转载：

其实上面回答的方法调用也都是基于以前对runtime的理解，和自己试验出来的结果，但是，回答完这个问题之后，抱着探究到底的精神（其实是这几天产品没提什么需求，有点儿闲），问了自己一个问题：你怎么知道是底层调用的是这几个方法？？。。。又是一番查资料，验证问题。。。下面正式开始分析：

• 首先新建一个Person类，代码如下：

Person.h

#import <Foundation/Foundation.h>

@interface Person : NSObject

- (void)eat;

@end

Person.m

#import "Person.h"

@implementation Person

- (void)eat{
    NSLog(@"Person eat=======");
}

@end

很简单的一个类

在main函数里面调用eat方法：

Person *p = [[Person alloc] init];
        
[p eat];

将main.m代码转换成c++代码：

 xcrun -sdk iphoneos clang -arch arm64 -rewrite-objc main.m -o main.cpp

在main.cpp文件当中查看底层实现：

int main(int argc, const char * argv[]) {
    /* @autoreleasepool */ { __AtAutoreleasePool __autoreleasepool; 

        Person *p = ((Person *(*)(id, SEL))(void *)objc_msgSend)((id)((Person *(*)(id, SEL))(void *)objc_msgSend)((id)objc_getClass("Person"), sel_registerName("alloc")), sel_registerName("init"));

        ((void (*)(id, SEL))(void *)objc_msgSend)((id)p, sel_registerName("eat"));

    }
    return 0;
}

通过这些代码我们发现，OC中方法调用本质上就是给对象发消息，上面给对象发消息的代码可以简写成：

objc_msgSend(p, @selector(eat));

上面方法调用的意思就是：给p对象发送名为eat的消息，所以OC中给对象发消息本质上都是调用objc_msgSend方法，接着看下苹果官方文档对这个方法的定义（我是用的Dash查看的）：

• self ：指向接收消息的类实例的指针。简单来说就是消息的接收者。
• op：处理消息的方法选择器，也就是我们常见的@selector()。
• ...：包含方法参数的可变参数列表，

翻译如下：

当遇到方法调用时，编译器生成对其中一个函数的调用。当向superclass发消息的时候调用的是objc_msgSendSuper，向其他对象发消息的时候调用objc_msgSend，方法返回值是一个结构体的时候调用的是objc_msgSendSuper_stret和objc_msgSend_stret。

接下来我们再看下objc_msgSend的底层实现，objc 源码，发现底层是用汇编代码实现的（表示很蛋疼）：

ENTRY _objc_msgSend
    UNWIND _objc_msgSend, NoFrame
    MESSENGER_START

    NilTest NORMAL

    GetIsaFast NORMAL       // r10 = self->isa  
    CacheLookup NORMAL, CALL    // calls IMP on success

    NilTestReturnZero NORMAL

    GetIsaSupport NORMAL

// cache miss: go search the method lists
LCacheMiss:
    // isa still in r10
    MESSENGER_END_SLOW
    jmp __objc_msgSend_uncached

    END_ENTRY _objc_msgSend

由于本人汇编就懂几个简单的指令，所以就做简单分析：

首先，GetIsaFast获取对象的isa指针，接着通过CacheLookup从缓存查找方法的实现，会调用cache_getImp(Class cls, SEL sel)，如果缓存中没有查到也就是cache miss，会跳到__objc_msgSend_uncached方法：

STATIC_ENTRY __objc_msgSend_uncached
    UNWIND __objc_msgSend_uncached, FrameWithNoSaves
    
    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band r10 is the searched class

    // r10 is already the class to search
    MethodTableLookup NORMAL    // r11 = IMP
    jmp *%r11           // goto *imp

    END_ENTRY __objc_msgSend_uncached

在这个方法里面又会调用MethodTableLookup查找方法列表：

.macro MethodTableLookup

    push    %rbp
    mov %rsp, %rbp
    
    sub $$0x80+8, %rsp      // +8 for alignment

    movdqa  %xmm0, -0x80(%rbp)
    push    %rax            // might be xmm parameter count
    movdqa  %xmm1, -0x70(%rbp)
    push    %a1
    movdqa  %xmm2, -0x60(%rbp)
    push    %a2
    movdqa  %xmm3, -0x50(%rbp)
    push    %a3
    movdqa  %xmm4, -0x40(%rbp)
    push    %a4
    movdqa  %xmm5, -0x30(%rbp)
    push    %a5
    movdqa  %xmm6, -0x20(%rbp)
    push    %a6
    movdqa  %xmm7, -0x10(%rbp)

