#include "objc-private.h"

#include "objc-weak.h"

#include <stdint.h>

#include <stdbool.h>

#include <sys/types.h>

#include <libkern/OSAtomic.h>

#define TABLE_SIZE(entry) (entry->mask ? entry->mask + 1 : 0)

static void append_referrer(weak_entry_t *entry, objc_object **new_referrer);

BREAKPOINT_FUNCTION(

void objc_weak_error(void)

);

static void bad_weak_table(weak_entry_t *entries)

{

_objc_fatal("bad weak table at %p. This may be a runtime bug or a "

"memory error somewhere else.", entries);

}

static inline uintptr_t hash_pointer(objc_object *key) {

return ptr_hash((uintptr_t)key);

}

static inline uintptr_t w_hash_pointer(objc_object **key) {

return ptr_hash((uintptr_t)key);

}

__attribute__((noinline, used))

static void grow_refs_and_insert(weak_entry_t *entry,

objc_object **new_referrer)

{

assert(entry->out_of_line());

size_t old_size = TABLE_SIZE(entry);

size_t new_size = old_size ? old_size * 2 : 8;

size_t num_refs = entry->num_refs;

weak_referrer_t *old_refs = entry->referrers;

entry->mask = new_size - 1;

entry->referrers = (weak_referrer_t *)

calloc(TABLE_SIZE(entry), sizeof(weak_referrer_t));

entry->num_refs = 0;

entry->max_hash_displacement = 0;

for (size_t i = 0; i < old_size && num_refs > 0; i++) {

if (old_refs[i] != nil) {

append_referrer(entry, old_refs[i]);

num_refs--;

}

}

// Insert

append_referrer(entry, new_referrer);

if (old_refs) free(old_refs);

}

static void append_referrer(weak_entry_t *entry, objc_object **new_referrer)

{

if (! entry->out_of_line()) { //如果数组大小没超过 4

// Try to insert inline.

for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) { //循环查找数组成员

if (entry->inline_referrers[i] == nil) { //把新的 weak 指针插入到空位置

entry->inline_referrers[i] = new_referrer;

return;

}

}

//数组中的 4 个位置都非空, 就要调整策略使用 referrers 了, 从这里开始, 这一段是把 inline_referrers 数组调整为使用 referrers 的形式

// Couldn't insert inline. Allocate out of line.

weak_referrer_t *new_referrers = (weak_referrer_t *)

calloc(WEAK_INLINE_COUNT, sizeof(weak_referrer_t)); //还是开辟 4 个 weak_referrer_t 大小的空间

// This constructed table is invalid, but grow_refs_and_insert

// will fix it and rehash it.

for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) {

new_referrers[i] = entry->inline_referrers[i]; //将 inline_referrers 中的值赋值给 referrers

}

//配置 entry 结构

entry->referrers = new_referrers;

entry->num_refs = WEAK_INLINE_COUNT;

entry->out_of_line_ness = REFERRERS_OUT_OF_LINE;

entry->mask = WEAK_INLINE_COUNT-1;

entry->max_hash_displacement = 0;

}

assert(entry->out_of_line());

if (entry->num_refs >= TABLE_SIZE(entry) * 3/4) { //数组使用量超过 3/4

return grow_refs_and_insert(entry, new_referrer); //需要扩展数组并进行插入

}

//开始哈希算法

size_t begin = w_hash_pointer(new_referrer) & (entry->mask);

size_t index = begin; //使用哈希算法计算到一个起始下标

size_t hash_displacement = 0; //哈希偏移次数

while (entry->referrers[index] != nil) { //循环找空位置

hash_displacement++; //移位一次 +1

index = (index+1) & entry->mask; //从起始位置开始遍历, 对数组大小取模

if (index == begin) bad_weak_table(entry); //如果找了一圈, 证明算法出了点问题

}

//这里记录下移位的最大值, 那么数组里的任何一个数据, 存储时的移位次数都不大于这个值

//可以提升查找时的效率, 如果移位次数超过了这个值都没有找到, 就证明要查找的项不在数组中

if (hash_displacement > entry->max_hash_displacement) {

entry->max_hash_displacement = hash_displacement;

}

weak_referrer_t &ref = entry->referrers[index];

ref = new_referrer;

entry->num_refs++; //数组使用量 +1

}

static void remove_referrer(weak_entry_t *entry, objc_object **old_referrer)

{

if (! entry->out_of_line()) {

for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) {

if (entry->inline_referrers[i] == old_referrer) {

entry->inline_referrers[i] = nil;

return;

}

}

_objc_inform("Attempted to unregister unknown __weak variable "

"at %p. This is probably incorrect use of "

"objc_storeWeak() and objc_loadWeak(). "

"Break on objc_weak_error to debug.\n",

old_referrer);

objc_weak_error();

return;

}

size_t begin = w_hash_pointer(old_referrer) & (entry->mask);

size_t index = begin;

size_t hash_displacement = 0;

while (entry->referrers[index] != old_referrer) {

index = (index+1) & entry->mask;

if (index == begin) bad_weak_table(entry);

hash_displacement++;

if (hash_displacement > entry->max_hash_displacement) {

_objc_inform("Attempted to unregister unknown __weak variable "

"at %p. This is probably incorrect use of "

"objc_storeWeak() and objc_loadWeak(). "

"Break on objc_weak_error to debug.\n",

old_referrer);

objc_weak_error();

return;

}

}

entry->referrers[index] = nil;

entry->num_refs--;

}

static void weak_entry_insert(weak_table_t *weak_table, weak_entry_t *new_entry)

{

weak_entry_t *weak_entries = weak_table->weak_entries;

assert(weak_entries != nil);

size_t begin = hash_pointer(new_entry->referent) & (weak_table->mask);

size_t index = begin;

size_t hash_displacement = 0;

while (weak_entries[index].referent != nil) {

index = (index+1) & weak_table->mask;

if (index == begin) bad_weak_table(weak_entries);

hash_displacement++;

}

weak_entries[index] = *new_entry;

weak_table->num_entries++;

if (hash_displacement > weak_table->max_hash_displacement) {

weak_table->max_hash_displacement = hash_displacement;

}

}

static void weak_resize(weak_table_t *weak_table, size_t new_size)

{

size_t old_size = TABLE_SIZE(weak_table);

weak_entry_t *old_entries = weak_table->weak_entries;

weak_entry_t *new_entries = (weak_entry_t *)

calloc(new_size, sizeof(weak_entry_t));

weak_table->mask = new_size - 1;

weak_table->weak_entries = new_entries;

weak_table->max_hash_displacement = 0;

weak_table->num_entries = 0; // restored by weak_entry_insert below

if (old_entries) {

weak_entry_t *entry;

weak_entry_t *end = old_entries + old_size;

for (entry = old_entries; entry < end; entry++) {

if (entry->referent) {

weak_entry_insert(weak_table, entry);

}

}

free(old_entries);

}

}

static void weak_grow_maybe(weak_table_t *weak_table)

{

size_t old_size = TABLE_SIZE(weak_table);

// Grow if at least 3/4 full.

if (weak_table->num_entries >= old_size * 3 / 4) {

weak_resize(weak_table, old_size ? old_size*2 : 64);

}

}

static void weak_compact_maybe(weak_table_t *weak_table)

{

size_t old_size = TABLE_SIZE(weak_table);

//如果数组大小大于 1024, 但使用量小于 1/16 的话, 将数组进行收缩, 节省空间

// Shrink if larger than 1024 buckets and at most 1/16 full.

if (old_size >= 1024 && old_size / 16 >= weak_table->num_entries) {

weak_resize(weak_table, old_size / 8); //收缩至原有大小的 1/8

// leaves new table no more than 1/2 full

//使用量小于 1/16, 收缩至 1/8 后, 使用量小于 1/2

}

}

⚠️dealloc销毁对象第8⃣️步

static void weak_entry_remove(weak_table_t *weak_table, weak_entry_t *entry)

{

// remove entry

if (entry->out_of_line()) free(entry->referrers); //如果 out_of_line(), 则需要 free 掉为 referrers alloc 的空间

bzero(entry, sizeof(*entry)); //entry 所属空间清空

weak_table->num_entries--; //weak_table 中 entries 元素个数 -1

weak_compact_maybe(weak_table); //根据需要重新调整 weak_table 的空间

}

static weak_entry_t *

weak_entry_for_referent(weak_table_t *weak_table, objc_object *referent)

{

assert(referent);

weak_entry_t *weak_entries = weak_table->weak_entries;

if (!weak_entries) return nil;

size_t begin = hash_pointer(referent) & weak_table->mask;

size_t index = begin;

size_t hash_displacement = 0;

while (weak_table->weak_entries[index].referent != referent) {

index = (index+1) & weak_table->mask;

if (index == begin) bad_weak_table(weak_table->weak_entries);

hash_displacement++;

if (hash_displacement > weak_table->max_hash_displacement) {

return nil;

}

}

return &weak_table->weak_entries[index];

}

weak_unregister_no_lock(weak_table_t *weak_table, id referent_id,

id *referrer_id) //弱引用表、旧对象、弱引用指针

{

objc_object *referent = (objc_object *)referent_id; //weak 指针指向的对象

objc_object **referrer = (objc_object **)referrer_id; //referrer_id是 weak 指针, 操作时需要用到这个指针的地址

weak_entry_t *entry;

//若旧的对象为空，则直接返回

if (!referent) return;

//通过旧对象找到弱引用表中的weak_entry_t，然后将弱引用指针从weak_entry_t的数组中移除

if ((entry = weak_entry_for_referent(weak_table, referent))) { //查找 referent 对象对应的 entry

remove_referrer(entry, referrer); //从 referent 对应的 entry 中删除地址为 referrer 的 weak 指针

bool empty = true;

if (entry->out_of_line() && entry->num_refs != 0) { //如果 entry 中的数组容量大于 4 并且数组中还有元素

empty = false; //entry 非空

}else { //否则循环查找 entry 数组, 如果 4 个位置中有一个非空

for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) {

if (entry->inline_referrers[i]) {

empty = false; //entry 非空

break;

}

}

}

if (empty) { //如果没有通过之前的查找逻辑, 则说明 entry 为空

weak_entry_remove(weak_table, entry); //从 weak_table 中移除该条 entry

}

}

// Do not set *referrer = nil. objc_storeWeak() requires that the

// value not change.

}

id

weak_register_no_lock(weak_table_t *weak_table, id referent_id,

id *referrer_id, bool crashIfDeallocating) {

//⚠️被弱引用的对象

objc_object *referent = (objc_object *)referent_id;

//⚠️__weak指针的地址

objc_object **referrer = (objc_object **)referrer_id;

//⚠️如果referent为nil 或 referent 采用了TaggedPointer计数方式，直接返回，不做任何操作

if (!referent || referent->isTaggedPointer()) return referent_id;

// ensure that the referenced object is viable

bool deallocating;

if (!referent->ISA()->hasCustomRR()) { //⚠️确保被引用的对象可用（没有在析构，同时应该支持weak引用）

deallocating = referent->rootIsDeallocating();

}else {

BOOL (*allowsWeakReference)(objc_object *, SEL) =

(BOOL(*)(objc_object *, SEL))

object_getMethodImplementation((id)referent,

SEL_allowsWeakReference);

if ((IMP)allowsWeakReference == _objc_msgForward) {

return nil;

}

deallocating =

! (*allowsWeakReference)(referent, SEL_allowsWeakReference);

}

if (deallocating) { //⚠️正在析构的对象，不能够被弱引用

if (crashIfDeallocating) {

_objc_fatal("Cannot form weak reference to instance (%p) of "

"class %s. It is possible that this object was "

"over-released, or is in the process of deallocation.",

(void*)referent, object_getClassName((id)referent));

} else {

return nil;

}

}

// now remember it and where it is being stored

weak_entry_t *entry;

//⚠️在 weak_table中找到referent对应的weak_entry,并将referrer加入到weak_entry中

if ((entry = weak_entry_for_referent(weak_table, referent))) { //如果 weak_table 有对应的 entry

append_referrer(entry, referrer); //将 weak 指针存入对应的 entry 中

} else { //⚠️ 如果找不到，就新建一个

weak_entry_t new_entry(referent, referrer); //创建新的 entry

weak_grow_maybe(weak_table); //查看是否需要调整 weak_table 中 weak_entries 数组大小

weak_entry_insert(weak_table, &new_entry); //将新的 entry 插入到 weak_table 中

}

// Do not set *referrer. objc_storeWeak() requires that the

// value not change.

return referent_id;

}

#if DEBUG

weak_is_registered_no_lock(weak_table_t *weak_table, id referent_id)

{

return weak_entry_for_referent(weak_table, (objc_object *)referent_id);

}

#endif

void

weak_clear_no_lock(weak_table_t *weak_table, id referent_id)

{

objc_object *referent = (objc_object *)referent_id;

//拿到对象的地址 通过hash算法找到weak_table中对应的weak_entry_t

weak_entry_t *entry = weak_entry_for_referent(weak_table, referent);

if (entry == nil) {

/// XXX shouldn't happen, but does with mismatched CF/objc

//printf("XXX no entry for clear deallocating %p\n", referent);

return;

}

// zero out references

weak_referrer_t *referrers;

size_t count;

if (entry->out_of_line()) { //弱引用个数超过4个，使用动态数组，获取到weak_entity_t中的动态数组

referrers = entry->referrers;

count = TABLE_SIZE(entry);

}

else { //否则使用静态数组，获取到weak_entity_t中的静态数组

referrers = entry->inline_referrers;

count = WEAK_INLINE_COUNT; //WEAK_INLINE_COUNT = 4

}

//遍历存放弱引用的数组，若弱引用的地址指向该对象，则将该弱引用置为nil

for (size_t i = 0; i < count; ++i) {

objc_object **referrer = referrers[i];

if (referrer) {

if (*referrer == referent) { //如果弱引用的指针指向的就是当前的对象，那么就将该弱引用指针置为nil

*referrer = nil;

}

else if (*referrer) {

_objc_inform("__weak variable at %p holds %p instead of %p. "

"This is probably incorrect use of "

"objc_storeWeak() and objc_loadWeak(). "

"Break on objc_weak_error to debug.\n",

referrer, (void*)*referrer, (void*)referent);

objc_weak_error();

}

}

}

//然后将该weak_entity_t从弱引用表中移除

weak_entry_remove(weak_table, entry);

}