在ARC模式中weak關鍵字常常用來處理對象之間的互相強引用導致的內存泄漏問題,主要是因爲使用weak修飾變量不會導致引用計數的增加不會影響對象的生命週期,而且在對象釋放之後會將自動指針置空避免也指針訪問問題.那麼系統是和實現weak管理的？
定位實現文件
- 首先在Xcode中,打開彙編調試
-
Xcode->Debug->Debug Workflow->Always Show Disassembly - 創建對象並進行弱引用,並在弱引用處設置斷點.
-
int main(int argc, const char * argv[]) { @autoreleasepool { NSObject *obj = [[NSObject alloc] init]; __weak typeof(obj) weakObj = obj;//在此處斷點 } } - 執行
-
... 0x100000ece <+62>: movq %rax, -0x18(%rbp) -> 0x100000ed2 <+66>: movq -0x18(%rbp), %rax 0x100000ed6 <+70>: leaq -0x20(%rbp), %rsi 0x100000eda <+74>: movq %rsi, %rdi 0x100000edd <+77>: movq %rax, %rsi 0x100000ee0 <+80>: callq 0x100000f2e ; symbol stub for: objc_initWeak 0x100000ee5 <+85>: leaq -0x20(%rbp), %rsi 0x100000ee9 <+89>: movq %rsi, %rdi 0x100000eec <+92>: movq %rax, -0x30(%rbp) 0x100000ef0 <+96>: callq 0x100000f28 ; symbol stub for: objc_destroyWeak 0x100000ef5 <+101>: xorl %ecx, %ecx 0x100000ef7 <+103>: movl %ecx, %esi 0x100000ef9 <+105>: leaq -0x18(%rbp), %rax 0x100000efd <+109>: movq %rax, %rdi 0x100000f00 <+112>: callq 0x100000f34 ; symbol stub for: objc_storeStrong 0x100000f05 <+117>: movq -0x28(%rbp), %rdi 0x100000f09 <+121>: callq 0x100000f1c ; symbol stub for: objc_autoreleasePoolPop 0x100000f0e <+126>: xorl %eax, %eax 0x100000f10 <+128>: addq $0x30, %rsp 0x100000f14 <+132>: popq %rbp 0x100000f15 <+133>: retq - 發現下一步要執行的函數是objc_initWeak,爲符號objc_initWeak設置斷點
-
Xcode->Show the Breakpoint navigator->左下角 "+" ->Symbolic Breakpoint... - 發現在objc_initWeak函數的實現在libobjc.A.dylib中
-
libobjc.A.dylib`::objc_initWeak(id *, id): 0x1003c6c40 <+0>: pushq %rbp 0x1003c6c41 <+1>: movq %rsp, %rbp 0x1003c6c44 <+4>: subq $0x20, %rsp 0x1003c6c48 <+8>: movq %rdi, -0x10(%rbp) 0x1003c6c4c <+12>: movq %rsi, -0x18(%rbp) -> 0x1003c6c50 <+16>: cmpq $0x0, -0x18(%rbp) 0x1003c6c55 <+21>: jne 0x1003c6c73 ; <+51> at NSObject.mm:415:10 0x1003c6c5b <+27>: movq -0x10(%rbp), %rax 0x1003c6c5f <+31>: movq $0x0, (%rax) 0x1003c6c66 <+38>: movq $0x0, -0x8(%rbp) 0x1003c6c6e <+46>: jmp 0x1003c6c87 ; <+71> at NSObject.mm:416:1 ...
所以可以通過objc的源代碼來查找相關實現.
查看實現
以下探討使用objc756.2進行說明.
首先了解需要的數據結構
-
StripedMap
- reinterpret_cast<new_type> (expression)是C++中用來處理無關類型轉化的一個運算符,它會產生一個新的值，這個值會有與原始參數有完全相同的比特位.在該實現中用於將一個證書類型轉化爲指針類型,可以理解爲生成一個開闢置頂大小空間的指針；
-
使用場景： 從指針類型到一個足夠大的整數類型 從整數類型或者枚舉類型到指針類型 從一個指向函數的指針到另一個不同類型的指向函數的指針 從一個指向對象的指針到另一個不同類型的指向對象的指針 從一個指向類函數成員的指針到另一個指向不同類型的函數成員的指針 從一個指向類數據成員的指針到另一個指向不同類型的數據成員的指針- 全局維護了一個StripedMap變量，其內部實現是一個靜態數組.在TARGET_OS_IPHONE非模擬器上數組元素的最大個數爲8，否則數組元素的最大個數爲64.
