objc_setBadAllocHandler(id(*newHandler)(Class))

{

badAllocHandler = newHandler;

}

namespace {

#define SIDE_TABLE_WEAKLY_REFERENCED (1UL<<0)

#define SIDE_TABLE_DEALLOCATING (1UL<<1) // MSB-ward of weak bit

#define SIDE_TABLE_RC_ONE (1UL<<2) // MSB-ward of deallocating bit

#define SIDE_TABLE_RC_PINNED (1UL<<(WORD_BITS-1))

#define SIDE_TABLE_RC_SHIFT 2

#define SIDE_TABLE_FLAG_MASK (SIDE_TABLE_RC_ONE-1)

typedef objc::DenseMap<DisguisedPtr<objc_object>,size_t,true> RefcountMap;

template<typename KeyT, typename ValueT,

bool ZeroValuesArePurgeable = false,

typename KeyInfoT = DenseMapInfo<KeyT> >

class DenseMap

: public DenseMapBase<DenseMap<KeyT, ValueT, ZeroValuesArePurgeable, KeyInfoT>,

KeyT, ValueT, KeyInfoT, ZeroValuesArePurgeable> {

// Lift some types from the dependent base class into this class for

// simplicity of referring to them.

typedef DenseMapBase<DenseMap, KeyT, ValueT, KeyInfoT, ZeroValuesArePurgeable> BaseT;

typedef typename BaseT::BucketT BucketT;

friend class DenseMapBase<DenseMap, KeyT, ValueT, KeyInfoT, ZeroValuesArePurgeable>;

BucketT *Buckets;

unsigned NumEntries;

unsigned NumTombstones;

unsigned NumBuckets;

......

template<typename InputIt>

DenseMap(const InputIt &I, const InputIt &E) {

init(NextPowerOf2(std::distance(I, E)));

this->insert(I, E);

}

// 这是对应 64 位的提供数组大小的方法, 需要为桶数组开辟空间时, 会由这个方法来决定数组大小

//⚠️简单理解就是桶数组的大小会是 2^n.为什么数组的大小是这个规律，是为了哈希出来的哈希值通过映射后，能够均匀的分布到数组中

inline uint64_t NextPowerOf2(uint64_t A) {

A |= (A >> 1);

A |= (A >> 2);

A |= (A >> 4);

A |= (A >> 8);

A |= (A >> 16);

A |= (A >> 32);

return A + 1;

}

}

enum HaveOld { DontHaveOld = false, DoHaveOld = true };

enum HaveNew { DontHaveNew = false, DoHaveNew = true };

struct SideTable {

/*

spinlock_t slock; //自旋锁：用于上锁/解锁SideTable

RefcountMap refcnts; //OC对象引用计数Map（key为对象，value为引用计数）-引用计数表

weak_table_t weak_table; //OC对象弱引用Map-弱引用表

SideTable() { //构造函数

memset(&weak_table, 0, sizeof(weak_table));

}

~SideTable() { //析构函数

_objc_fatal("Do not delete SideTable.");

}

//锁操作 符合StripedMap对T的定义

void lock() { slock.lock(); }

void unlock() { slock.unlock(); }

void forceReset() { slock.forceReset(); }

// Address-ordered lock discipline for a pair of side tables.

template<HaveOld, HaveNew>

static void lockTwo(SideTable *lock1, SideTable *lock2);

template<HaveOld, HaveNew>

static void unlockTwo(SideTable *lock1, SideTable *lock2);

};

template<>

void SideTable::lockTwo<DoHaveOld, DoHaveNew>

(SideTable *lock1, SideTable *lock2)

{

spinlock_t::lockTwo(&lock1->slock, &lock2->slock);

}

template<>

void SideTable::lockTwo<DoHaveOld, DontHaveNew>

(SideTable *lock1, SideTable *)

{

lock1->lock();

}

template<>

void SideTable::lockTwo<DontHaveOld, DoHaveNew>

(SideTable *, SideTable *lock2)

{

lock2->lock();

}

template<>

void SideTable::unlockTwo<DoHaveOld, DoHaveNew>

(SideTable *lock1, SideTable *lock2)

{

spinlock_t::unlockTwo(&lock1->slock, &lock2->slock);

}

template<>

void SideTable::unlockTwo<DoHaveOld, DontHaveNew>

(SideTable *lock1, SideTable *)

{

lock1->unlock();

}

template<>

void SideTable::unlockTwo<DontHaveOld, DoHaveNew>

(SideTable *, SideTable *lock2)

{

lock2->unlock();

}

alignas(StripedMap<SideTable>) static uint8_t

SideTableBuf[sizeof(StripedMap<SideTable>)];

static void SideTableInit() {

new (SideTableBuf) StripedMap<SideTable>();