    // _class_lookupMethodAndLoadCache3(receiver, selector, class)
   ...
   ...
   省略

在MethodTableLookup里面又调用了_class_lookupMethodAndLoadCache3方法：

/***********************************************************************
* _class_lookupMethodAndLoadCache.
* Method lookup for dispatchers ONLY. OTHER CODE SHOULD USE lookUpImp().
* This lookup avoids optimistic cache scan because the dispatcher 
* already tried that.
**********************************************************************/
IMP _class_lookupMethodAndLoadCache3(id obj, SEL sel, Class cls)
{
    return lookUpImpOrForward(cls, sel, obj, 
                              YES/*initialize*/, NO/*cache*/, YES/*resolver*/);
}

接下来看一下lookUpImpOrForward的实现

IMP lookUpImpOrForward(Class cls, SEL sel, id inst, 
                       bool initialize, bool cache, bool resolver)
{
    IMP imp = nil;
    bool triedResolver = NO;

    runtimeLock.assertUnlocked();

    // Optimistic cache lookup
    if (cache) {
        imp = cache_getImp(cls, sel);
        if (imp) return imp;
    }

    // runtimeLock is held during isRealized and isInitialized checking
    // to prevent races against concurrent realization.

    // runtimeLock is held during method search to make
    // method-lookup + cache-fill atomic with respect to method addition.
    // Otherwise, a category could be added but ignored indefinitely because
    // the cache was re-filled with the old value after the cache flush on
    // behalf of the category.

    runtimeLock.read();

    if (!cls->isRealized()) {
        // Drop the read-lock and acquire the write-lock.
        // realizeClass() checks isRealized() again to prevent
        // a race while the lock is down.
        runtimeLock.unlockRead();
        runtimeLock.write();

        realizeClass(cls);

        runtimeLock.unlockWrite();
        runtimeLock.read();
    }

    if (initialize  &&  !cls->isInitialized()) {
        runtimeLock.unlockRead();
        _class_initialize (_class_getNonMetaClass(cls, inst));
        runtimeLock.read();
        // If sel == initialize, _class_initialize will send +initialize and 
        // then the messenger will send +initialize again after this 
        // procedure finishes. Of course, if this is not being called 
        // from the messenger then it won't happen. 2778172
    }

    
 retry:    
    runtimeLock.assertReading();

    // Try this class's cache.

    imp = cache_getImp(cls, sel);
    if (imp) goto done;

    // Try this class's method lists.
    {
        Method meth = getMethodNoSuper_nolock(cls, sel);
        if (meth) {
            log_and_fill_cache(cls, meth->imp, sel, inst, cls);
            imp = meth->imp;
            goto done;
        }
    }

    // Try superclass caches and method lists.
    {
        unsigned attempts = unreasonableClassCount();
        for (Class curClass = cls->superclass;
             curClass != nil;
             curClass = curClass->superclass)
        {
            // Halt if there is a cycle in the superclass chain.
            if (--attempts == 0) {
                _objc_fatal("Memory corruption in class list.");
            }
            
            // Superclass cache.
            imp = cache_getImp(curClass, sel);
            if (imp) {
                if (imp != (IMP)_objc_msgForward_impcache) {
                    // Found the method in a superclass. Cache it in this class.
                    log_and_fill_cache(cls, imp, sel, inst, curClass);
                    goto done;
                }
                else {
                    // Found a forward:: entry in a superclass.
                    // Stop searching, but don't cache yet; call method 
                    // resolver for this class first.
                    break;
                }
            }
            
            // Superclass method list.
            Method meth = getMethodNoSuper_nolock(curClass, sel);
            if (meth) {
                log_and_fill_cache(cls, meth->imp, sel, inst, curClass);
                imp = meth->imp;
                goto done;
            }
        }
    }

    // No implementation found. Try method resolver once.