- 通過將被引用對象的地址做indexForPointer運算使得每個被引用對象運算之後的結果在[0, StripeCount)之間；
- 存儲的值是抽象的PaddedT,在弱引用管理中存儲的是結構體SideTable的實例.
-
static StripedMap<SideTable>& SideTables() { return *reinterpret_cast<StripedMap<SideTable>*>(SideTableBuf); } class StripedMap { #if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR enum { StripeCount = 8 }; #else enum { StripeCount = 64 }; #endif struct PaddedT { T value alignas(CacheLineSize); }; PaddedT array[StripeCount]; int count = StripeCount; //將被引用對象的指針索引化,結果在[0, StripeCount) static unsigned int indexForPointer(const void *p) { uintptr_t addr = reinterpret_cast<uintptr_t>(p); int count = StripeCount; return ((addr >> 4) ^ (addr >> 9)) % StripeCount; } public: T& operator[] (const void *p) { return array[indexForPointer(p)].value; } const T& operator[] (const void *p) const { return const_cast<StripedMap<T>>(this)[p]; } // Shortcuts for StripedMaps of locks. void lockAll() { for (unsigned int i = 0; i < StripeCount; i++) { array[i].value.lock(); } } void unlockAll() { for (unsigned int i = 0; i < StripeCount; i++) { array[i].value.unlock(); } } void forceResetAll() { for (unsigned int i = 0; i < StripeCount; i++) { array[i].value.forceReset(); } } void defineLockOrder() { for (unsigned int i = 1; i < StripeCount; i++) { lockdebug_lock_precedes_lock(&array[i-1].value, &array[i].value); } } void precedeLock(const void *newlock) { // assumes defineLockOrder is also called lockdebug_lock_precedes_lock(&array[StripeCount-1].value, newlock); } void succeedLock(const void *oldlock) { // assumes defineLockOrder is also called lockdebug_lock_precedes_lock(oldlock, &array[0].value); } const void *getLock(int i) { if (i < StripeCount) return &array[i].value; else return nil; } #if DEBUG StripedMap() { // Verify alignment expectations. uintptr_t base = (uintptr_t)&array[0].value; uintptr_t delta = (uintptr_t)&array[1].value - base; assert(delta % CacheLineSize == 0); assert(base % CacheLineSize == 0); } #else constexpr StripedMap() {} #endif };
- SideTable:主要用於輔助管理對象的引用計數和弱引用依賴.
- slock：保證操作線程安全的自旋鎖;
- 用於輔助管理對象的引用計數:當對象isa中extra_rc不足以存儲對象引用對象時,has_sidetable_rc會被置爲1,然後對引用計數進行折半，一半存儲在isa中extra_rc位區，另一半存儲在對應的sidetable中,可以通過對象的地址查找到存儲的sidetable實例.
-
struct SideTable { spinlock_t slock; //保障操作安全的鎖 RefcountMap refcnts;//保存對應的引用計數:當isa中extra_rc不足以保存時,使用散列表保存refcnts.find(obj) weak_table_t weak_table;//保存weak_table_t //默認構造函數 SideTable() { memset(&weak_table, 0, sizeof(weak_table)); } //析構函數 ~SideTable() { _objc_fatal("Do not delete SideTable."); } void lock() { slock.lock(); } void unlock() { slock.unlock(); } void forceReset() { slock.forceReset(); } // Address-ordered lock discipline for a pair of side tables. template<HaveOld, HaveNew> static void lockTwo(SideTable *lock1, SideTable *lock2); template<HaveOld, HaveNew> static void unlockTwo(SideTable *lock1, SideTable *lock2); };
- struct weak_table_t：全局的弱引用表,所有的弱引用都在該表中進行存儲,使用不定類型對象的地址作爲 key，用 weak_entry_t 類型結構體對象作爲 value
-
/** * The global weak references table. Stores object ids as keys, * and weak_entry_t structs as their values. */ struct weak_table_t { weak_entry_t *weak_entries; //保存了所有指向指定對象的weak指針 size_t num_entries; // weak對象的存儲空間大小 uintptr_t mask;////參與判斷引用計數輔助量 uintptr_t max_hash_displacement;//hash key 最大偏移值:hash衝撞時最大嘗試次數，用於優化搜索算法 };
- struct weak_entry_t：用來存儲具體某一對象的所有弱引用指針
- 當對象的弱引用指針小於4個時,使用靜態數組inline_referrers進行保存,同時out_of_line_ness = 0;
- 當對象弱引用指針大於4個時,使用二維數組referrers保存,out_of_line_ness = 2;
-