}

static StripedMap<SideTable>& SideTables() {

return *reinterpret_cast<StripedMap<SideTable>*>(SideTableBuf);

}

};

void SideTableLockAll() {

SideTables().lockAll();

}

void SideTableUnlockAll() {

SideTables().unlockAll();

}

void SideTableForceResetAll() {

SideTables().forceResetAll();

}

void SideTableDefineLockOrder() {

SideTables().defineLockOrder();

}

void SideTableLocksPrecedeLock(const void *newlock) {

SideTables().precedeLock(newlock);

}

void SideTableLocksSucceedLock(const void *oldlock) {

SideTables().succeedLock(oldlock);

}

void SideTableLocksPrecedeLocks(StripedMap<spinlock_t>& newlocks) {

int i = 0;

const void *newlock;

while ((newlock = newlocks.getLock(i++))) {

SideTables().precedeLock(newlock);

}

}

void SideTableLocksSucceedLocks(StripedMap<spinlock_t>& oldlocks) {

int i = 0;

const void *oldlock;

while ((oldlock = oldlocks.getLock(i++))) {

SideTables().succeedLock(oldlock);

}

}

id objc_retainBlock(id x) {

return (id)_Block_copy(x);

}

BOOL objc_should_deallocate(id object) {

return YES;

}

objc_retain_autorelease(id obj)

{

return objc_autorelease(objc_retain(obj));

}

objc_storeStrong(id *location, id obj)

{

id prev = *location;

if (obj == prev) {

return;

}

objc_retain(obj);

*location = obj;

objc_release(prev);

}

enum CrashIfDeallocating {

DontCrashIfDeallocating = false, DoCrashIfDeallocating = true

};

template <HaveOld haveOld, HaveNew haveNew,

CrashIfDeallocating crashIfDeallocating>

static id

storeWeak(id *location, objc_object *newObj) { //location 是 weak 指针,newObj 是 weak 指针将要指向的对象

//模版函数 haveOld、haveNew由编译器传入参数，这里传递的是haveOld=false，haveNew=true

assert(haveOld || haveNew);

if (!haveNew) assert(newObj == nil);

Class previouslyInitializedClass = nil;

id oldObj;

SideTable *oldTable; //⚠️存储旧对象的weak相关的信息

SideTable *newTable; //⚠️存储新对象的weak相关的信息

// Acquire locks for old and new values.

// Order by lock address to prevent lock ordering problems.

// Retry if the old value changes underneath us.

retry:

if (haveOld) { //如果之前weak弱指针(即id *location)有指向，现在要改指向新的对象，那么需要先将旧的指向给删除了，才能重新指向新的对象

oldObj = *location; //⚠️通过弱引用指针获取旧对象

oldTable = &SideTables()[oldObj]; //⚠️通过旧对象获取到对应的SideTable

} else {

oldTable = nil;

}

if (haveNew) {

newTable = &SideTables()[newObj]; //⚠️获取新对象的SideTable

} else {

newTable = nil;

}

SideTable::lockTwo<haveOld, haveNew>(oldTable, newTable);

//进行线程冲突重处理判断

if (haveOld && *location != oldObj) { //如果有旧值，并且现在新的弱引用指向不指向旧对象

SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);

goto retry;

}

// Prevent a deadlock between the weak reference machinery

// and the +initialize machinery by ensuring that no

// weakly-referenced object has an un-+initialized isa.

if (haveNew && newObj) { //⚠️有新值，并且新值不为nil，

Class cls = newObj->getIsa(); //⚠️获取新对象的isa指针

if (cls != previouslyInitializedClass &&

!((objc_class *)cls)->isInitialized()) {

SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);

//如果cls没有初始化，先对其进行初始化在尝试设置weak

_class_initialize(_class_getNonMetaClass(cls, (id)newObj));

// If this class is finished with +initialize then we're good.

// If this class is still running +initialize on this thread

// (i.e. +initialize called storeWeak on an instance of itself)

// then we may proceed but it will appear initializing and

// not yet initialized to the check above.

// Instead set previouslyInitializedClass to recognize it on retry.

previouslyInitializedClass = cls;

goto retry;

}

}

// Clean up old value, if any.

//⚠️ 清除旧对象weak_table中的location

if (haveOld) { //旧对象所在的弱引用表、旧对象、弱引用指针

//如果 weak 指针有旧值, 则需要在 weak_table 中处理掉旧值

weak_unregister_no_lock(&oldTable->weak_table, oldObj, location);

}

// Assign new value, if any.

