runtime源码探究（一） weak的实现

weak指针的建立

weak修饰对象不增加其引用计数，apple通过一个hash表来实现对象的弱引用。
在Xcode下编写如下代码：

__weak obj1 = obj;

编译器编译之后变成类似如下的代码：

objc_initWeak(&obj1,obj);

翻开runtime源码，NSObject.mm，找到objc_initWeak函数，实现如下：

 * @param location Address of __weak ptr. 
 * @param newObj Object ptr. 
 */
id
objc_initWeak(id *location, id newObj)
{
    if (!newObj) {
        *location = nil;
        return nil;
    }

    return storeWeak<false/*old*/, true/*new*/, true/*crash*/>(location, (objc_object*)newObj);
}

apple对参数已有说明，location是weak指针的地址，newObj是被指向的对象的地址。接下来寻找storeWeak函数，先看apple对storeWeak函数的注释：

// Update a weak variable.
// If HaveOld is true, the variable has an existing value
// that needs to be cleaned up. This value might be nil.
// If HaveNew is true, there is a new value that needs to be
// assigned into the variable. This value might be nil.
// If CrashIfDeallocating is true, the process is halted if newObj is
// deallocating or newObj’s class does not support weak references.
// If CrashIfDeallocating is false, nil is stored instead.

如果weak指针有指向的对象，那么清除这个对象，然后weak指针指向新的对象；如果weak指针指向新的对象，那么就将新的weak引用存起来；如果weak指针指向的对象被释放了，那么就不会存储这个weak引用，直接返回nil。下面一行行看代码：

template <bool HaveOld, bool HaveNew, bool CrashIfDeallocating>
static id 
storeWeak(id *location, objc_object *newObj)
{
    assert(HaveOld  ||  HaveNew);
    if (!HaveNew) assert(newObj == nil);

    Class previouslyInitializedClass = nil;
    id oldObj;
    SideTable *oldTable;
    SideTable *newTable;

    // Acquire locks for old and new values.
    // Order by lock address to prevent lock ordering problems. 
    // Retry if the old value changes underneath us.
 retry:
    if (HaveOld) {
        oldObj = *location;
        oldTable = &SideTables()[oldObj];
    } else {
        oldTable = nil;
    }
    if (HaveNew) {
        newTable = &SideTables()[newObj];
    } else {
        newTable = nil;
    }

    SideTable::lockTwo<HaveOld, HaveNew>(oldTable, newTable);

    if (HaveOld  &&  *location != oldObj) {
        SideTable::unlockTwo<HaveOld, HaveNew>(oldTable, newTable);
        goto retry;
    }

    // Prevent a deadlock between the weak reference machinery
    // and the +initialize machinery by ensuring that no 
    // weakly-referenced object has an un-+initialized isa.
    if (HaveNew  &&  newObj) {
        Class cls = newObj->getIsa();
        if (cls != previouslyInitializedClass  &&  
            !((objc_class *)cls)->isInitialized()) 
        {
            SideTable::unlockTwo<HaveOld, HaveNew>(oldTable, newTable);
            _class_initialize(_class_getNonMetaClass(cls, (id)newObj));

            // If this class is finished with +initialize then we're good.
            // If this class is still running +initialize on this thread 
            // (i.e. +initialize called storeWeak on an instance of itself)
            // then we may proceed but it will appear initializing and 
            // not yet initialized to the check above.
            // Instead set previouslyInitializedClass to recognize it on retry.
            previouslyInitializedClass = cls;

            goto retry;
        }
    }

    // Clean up old value, if any.
    if (HaveOld) {
        weak_unregister_no_lock(&oldTable->weak_table, oldObj, location);
    }

    // Assign new value, if any.
    if (HaveNew) {
        newObj = (objc_object *)weak_register_no_lock(&newTable->weak_table, 
                                                      (id)newObj, location, 
                                                      CrashIfDeallocating);
        // weak_register_no_lock returns nil if weak store should be rejected

        // Set is-weakly-referenced bit in refcount table.
        if (newObj  &&  !newObj->isTaggedPointer()) {
            newObj->setWeaklyReferenced_nolock();
        }

        // Do not set *location anywhere else. That would introduce a race.
        *location = (id)newObj;
    }
    else {
        // No new value. The storage is not changed.
    }

    SideTable::unlockTwo<HaveOld, HaveNew>(oldTable, newTable);

    return (id)newObj;
}

SideTable是存储了对象的引用信息，结构如下：

struct SideTable {
    spinlock_t slock;
    RefcountMap refcnts;
    weak_table_t weak_table;
}

其中weak_table定义如下：

struct weak_table_t {
    weak_entry_t *weak_entries;
    size_t    num_entries;
    uintptr_t mask;
    uintptr_t max_hash_displacement;
};

weak_entries是一个散列表，以对象的地址值为key存储weak_entry_t对象。

接下来首先判断weak指针有没有指向旧的对象：

    if (HaveOld) {
        oldObj = *location;
        oldTable = &SideTables()[oldObj];
    } else {
        oldTable = nil;
    }

如果有，就取出来，然后将该对象从旧的weak表中删除：

    // Clean up old value, if any.
    if (HaveOld) {
        weak_unregister_no_lock(&oldTable->weak_table, oldObj, location);
    }