struct weak_entry_t { DisguisedPtr<objc_object> referent; union { //當弱引用指針個數大於WEAK_INLINE_COUNT時,使用二維指針進行存儲 struct { weak_referrer_t *referrers; uintptr_t out_of_line_ness : 2; uintptr_t num_refs : PTR_MINUS_2; uintptr_t mask; uintptr_t max_hash_displacement; }; //當弱引用指針個數小於WEAK_INLINE_COUNT時,使用一位數組進行存儲 struct { // out_of_line_ness field is low bits of inline_referrers[1] weak_referrer_t inline_referrers[WEAK_INLINE_COUNT]; }; }; //判斷當前是否是離線存儲 bool out_of_line() { return (out_of_line_ness == REFERRERS_OUT_OF_LINE); } //重載運算符= weak_entry_t& operator=(const weak_entry_t& other) { memcpy(this, &other, sizeof(other)); return *this; } //第一個弱引用指針使用該方法存儲 weak_entry_t(objc_object *newReferent, objc_object **newReferrer) : referent(newReferent) { inline_referrers[0] = newReferrer; for (int i = 1; i < WEAK_INLINE_COUNT; i++) { inline_referrers[i] = nil; } } };
實現原理
在NSObject.mm(line 406-426)中找到了相關實現.
- objc_initWeak：runtime會調用objc_initWeak函數，初始化一個新的weak指針指向對象的地址；
-
objc_initWeak(id *location, id newObj) { //判斷原始引用對象是否爲空; if (!newObj) { *location = nil; return nil; } // 這裏傳遞了三個 bool 數值 // 使用 template 進行常量參數傳遞是爲了優化性能,預判了大概率會發生的事情處理優先 return storeWeak<DontHaveOld, DoHaveNew, DoCrashIfDeallocating> (location, (objc_object*)newObj); } - storeWeak函數：objc_initWeak函數會調用 objc_storeWeak() 函數， objc_storeWeak() 的作用是更新指針指向，創建對應的弱引用表。
-
static id storeWeak(id *location, objc_object *newObj) { //斷言在模板參數中新值和舊值至少有一個是存在:這個參數只是表明我覺得很大可能是有(新值/舊值)或者沒有(新值/舊值),實際上有或者沒有還是要做具體判斷 assert(haveOld || haveNew); if (!haveNew) assert(newObj == nil); //在類沒有完成+initialized方法之前調用weakStore時,作爲初始化的標識 Class previouslyInitializedClass = nil; id oldObj; SideTable *oldTable; SideTable *newTable; // Acquire locks for old and new values. // Order by lock address to prevent lock ordering problems. // Retry if the old value changes underneath us. //定義代碼塊，供關鍵字goto使用 retry: if (haveOld) { //獲取弱引用指針的舊指向 oldObj = *location; //獲取oldObj對應的弱引用表 oldTable = &SideTables()[oldObj]; } else { oldTable = nil; } if (haveNew) { //獲取newObj對應的弱引用表 newTable = &SideTables()[newObj]; } else { newTable = nil; } SideTable::lockTwo<haveOld, haveNew>(oldTable, newTable); //location存在弱引用指向 if (haveOld && *location != oldObj) { SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable); goto retry; } // Prevent a deadlock between the weak reference machinery // and the +initialize machinery by ensuring that no // weakly-referenced object has an un-+initialized isa. //主要防止在自定義的+initialize方法未完成時,調用storeWeak方法形成死鎖(例如在+initialize添加弱引用) if (haveNew && newObj) { Class cls = newObj->getIsa(); if (cls != previouslyInitializedClass && !((objc_class *)cls)->isInitialized()) { SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable); class_initialize(cls, (id)newObj); // If this class is finished with +initialize then we're good. // If this class is still running +initialize on this thread // (i.e. +initialize called storeWeak on an instance of itself) // then we may proceed but it will appear initializing and // not yet initialized to the check above. // Instead set previouslyInitializedClass to recognize it on retry. previouslyInitializedClass = cls; goto retry; } } // Clean up old value, if any. //如果舊值存在就清理舊值 if (haveOld) { weak_unregister_no_lock(&oldTable->weak_table, oldObj, location); } // Assign new value, if any. //綁定新值 if (haveNew) { newObj = (objc_object *) weak_register_no_lock(&newTable->weak_table, (id)newObj, location, crashIfDeallocating); // weak_register_no_lock returns nil if weak store should be rejected // Set is-weakly-referenced bit in refcount table. if (newObj && !newObj->isTaggedPointer()) { newObj->setWeaklyReferenced_nolock(); } // Do not set *location anywhere else. That would introduce a race. *location = (id)newObj; } else { // No new value. The storage is not changed. } SideTable::unlockTwo<haveOld, haveNew>(oldTable, newTable); return (id)newObj; }
綁定存儲
- weak_register_no_lock：向指定的弱引用表weak_table中添加新的弱應用指針.