    if (resolver  &&  !triedResolver) {
        runtimeLock.unlockRead();
        _class_resolveMethod(cls, sel, inst);
        runtimeLock.read();
        // Don't cache the result; we don't hold the lock so it may have 
        // changed already. Re-do the search from scratch instead.
        triedResolver = YES;
        goto retry;
    }

    // No implementation found, and method resolver didn't help. 
    // Use forwarding.

    imp = (IMP)_objc_msgForward_impcache;
    cache_fill(cls, sel, imp, inst);

 done:
    runtimeLock.unlockRead();

    return imp;
}

我们重点看// No implementation found. Try method resolver once.下面的代码，如果依然没有找到方法的实现，会调用_class_resolveMethod方法：

void _class_resolveMethod(Class cls, SEL sel, id inst)
{
    if (! cls->isMetaClass()) {
        // try [cls resolveInstanceMethod:sel]
        _class_resolveInstanceMethod(cls, sel, inst);
    } 
    else {
        // try [nonMetaClass resolveClassMethod:sel]
        // and [cls resolveInstanceMethod:sel]
        _class_resolveClassMethod(cls, sel, inst);
        if (!lookUpImpOrNil(cls, sel, inst, 
                            NO/*initialize*/, YES/*cache*/, NO/*resolver*/)) 
        {
            _class_resolveInstanceMethod(cls, sel, inst);
        }
    }
}

在这个方法里面，我们可以清楚地看到，首先会判断该对象是否是元类对象，如果不是，会调用_class_resolveInstanceMethod方法，否则会调用_class_resolveClassMethod方法。如果还没有找到对应的IMP方法实现：

// No implementation found, and method resolver didn't help. 
// Use forwarding.

接下来就会用到消息转发，调用这个方法_objc_msgForward_impcache

/********************************************************************
*
* id _objc_msgForward(id self, SEL _cmd,...);
*
* _objc_msgForward and _objc_msgForward_stret are the externally-callable
*   functions returned by things like method_getImplementation().
* _objc_msgForward_impcache is the function pointer actually stored in
*   method caches.
*
********************************************************************/

    STATIC_ENTRY __objc_msgForward_impcache
    // Method cache version

    // THIS IS NOT A CALLABLE C FUNCTION
    // Out-of-band condition register is NE for stret, EQ otherwise.

    MESSENGER_START
    nop
    MESSENGER_END_SLOW
    
    jne __objc_msgForward_stret
    jmp __objc_msgForward

    END_ENTRY __objc_msgForward_impcache
    
    
    ENTRY __objc_msgForward
    // Non-stret version

    movq    __objc_forward_handler(%rip), %r11
    jmp *%r11

    END_ENTRY __objc_msgForward


    ENTRY __objc_msgForward_stret
    // Struct-return version

    movq    __objc_forward_stret_handler(%rip), %r11
    jmp *%r11

    END_ENTRY __objc_msgForward_stret
    ...
   ...
   省略

从description可以看到__objc_msgForward_impcache实际上是一个存储在方法缓存当中的函数指针，当某种类型的对象处理消息的过程中，无论怎样都找不到对应的IMP实现时，会将它作为sel对应的imp记入缓存。所以，从严格意义上来讲_class_resolveInstanceMethod和_class_resolveClassMethod并不是由__objc_msgForward_impcache触发的，并不能算作消息转发的后续步骤，消息转发后，该对象如果再次遇到同名消息是，会直接从缓存中找到对应的IMP,即_objc_msgForward_impcache，此时我们需要重写- (id)forwardingTargetForSelector:(SEL)aSelector方法，重定向到别的类当中找到方法的实现。

imp = (IMP)_objc_msgForward_impcache;
cache_fill(cls, sel, imp, inst);

官方文档截图：

主要看下官方文档里面的Discussion：

官方文档写的非常清楚：当你只想将消息重定向到另一个类时，用这个方法非常有用，因为它比常规的转发快一个数量级,他转发的目标是捕获NSInvocation。也有人将这种方式称为Fast Forwarding，因为这一步不会创建NSInvocation对象。

今天先写这么多，还没完呢，上网查了好多资料，好多网上资料苹果的源代码都是老的，跟最新代码不太一样，也费了我很多时间，下一篇文章将会介绍如何通过regular forwarding也有人叫Normal Forwarding，动态添加方法实现。。。。

---

References:

• https://lpd-ios.github.io/2017/12/19/ObjC-Message/