然后再将weak指针指向新的对象，存入weak表中。
如果weak指针指向的是一个新的对象，那么直接存入对象的weak表中：

    // Assign new value, if any.
    if (HaveNew) {
        newObj = (objc_object *)weak_register_no_lock(&newTable->weak_table,                                               (id)newObj, location, 
                                                      CrashIfDeallocating);
        // weak_register_no_lock returns nil if weak store should be rejected

        // Set is-weakly-referenced bit in refcount table.
        if (newObj  &&  !newObj->isTaggedPointer()) {
            newObj->setWeaklyReferenced_nolock();
        }

        // Do not set *location anywhere else. That would introduce a race.
        *location = (id)newObj;
    }
    else {
        // No new value. The storage is not changed.
    }

其中，weak_register_no_lock函数以被指向的对象的地址为key，将weak指针存入weak表。再看weak_register_no_lock函数的实现：

**整理后关键逻辑如下：**
    // now remember it and where it is being stored
    weak_entry_t *entry;
    if ((entry = weak_entry_for_referent(weak_table, referent))) {
        append_referrer(entry, referrer);
    } 
    else {
        weak_entry_t new_entry;
        new_entry.referent = referent;
        new_entry.out_of_line = 0;
        new_entry.inline_referrers[0] = referrer;
        for (size_t i = 1; i < WEAK_INLINE_COUNT; i++) {
            new_entry.inline_referrers[i] = nil;
        }

        weak_grow_maybe(weak_table);
        weak_entry_insert(weak_table, &new_entry);
    }

其中weak_entry_t定义如下：

#define WEAK_INLINE_COUNT 4
struct weak_entry_t {
    DisguisedPtr<objc_object> referent;
    union {
        struct {
            weak_referrer_t *referrers;
            uintptr_t        out_of_line : 1;
            uintptr_t        num_refs : PTR_MINUS_1;
            uintptr_t        mask;
            uintptr_t        max_hash_displacement;
        };
        struct {
            // out_of_line=0 is LSB of one of these (don't care which)
            weak_referrer_t  inline_referrers[WEAK_INLINE_COUNT];
        };
    };
};

weak_entry_t对象里边存储着被弱引用的对象，里面weak_referrer_t变量也是一个hash表，存储着该对象的若引用指针。如果弱引用数目小于4个，那么weak_entry_t就通过数组来存储weak指针，如果超过4个，那么就通过hash表来存储weak指针。
回到weak_register_no_lock函数，如果发现被引用的对象有弱引用，那么直接取出weak_entry_t对象，然后将新的weak指针存到weak_referrer_t指向的数组或者hash表中，如果存的是hash表，那么key值是weak指针的地址；如果发现对象之前没有弱引用，那么就新建立一个weak_entry_t对象，然后将weak指针存入到其中。

weak指针的销毁

再来看weak是在什么时候销毁并被置为空的。找到dealloc函数的实现，其中dealloc主要调用了objc_destructInstance函数：

void *objc_destructInstance(id obj) 
{
    if (obj) {
        Class isa = obj->getIsa();

        if (isa->hasCxxDtor()) {
            object_cxxDestruct(obj);
        }

        if (isa->instancesHaveAssociatedObjects()) {
            _object_remove_assocations(obj);
        }

        if (!UseGC) objc_clear_deallocating(obj);
    }

    return obj;
}

objc_destructInstance函数主要做了三件事：
1. 寻找一个名为 ._cxx_destruct 的函数，这一步主要是由编译器插入代码实现，这里销毁了对象的实例变量，并且调用了父类的dealloc（ARC环境下）。
2. 调用_object_remove_assocations函数清除对象的所有关联对象。
3. 调用objc_clear_deallocating函数清除所有的weak指针被将其置为nil。

objc_clear_deallocating函数里主要调用了sidetable_clearDeallocating函数来清除弱引用，里边通过weak_clear_no_lock函数来实现：

void 
weak_clear_no_lock(weak_table_t *weak_table, id referent_id) 
{
    objc_object *referent = (objc_object *)referent_id;

    weak_entry_t *entry = weak_entry_for_referent(weak_table, referent);
    if (entry == nil) {
        /// XXX shouldn't happen, but does with mismatched CF/objc
        //printf("XXX no entry for clear deallocating %p\n", referent);
        return;
    }

    // zero out references
    weak_referrer_t *referrers;
    size_t count;

    if (entry->out_of_line) {
        referrers = entry->referrers;
        count = TABLE_SIZE(entry);
    } 
    else {
        referrers = entry->inline_referrers;
        count = WEAK_INLINE_COUNT;
    }

    for (size_t i = 0; i < count; ++i) {
        objc_object **referrer = referrers[i];
        if (referrer) {
            if (*referrer == referent) {
                *referrer = nil;
            }
            else if (*referrer) {
                _objc_inform("__weak variable at %p holds %p instead of %p. "
                             "This is probably incorrect use of "
                             "objc_storeWeak() and objc_loadWeak(). "
                             "Break on objc_weak_error to debug.\n", 
                             referrer, (void*)*referrer, (void*)referent);
                objc_weak_error();
            }
        }
    }

    weak_entry_remove(weak_table, entry);
}

我们可以清楚的看到，这里清除了对象所有的weak指针并将其置为nil，同时从weak表中清除了对应的weak_entry_t对象。

weak和aoturelease

即使将weak指针变量注册到aotureleasepool中，该对象一样有效，这是因为在weak指针变量注册到aotureleasepool中时，系统调用了objc_loadWeakRetained函数，将weak指针变量的引用计数加1，然后又对其发送了objc_autorelease消息，以保证aotureleasepool声明周期中其值可用。