- 如果被引用對象referent爲空或者referent是標籤指針則直接返回referent_id；
- 判斷當前對象是否正在釋放.如果當前對象正在釋放,當crashIfDeallocating=true,則拋出異常；當crashIfDeallocating=false時直接返回nil。通過這個函數,還可以得到一個意外的知識點:在自定義的dealloc實現中,不允許增加新的弱引用指針,否則會報錯.通過這個函數可以知道在自定義的dealloc實現中,不允許增加新的弱引用指針,否則會報錯.
- 判斷當前的弱引用表中是否存在referent對應的weak_entry_t：如果存在則直接進行append_referrer，否則需要創建新的weak_entry_t實例並添加到當前的弱應用表中.
-
id weak_register_no_lock(weak_table_t *weak_table, id referent_id, id *referrer_id, bool crashIfDeallocating) { //獲取被引用對象 objc_object *referent = (objc_object *)referent_id; //強轉referrer_id爲二級指針 objc_object **referrer = (objc_object **)referrer_id; //如果被引用對象不存在或者被引用對象爲TaggedPointer(標籤指針),直接返回被引用對象的指針 if (!referent || referent->isTaggedPointer()) return referent_id; // ensure that the referenced object is viable bool deallocating; /* 查看是否有自定義的RR函數,RR函數包括： retain release autorelease retainCount tryRetain SEL_retainWeakReference isDeallocating allowsWeakReference); */ if (!referent->ISA()->hasCustomRR()) { deallocating = referent->rootIsDeallocating(); } else { BOOL (*allowsWeakReference)(objc_object *, SEL) = (BOOL(*)(objc_object *, SEL)) object_getMethodImplementation((id)referent, SEL_allowsWeakReference); if ((IMP)allowsWeakReference == _objc_msgForward) { return nil; } deallocating = ! (*allowsWeakReference)(referent, SEL_allowsWeakReference); } if (deallocating) { //如果對象正在釋放,不能增加新的弱引用指針 if (crashIfDeallocating) { _objc_fatal("Cannot form weak reference to instance (%p) of " "class %s. It is possible that this object was " "over-released, or is in the process of deallocation.", (void*)referent, object_getClassName((id)referent)); } else { return nil; } } // now remember it and where it is being stored weak_entry_t *entry; if ((entry = weak_entry_for_referent(weak_table, referent))) { //在weak_table找到referent對應的weak_entry_t append_referrer(entry, referrer); //在entry中添加新的弱引用指針referrer } else { //在weak_table中未找到referent對應的weak_entry_t weak_entry_t new_entry(referent, referrer); //初始化新的weak_entry_t weak_grow_maybe(weak_table); //查看是否需要重新開闢weak_table空間 weak_entry_insert(weak_table, &new_entry); //在weak_table中插入new_entry } // Do not set *referrer. objc_storeWeak() requires that the // value not change. return referent_id; } - weak_grow_maybe:嘗試增加弱引用表的容量.
- 若weaktable當前的使用量不小於總量的3/4,則進行擴容；否則不做任何處理.同時也可以看出弱引用表中容量的初始化值爲64.
-
static void weak_grow_maybe(weak_table_t *weak_table) { size_t old_size = TABLE_SIZE(weak_table); // Grow if at least 3/4 full. if (weak_table->num_entries >= old_size * 3 / 4) { //擴容之後開闢新的空間並複製 weak_resize(weak_table, old_size ? old_size*2 : 64); } } - weak_entry_insert：向弱引用表中插入新的entry.
- 使用hash_pointer(new_entry->referent) & (weak_table->mask)獲取起始索引;
- 循環查找weak_entries中爲空的位置;
- 在index位置保存new_entry並num_entries進行自增;
- 保存哈希碰撞最大的嘗試次數,在查找時可以減少搜索次數.
-
static void weak_entry_insert(weak_table_t *weak_table, weak_entry_t *new_entry) { weak_entry_t *weak_entries = weak_table->weak_entries; assert(weak_entries != nil); //使用hash_pointer對new_entry->referent進行哈希運算並對容量取與 size_t begin = hash_pointer(new_entry->referent) & (weak_table->mask); size_t index = begin; size_t hash_displacement = 0; while (weak_entries[index].referent != nil) { index = (index+1) & weak_table->mask; if (index == begin) bad_weak_table(weak_entries); //hash碰撞hash_displacement自增 hash_displacement++; } //獲取到哈希索引保存new_entry weak_entries[index] = *new_entry; //weak_table->num_entries自增 weak_table->num_entries++; if (hash_displacement > weak_table->max_hash_displacement) { //保存哈希碰撞最大嘗試次數,由於優化搜索算法減少搜索次數 weak_table->max_hash_displacement = hash_displacement; } } - append_referrer: 在weak_entry_t中添加新的弱引用指針.
- 當前沒有使用離線存儲,遍歷內部靜態數組inline_referrers,有空餘的位置則直接保存new_referrer;否則開闢新的空間指針new_referrers，並將原始靜態數組的元素複製到新開闢空間中的對應位置,然後重置entry相關屬性(此時entry->num_refs=WEAK_INLINE_COUNT是大於TABLE_SIZE(entry) * 3/4).
- 判斷離線存儲的實際使用量(num_refs)是否大於空間總量的(TABLESIZE(entry))，如果爲真則需要擴容並添加新的弱引用指針,直接返回grow_refs_and_insert；否則正常存儲.
-
static void append_referrer(weak_entry_t *entry, objc_object **new_referrer) { //在增加新的弱引用指針之前使用非離線存儲弱引用指針：使用靜態數組inline_referrers來進行存儲 if (! entry->out_of_line()) { //遍歷inline_referrers查看是否存在空的位置 for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) { if (entry->inline_referrers[i] == nil) { //存在則直接將新的弱引用指針存儲在該位置,並返回 entry->inline_referrers[i] = new_referrer; return; } } // 在靜態數組中沒有可用的存儲位置，需要開闢離線空間 weak_referrer_t *new_referrers = (weak_referrer_t *) calloc(WEAK_INLINE_COUNT, sizeof(weak_referrer_t)); //將之前使用靜態數組進行存儲的元素複製到新的new_referrers中,雖然目前來講這部分操作並沒開闢足夠的空間存儲新的new_referrer，但是不用緊張會在grow_refs_and_inser進行修復並對元素進行哈希 for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) { new_referrers[i] = entry->inline_referrers[i]; } entry->referrers = new_referrers; entry->num_refs = WEAK_INLINE_COUNT; entry->out_of_line_ness = REFERRERS_OUT_OF_LINE; entry->mask = WEAK_INLINE_COUNT-1;//entry->mask永遠是最大容量-1 entry->max_hash_displacement = 0; //重置max_hash_displacement } //斷言：代碼執行到這個位置時entry應該是離線存儲，即：entry->out_of_line() = true assert(entry->out_of_line()); //如果當前已經使用了總量的3/4,則l擴容並添加新的引用,並返回 if (entry->num_refs >= TABLE_SIZE(entry) * 3/4) { return grow_refs_and_insert(entry, new_referrer); } //如果當前已經使用量小於總量的3/4,則直接添加 size_t begin = w_hash_pointer(new_referrer) & (entry->mask); //hash new_referrer並與entry->mask作&運算得到起始索引 size_t index = begin; size_t hash_displacement = 0; //發生hash碰撞 while (entry->referrers[index] != nil) { hash_displacement++; index = (index+1) & entry->mask; if (index == begin) bad_weak_table(entry); } //更新存儲時最大的hash碰撞次數,由於優化取值時算法減少搜索次數 if (hash_displacement > entry->max_hash_displacement) { entry->max_hash_displacement = hash_displacement; } weak_referrer_t &ref = entry->referrers[index]; ref = new_referrer; entry->num_refs++; } - grow_refs_and_insert：擴容並增加新的弱引用指針,最終的存儲還是依靠append_referrer完成.
- 如果當前entry容量爲0則初始化new_size=8;否則置new_size=2*old_size;
- 開闢新的空間指針賦值給entry->referrers並重置entry相關屬性;
- 插入新的弱引用指針.
-
__attribute__((noinline, used)) static void grow_refs_and_insert(weak_entry_t *entry, objc_object **new_referrer) { assert(entry->out_of_line()); //獲取當前的entry容量 size_t old_size = TABLE_SIZE(entry); //如果當前容量爲0則置new_size = 8;否則new_size=2*old_size; size_t new_size = old_size ? old_size * 2 : 8; size_t num_refs = entry->num_refs; weak_referrer_t *old_refs = entry->referrers; //重置entry->mask entry->mask = new_size - 1; //開闢新的空間指針進行擴容 entry->referrers = (weak_referrer_t *) calloc(TABLE_SIZE(entry), sizeof(weak_referrer_t)); entry->num_refs = 0; entry->max_hash_displacement = 0; for (size_t i = 0; i < old_size && num_refs > 0; i++) { if (old_refs[i] != nil) { append_referrer(entry, old_refs[i]); num_refs--; } } // Insert append_referrer(entry, new_referrer); //釋放舊指針空間 if (old_refs) free(old_refs); } - setWeaklyReferenced_nolock：保存對象的弱引用標記
- 判斷是否支持nonpointer,若不支持則直接在sidetable中保存弱引用標記；否則繼續執行.
- 若支持nonpointer且已經被標記爲存在弱引用指針,則直接返回；否則繼續執行.
- 在isa中保存弱引用標記;
- 進行newisa保存.
inline void
objc_object::setWeaklyReferenced_nolock()
{
retry:
isa_t oldisa = LoadExclusive(&isa.bits);
isa_t newisa = oldisa;
//若當前對象不支持nonpointer
if (slowpath(!newisa.nonpointer)) {
ClearExclusive(&isa.bits);
//在弱引用表中存儲弱引用標誌
sidetable_setWeaklyReferenced_nolock();
return;
}
//當前對象支持nonpointer且已經被標識爲弱引用
if (newisa.weakly_referenced) {
ClearExclusive(&isa.bits);
return;
}
//當前對象支持nonpointer，則添加弱引用標記
newisa.weakly_referenced = true;
//保存弱引用標記
if (!StoreExclusive(&isa.bits, oldisa.bits, newisa.bits)) goto retry;
}
解除存儲
- weak_unregister_no_lock：移除指定的弱引用指針
- 在weak_table中查找對應的entry;
- 從entry中移除referrer，並判斷移除之後entry是否爲空;
- 若移除之後當前entry爲空,則從weak_table中移除entry.
void
weak_unregister_no_lock(weak_table_t *weak_table, id referent_id,
id *referrer_id)
{
//獲取被引用對象
objc_object *referent = (objc_object *)referent_id;
//強轉referrer_id爲二級指針
objc_object **referrer = (objc_object **)referrer_id;
weak_entry_t *entry;
if (!referent) return;
//獲取weak_table_t中的weak_entry_t *weak_entries;
if ((entry = weak_entry_for_referent(weak_table, referent))) {
//如果弱引用指針存在,則從entry移除referrer
remove_referrer(entry, referrer);
bool empty = true;//判斷移除referrer之後entry是否爲空
if (entry->out_of_line() && entry->num_refs != 0) {
empty = false;
}
else {
for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) {
if (entry->inline_referrers[i]) {
empty = false;
break;
}
}
}
//如果移除referrer之後entry爲空則從表中移除entry
if (empty) {
weak_entry_remove(weak_table, entry);
}
}
// Do not set *referrer = nil. objc_storeWeak() requires that the
// value not change.
}
- remove_referrer: 從當前weak_entry_t實例中移除弱引用指針.
- 判斷是否是弱引用是否是離線存儲:如果使用飛離線存儲,則遍歷inline_referrers查找old_referrer,查找到則置空，否則只需執行;
- 使用離線存儲機制：使用 w_hash_pointer(old_referrer) & (entry->mask)獲取起始索引,遍歷entry->referrers，找到之後置空，並entry->num_refs自減.
static void remove_referrer(weak_entry_t *entry, objc_object **old_referrer)
{
//如果entry沒有使用離線機制存儲:對象弱引用個數不大於WEAK_INLINE_COUNT
if (! entry->out_of_line()) {
for (size_t i = 0; i < WEAK_INLINE_COUNT; i++) {
if (entry->inline_referrers[i] == old_referrer) {
//置空對應的弱引用指針
entry->inline_referrers[i] = nil;
return;
}
}
_objc_inform("Attempted to unregister unknown __weak variable "
"at %p. This is probably incorrect use of "
"objc_storeWeak() and objc_loadWeak(). "
"Break on objc_weak_error to debug.\n",
old_referrer);
objc_weak_error();
return;
}
//如果entry使用離線機制存儲:對象弱引用個數大於WEAK_INLINE_COUNT
size_t begin = w_hash_pointer(old_referrer) & (entry->mask);
size_t index = begin;
size_t hash_displacement = 0;
while (entry->referrers[index] != old_referrer) {
index = (index+1) & entry->mask;
if (index == begin) bad_weak_table(entry);
//搜索次數+1
hash_displacement++;
if (hash_displacement > entry->max_hash_displacement) {
_objc_inform("Attempted to unregister unknown __weak variable "
"at %p. This is probably incorrect use of "
"objc_storeWeak() and objc_loadWeak(). "
"Break on objc_weak_error to debug.\n",
old_referrer);
objc_weak_error();
return;
}
}
//將index對應的referrer置空
entry->referrers[index] = nil;
//弱引用計數-1
entry->num_refs--;
}
對象釋放
使用weak一個最重要的特性就是在對象釋放時,指向對象的所有弱引用都會被自動置爲nil,從而可以有效滴防止非法訪問造成的也指針問題.當一個對象的引用計數爲零時，對象會進行釋放銷燬,調用過程大概這個樣子:
- 在對象釋放時會調用dealloc方法,而dealloc會調用_objc_rootDealloc方法：
// Replaced by NSZombies
- (void)dealloc {
_objc_rootDealloc(self);
}
- _objc_rootDealloc調用objc->rootDealloc:
inline void
objc_object::rootDealloc()
{
if (isTaggedPointer()) return; // fixme necessary?
if (fastpath(isa.nonpointer &&
!isa.weakly_referenced &&
!isa.has_assoc &&
!isa.has_cxx_dtor &&
!isa.has_sidetable_rc))
{
assert(!sidetable_present());
free(this);
}
else {
object_dispose((id)this);
}
}
- objc->rootDealloc調用objc_dispose:
/***********************************************************************
* object_dispose
* fixme
* Locking: none
**********************************************************************/
id
object_dispose(id obj)
{
if (!obj) return nil;
objc_destructInstance(obj);
free(obj);
return nil;
}
- objc-dispose調用objc_destructInstance:
/***********************************************************************
* objc_destructInstance
* Destroys an instance without freeing memory.
* Calls C++ destructors.
* Calls ARC ivar cleanup.
* Removes associative references.
* Returns `obj`. Does nothing if `obj` is nil.
**********************************************************************/
void *objc_destructInstance(id obj)
{
if (obj) {
// Read all of the flags at once for performance.
bool cxx = obj->hasCxxDtor();
bool assoc = obj->hasAssociatedObjects();
// This order is important.
if (cxx) object_cxxDestruct(obj);
if (assoc) _object_remove_assocations(obj);
obj->clearDeallocating();
}
return obj;
}
- objc_desctructInstance調用objc->clearDeallocating：
inline void
objc_object::clearDeallocating()
{
//若果不支持nonpointer技術,則直接釋放
if (slowpath(!isa.nonpointer)) {
// Slow path for raw pointer isa.
sidetable_clearDeallocating();
}
else if (slowpath(isa.weakly_referenced || isa.has_sidetable_rc)) {
//支持nonpointer&有弱引用指針&(弱引用指針 || 引用計數存儲在弱引用表中)
// Slow path for non-pointer isa with weak refs and/or side table data.
clearDeallocating_slow();
}
assert(!sidetable_present());
}
- 如果當前對象不支持nonpointer則執行sidetable_clearDeallocating;否則當前對象存在弱引用指針或者引用計數存在弱引用表中,則執行clearDeallocating_slow.
- sidetable_clearDeallocating：當前對象不支持nonpointer時，清除sidetable中的弱引用指針以及引用計數：此時是否存在弱引用指針的標誌存儲在RefcountMap::iterator中的成員變量second中.
-
void objc_object::sidetable_clearDeallocating() { SideTable& table = SideTables()[this]; // clear any weak table items // clear extra retain count and deallocating bit // (fixme warn or abort if extra retain count == 0 ?) //添加線程鎖 table.lock(); RefcountMap::iterator it = table.refcnts.find(this); if (it != table.refcnts.end()) { //清除弱引用表 if (it->second & SIDE_TABLE_WEAKLY_REFERENCED) { weak_clear_no_lock(&table.weak_table, (id)this); } //清除引用計數 table.refcnts.erase(it); } table.unlock(); }- clearDeallocating_slow:當前對象支持nonpointer時，清除弱引用指針以及引用計數:此時是否存在弱引用的標誌存儲在isa的weakly_referenced位域中.
