快捷搜索:

赋值的时候引用计数不增加

在使用delegate时候, 尤其是自定义delegate的时候, 都会自觉不自觉的加上weak属性, 系统的delegate也是这样写的, @property(nullable,nonatomic,weak) id<UIScrollViewDelegate>, 当然, 这样写的一个主要原因是为了防止循环引用, 但是在iOS8.x的系统上delegate并不是weak属性, 而是__unsafe_unretained.

先来说下__unsafe_unretained和weak的区别

先上段代码

 __unsafe_unretained id obj0 = nil; { id obj1 = [[NSObject alloc] init]; obj0 = obj1; NSLog(@"obj1: %@", obj1); } NSLog(@"obj0: %@", obj0);

 __weak id obj0 = nil; { id obj1 = [[NSObject alloc] init]; obj0 = obj1; NSLog(@"obj1: %@", obj1); } NSLog(@"obj0: %@", obj0);

__unsafe_unretained从名字上就可以看出来, 不安全, 赋值的时候引用计数不增加, 也就是obj0被赋值为obj1的地址, 但是出了obj1的作用域, obj1被释放了, 而obj0并不释放, 而是依旧持有, 这样就会造成不安全!

而使用weak的时候, 出了obj1的作用域, obj1被释放, obj0引用计数为0被释放, 随即会把obj0置为nil.

崩溃堆栈&&场景重现

0 libobjc.A.dylib!objc_msgSend   0x101 UIKit!-[UIScrollView(UIScrollViewInternal) _delegateScrollViewAnimationEnded]   0x402 UIKit!-[UIScrollView(UIScrollViewInternal) _scrollViewAnimationEnded:finished:]   0xcc3 UIKit!-[UIAnimator stopAnimation:]   0x1f44 UIKit!-[UIAnimator _advanceAnimationsOfType:withTimestamp:]   0x14c5 QuartzCore!CA::Display::DisplayLinkItem::dispatch()   0x1c6 QuartzCore!CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long)   0x1407 IOKit!IODispatchCalloutFromCFMessage   0x1748 CoreFoundation!__CFMachPortPerform   0xb09 CoreFoundation!__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__   0x34

大体上意思就是, 在scrollView滑动结束的时候, 会继续使用delegate, 而此时的delegate已经释放了, 在iOS9 系统上, 是没有问题的, 因为delegate是weak的, 释放了立即置空, 不存在安全隐患, 而iOS9-, 则不行, 因为是__unsafe_unretained的, 所以, 释放了, 但不置空, 这就造成了野指针崩溃.

重现代码

#import "ScrollViewController.h"@interface ScrollViewController ()<UIScrollViewDelegate>@property (nonatomic, weak) UIScrollView *scrollView;@property (nonatomic, weak) UIView *leftView;@property (nonatomic, weak) UIView *centerView;@property (nonatomic, weak) UIView *rightView;@property (nonatomic, assign) NSInteger currentPage;@end@implementation ScrollViewController- dealloc { NSLog(@"dealloc");}- viewDidLoad { [super viewDidLoad]; UIScrollView *scrollView = [[UIScrollView alloc] init]; scrollView.delegate = self; [self.view addSubview:scrollView]; UIView *leftView = [[UIView alloc] init]; leftView.backgroundColor = UIColor.redColor; [scrollView addSubview:leftView]; UIView *centerView = [[UIView alloc] init]; centerView.backgroundColor = UIColor.blueColor; [scrollView addSubview:centerView]; UIView *rightView = [[UIView alloc] init]; rightView.backgroundColor = UIColor.greenColor; [scrollView addSubview:rightView]; self.scrollView = scrollView; self.leftView = leftView; self.centerView = centerView; self.rightView = rightView; self.currentPage = 1;}- viewDidLayoutSubviews { CGFloat W = self.view.frame.size.width; CGFloat H = self.view.frame.size.height; self.scrollView.frame = self.view.bounds; self.scrollView.contentSize = CGSizeMake; self.leftView.frame = CGRectMake(0, 0, W, H); self.centerView.frame = CGRectMake(W, 0, W, H); self.rightView.frame = CGRectMake(2*W, 0, W, H); [super viewDidLayoutSubviews];}#pragma mark - UIScrollViewDelegate- scrollViewWillBeginDragging:(UIScrollView *)scrollView { NSLog(@"scrollViewWillBeginDragging"); [self.navigationController popViewControllerAnimated:NO];}- scrollViewWillEndDragging:(UIScrollView *)scrollView withVelocity:velocity targetContentOffset:(inout CGPoint *)targetContentOffset { NSLog(@"scrollViewWillEndDragging"); float width = scrollView.bounds.size.width; CGFloat scrolledOffset = targetContentOffset->x - width * self.currentPage; if (scrolledOffset > 0 && scrolledOffset >= width / 2) { self.currentPage = self.currentPage   1; [self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES]; } else if (scrolledOffset < 0 && fabs(scrolledOffset) >= width / 2) { self.currentPage = self.currentPage - 1; [self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES]; } }@end