//⚠️ 保存location到新对象的weak_table种

if (haveNew) {

//如果 weak 指针将要指向新值(即非 location = nil 的情况), 在 weak_table 中处理赋值操作

newObj = (objc_object *)

weak_register_no_lock(&newTable->weak_table, (id)newObj, location,

crashIfDeallocating);

// weak_register_no_lock returns nil if weak store should be rejected

// Set is-weakly-referenced bit in refcount table.

if (newObj && !newObj->isTaggedPointer()) {

newObj->setWeaklyReferenced_nolock();

}

// Do not set *location anywhere else. That would introduce a race.

//⚠️设置location指针指向newObj

*location = (id)newObj;

}

else { //⚠️没有新值，则无需更改

// No new value. The storage is not changed.

}

SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable);

return (id)newObj;

}

objc_storeWeak(id *location, id newObj)

{

return storeWeak<DoHaveOld, DoHaveNew, DoCrashIfDeallocating>

(location, (objc_object *)newObj);

}

objc_storeWeakOrNil(id *location, id newObj)

{

return storeWeak<DoHaveOld, DoHaveNew, DontCrashIfDeallocating>

(location, (objc_object *)newObj);

}

objc_initWeak(id *location, id newObj) {

if (!newObj) { //如果newObj对象为nil，那么指向它的weak指针也要置为nil

*location = nil;

return nil;

}

//DontHaveOld: 没有旧对象 DoHaveNew: 有新对象 DoCrashIfDeallocating: 如果释放了就Crash提示

return storeWeak<DontHaveOld, DoHaveNew, DoCrashIfDeallocating>

(location, (objc_object*)newObj);

}

objc_initWeakOrNil(id *location, id newObj) {

if (!newObj) {

*location = nil;

return nil;

}

return storeWeak<DontHaveOld, DoHaveNew, DontCrashIfDeallocating>

(location, (objc_object*)newObj);

}

objc_destroyWeak(id *location)

{

(void)storeWeak<DoHaveOld, DontHaveNew, DontCrashIfDeallocating>

(location, nil);

}

objc_loadWeakRetained(id *location)

{

id obj;

id result;

Class cls;

SideTable *table;

retry:

// fixme std::atomic this load

obj = *location;

if (!obj) return nil;

if (obj->isTaggedPointer()) return obj;

table = &SideTables()[obj];

table->lock();

if (*location != obj) {

table->unlock();

goto retry;

}

result = obj;

cls = obj->ISA();

if (! cls->hasCustomRR()) {

// Fast case. We know +initialize is complete because

// default-RR can never be set before then.

assert(cls->isInitialized());

if (! obj->rootTryRetain()) {

result = nil;

}

}

else {

// Slow case. We must check for +initialize and call it outside

// the lock if necessary in order to avoid deadlocks.

if (cls->isInitialized() || _thisThreadIsInitializingClass(cls)) {

BOOL (*tryRetain)(id, SEL) = (BOOL(*)(id, SEL))

class_getMethodImplementation(cls, SEL_retainWeakReference);

if ((IMP)tryRetain == _objc_msgForward) {

result = nil;

}

else if (! (*tryRetain)(obj, SEL_retainWeakReference)) {

result = nil;

}

}

else {

table->unlock();

_class_initialize(cls);

goto retry;

}

}

table->unlock();

return result;

}

objc_loadWeak(id *location)

{

if (!*location) return nil;

return objc_autorelease(objc_loadWeakRetained(location));

}

objc_copyWeak(id *dst, id *src)

{

id obj = objc_loadWeakRetained(src);

objc_initWeak(dst, obj);

objc_release(obj);

}

objc_moveWeak(id *dst, id *src)

{

objc_copyWeak(dst, src);

objc_destroyWeak(src);

*src = nil;

}

#define PROTECT_AUTORELEASEPOOL 0

#define CHECK_AUTORELEASEPOOL (DEBUG)

BREAKPOINT_FUNCTION(void objc_autoreleaseNoPool(id obj));

BREAKPOINT_FUNCTION(void objc_autoreleasePoolInvalid(const void *token));

namespace {

struct magic_t {

static const uint32_t M0 = 0xA1A1A1A1;

# define M1 "AUTORELEASE!"

static const size_t M1_len = 12;

uint32_t m[4];

magic_t() {

assert(M1_len == strlen(M1));

assert(M1_len == 3 * sizeof(m[1]));

m[0] = M0;

strncpy((char *)&m[1], M1, M1_len);

}

~magic_t() {

m[0] = m[1] = m[2] = m[3] = 0;

}

bool check() const {

return (m[0] == M0 && 0 == strncmp((char *)&m[1], M1, M1_len));

}

bool fastcheck() const {

#if CHECK_AUTORELEASEPOOL

return check();

#else

return (m[0] == M0);

#endif

}

# undef M1

};

class AutoreleasePoolPage

{

// EMPTY_POOL_PLACEHOLDER is stored in TLS when exactly one pool is

// pushed and it has never contained any objects. This saves memory

// when the top level (i.e. libdispatch) pushes and pops pools but

// never uses them.

# define EMPTY_POOL_PLACEHOLDER ((id*)1)

# define POOL_BOUNDARY nil //哨兵对象

static pthread_key_t const key = AUTORELEASE_POOL_KEY;

static uint8_t const SCRIBBLE = 0xA3; // 0xA3A3A3A3 after releasing

//每一个page的大小

static size_t const SIZE =

#if PROTECT_AUTORELEASEPOOL

PAGE_MAX_SIZE; // must be multiple of vm page size

#else

PAGE_MAX_SIZE; // size and alignment, power of 2

#endif

static size_t const COUNT = SIZE / sizeof(id);

// AutoreleasePoolPage对象内部有7个成员变量，每个占用8个字节

magic_t const magic; //用来校验 AutoreleasePoolPage 的结构是否完整 16字节

id *next; //指向了下一个能存放autorelease对象地址的区域，初始化时指向 begin() 8字节

pthread_t const thread; //指向当前线程，AutoreleasePool是和线程一一对应的， 8字节

AutoreleasePoolPage * const parent; //父节点，指向上一个AutoreleasePoolPage对象，第一个结点的parent值为nil 8字节

AutoreleasePoolPage *child; //子节点，指向下一个AutoreleasePoolPage对象，最后一个结点的 child 值为 nil 8字节

uint32_t const depth; //代表深度，从 0 开始，往后递增 1 4字节

uint32_t hiwat; //4字节

// SIZE-sizeof(*this) bytes of contents follow

static void * operator new(size_t size) {

return malloc_zone_memalign(malloc_default_zone(), SIZE, SIZE);

}

static void operator delete(void * p) {

return free(p);

}

inline void protect() {

#if PROTECT_AUTORELEASEPOOL

mprotect(this, SIZE, PROT_READ);

check();

#endif

}

inline void unprotect() {

#if PROTECT_AUTORELEASEPOOL

check();

mprotect(this, SIZE, PROT_READ | PROT_WRITE);

#endif

}

// 构造函数

AutoreleasePoolPage(AutoreleasePoolPage *newParent)

: magic(),

next(begin()), //开始存储的位置

thread(pthread_self()), //传的是当前线程，

parent(newParent), child(nil),

depth(parent ? 1+parent->depth : 0), //如果是第一页深度为0，往后是前一个的深度+1

hiwat(parent ? parent->hiwat : 0)

{

if (parent) {

parent->check();

assert(!parent->child);

parent->unprotect();

parent->child = this;

parent->protect();

}

protect();

}

//析构函数

~AutoreleasePoolPage()

{

check();

unprotect();

assert(empty());

// Not recursive: we don't want to blow out the stack

// if a thread accumulates a stupendous amount of garbage

assert(!child);

}

void busted(bool die = true)

{

magic_t right;

(die ? _objc_fatal : _objc_inform)

("autorelease pool page %p corrupted\n"

" magic 0x%08x 0x%08x 0x%08x 0x%08x\n"

" should be 0x%08x 0x%08x 0x%08x 0x%08x\n"

" pthread %p\n"

" should be %p\n",

this,

magic.m[0], magic.m[1], magic.m[2], magic.m[3],

right.m[0], right.m[1], right.m[2], right.m[3],

this->thread, pthread_self());

}

void check(bool die = true)

{

if (!magic.check() || !pthread_equal(thread, pthread_self())) {

busted(die);

}

}

void fastcheck(bool die = true)

{

#if CHECK_AUTORELEASEPOOL

check(die);

#else

if (! magic.fastcheck()) {

busted(die);

}

#endif

}

//页的开始位置

id * begin() {

return (id *) ((uint8_t *)this+sizeof(*this));

}

//页的结束位置

id * end() {

return (id *) ((uint8_t *)this+SIZE);

}

//⚠️当 next == begin() 时，表示 AutoreleasePoolPage 为空

bool empty() {

return next == begin();

}

//⚠️当 next == end() 时，表示 AutoreleasePoolPage 已满

bool full() {

return next == end();

}

//页的存储是否少于空间的一半

bool lessThanHalfFull() {

return (next - begin() < (end() - begin()) / 2);

}

// 释放所有对象 知道开始位置(哨兵对象所在的位置)

void releaseAll() {

releaseUntil(begin());

}

//释放到stop位置之前的所有对象

void releaseUntil(id *stop) {

// Not recursive: we don't want to blow out the stack

// if a thread accumulates a stupendous amount of garbage

//判断下一个对象是否等于stop，如果不等于，则进入while循环

while (this->next != stop) {

// Restart from hotPage() every time, in case -release

// autoreleased more objects

//获取当前操作页面，即hot页面

AutoreleasePoolPage *page = hotPage();