-
NEVER_INLINE void objc_object::clearDeallocating_slow() { assert(isa.nonpointer && (isa.weakly_referenced || isa.has_sidetable_rc)); SideTable& table = SideTables()[this]; table.lock(); if (isa.weakly_referenced) { //清除弱引用表 weak_clear_no_lock(&table.weak_table, (id)this); } if (isa.has_sidetable_rc) { //清除引用計數 table.refcnts.erase(this); } table.unlock(); } - weak_clear_no_lock：清理指向referent的弱引用指針.
/**
* Called by dealloc; nils out all weak pointers that point to the
* provided object so that they can no longer be used.
*
* @param weak_table
* @param referent The object being deallocated.
*/
void
weak_clear_no_lock(weak_table_t *weak_table, id referent_id)
{
objc_object *referent = (objc_object *)referent_id;
weak_entry_t *entry = weak_entry_for_referent(weak_table, referent);
//若entry爲空則證明當前對象不存在弱引用指針.
if (entry == nil) {
/// XXX shouldn't happen, but does with mismatched CF/objc
//printf("XXX no entry for clear deallocating %p\n", referent);
return;
}
// zero out references
weak_referrer_t *referrers;
size_t count;
if (entry->out_of_line()) {
//使用離線存儲弱引用指針
referrers = entry->referrers;
count = TABLE_SIZE(entry);
}
else {
//使用內部靜態數組存儲弱引用指針
referrers = entry->inline_referrers;
count = WEAK_INLINE_COUNT;
}
//遍歷弱引用數組逐個置空指向referent的弱引用指針
for (size_t i = 0; i < count; ++i) {
objc_object **referrer = referrers[i];
if (referrer) {
//當前弱指針指向對象referent
if (*referrer == referent) {
//置空弱引用指針
*referrer = nil;
}
else if (*referrer) {
_objc_inform("__weak variable at %p holds %p instead of %p. "
"This is probably incorrect use of "
"objc_storeWeak() and objc_loadWeak(). "
"Break on objc_weak_error to debug.\n",
referrer, (void*)*referrer, (void*)referent);
objc_weak_error();
}
}
}
//從weak_table中移除entry
weak_entry_remove(weak_table, entry);
}
總結
-
entry存儲使用了hash_pointer，referrer存儲使用了w_hash_pointer，其實兩個函數的實現是一樣的.
static inline uintptr_t hash_pointer(objc_object *key) {
return ptr_hash((uintptr_t)key);
}
static inline uintptr_t w_hash_pointer(objc_object **key) {
return ptr_hash((uintptr_t)key);
}
- 全局的SideTables()方法獲取的其實是一個StripedMap<SideTable>*類型的對象，該對象內部創建了一個最大容量爲StripeCount(在iOS真機中StripeCount=8；iOS模擬器中StripeCount=64)的靜態數組，所有的對象都通過indexForPointer函數映射到[0,StripeCount)的索引位置進行存儲;
- weak_table_t中weak_entries數量的初始化數量mask是64
static void weak_grow_maybe(weak_table_t *weak_table)
{
size_t old_size = TABLE_SIZE(weak_table);
// Grow if at least 3/4 full.
if (weak_table->num_entries >= old_size * 3 / 4) {
weak_resize(weak_table, old_size ? old_size*2 : 64);
}
}
- weak_entry_t中referrers的初始化數量mask是8
__attribute__((noinline, used))
static void grow_refs_and_insert(weak_entry_t *entry,
objc_object **new_referrer)
{
assert(entry->out_of_line());
size_t old_size = TABLE_SIZE(entry);
size_t new_size = old_size ? old_size * 2 : 8;
size_t num_refs = entry->num_refs;
weak_referrer_t *old_refs = entry->referrers;
entry->mask = new_size - 1;
...
}
- weak_table_t和weak_entry_t都是在使用量超過總量3/4時開始擴容
//weak_table_t擴容
static void weak_grow_maybe(weak_table_t *weak_table)
{
size_t old_size = TABLE_SIZE(weak_table);
// Grow if at least 3/4 full.
if (weak_table->num_entries >= old_size * 3 / 4) {
weak_resize(weak_table, old_size ? old_size*2 : 64);
}
}
//weak_entry_t進行擴容
static void append_referrer(weak_entry_t *entry, objc_object **new_referrer)
{
...
//如果當前已經使用了總量的3/4,則擴容並添加新的引用,並返回
if (entry->num_refs >= TABLE_SIZE(entry) * 3/4) {
return grow_refs_and_insert(entry, new_referrer);
}
...
}