好的, 在scrollView开始滑动的时候就释放调当前的ViewController, 这时候由于系统持有scrollView在做动画, 并没有立即释放, 当动画结束后, 系统释放scrollView, 然后来到dealloc, self被释放, 但是问题的关键是这句代码

[self.scrollView setContentOffset:CGPointMake(self.scrollView.bounds.size.width * self.currentPage, 0) animated:YES];

这里scrollview会在整个做动画scrollViewWillBeginDragging, scrollViewWillEndDragging, scrollViewDidEndDragging等, 被系统强引用, 所以这里都是没问题的, 不会崩溃, 但是在里面再去做animated动画, 就很危险了, 因为这时候self即将被释放, 到时候, delegate将变成野指针, 所以当animated动画结束的时候会造成崩溃(可能animated结束的时候系统又用delegate去做了什么事情).因为控制台打出的日志显示

[ScrollViewController respondsToSelector:]: message sent to deallocated instance 0x7ff8324d6900

经调查发现0x7ff8324d6900这个地址正是delegate原来的地址.

解决办法

那么这样一来, 我们是不是可以通过把delegate置空来避免崩溃呢'?可以:

_scrollView.delegate = nil;

这也是最简单的解决办法, _scrollView.delegate置空后面拿delegate干事儿就安全了, 还有一个办法, hook dealloc, 通常我们再将scrollView后不会去考虑scrollView.delegate的安全性问题, 因为都会觉得, 随着scrollview的置空delegate也将被置空, 然而并不是!

有关hook这里就不多表了, 懂的自然懂, 不懂也不是一两句话就能说明白的, 直接上代码

  hookUIScrollViewSetDelegate{ [MethodsHooker hookMethedClass:NSClassFromString(@"UIScrollView") hookSEL:@selector(setDelegate:) originalSEL:@selector(originalSetDelegate:) myselfSEL:@selector(myselfSetDelegate:)];}- myselfSetDelegate:(UIViewController *)delegate{ if  { UIScrollView * __weak weak_self = (UIScrollView *)self; [delegate setDeallocCallback:^{ weak_self.delegate = nil; if ([weak_self isKindOfClass:[UITableView class]]) { ((UITableView *)weak_self).editing = NO; ((UITableView *)weak_self).dataSource = nil; ((UITableView *)weak_self).delegate = nil; } else if ([weak_self isKindOfClass:[UICollectionView class]]) { ((UICollectionView *)weak_self).dataSource = nil; ((UICollectionView *)weak_self).delegate = nil; } }]; } [self originalSetDelegate:delegate];}- originalSetDelegate:delegate{ }

.h#import <UIKit/UIKit.h>typedef void (^DeallocCallback)();@interface UIViewController @property (nonatomic, copy) DeallocCallback deallocCallback;@end.m@implementation UIViewController   load{ static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ [self hookSelectorName:@"dealloc" withSelector:@selector(myUIViewControllerDealloc)]; });}- myUIViewControllerDealloc{ DeallocCallback callback = [self deallocCallback]; if  { callback(); } [self myUIViewControllerDealloc];}- setDeallocCallback:(DeallocCallback)callback{ objc_setAssociatedObject(self, _cmd, callback, OBJC_ASSOCIATION_COPY_NONATOMIC);}- (DeallocCallback)deallocCallback{ return objc_getAssociatedObject(self, @selector(setDeallocCallback:));}@end

这里在给scrollView设置delegate的时候, 同时为delegate的dealloc方法添加block. 为了执行到自己写的block, 我们还要hook dealloc, 这样执行dealloc会先执行我们的block中的代码, 这里会将delegate置空, 从而完成任务.

本文由澳门新葡萄京8455官网发布于澳门新葡萄京8455官网,转载请注明出处:赋值的时候引用计数不增加

您可能还会对下面的文章感兴趣: