Runtime之常见崩溃问题

一、iOS常见的崩溃类型

• unrecognized selector sent to instance 调用了不存在的方法
• NSArray、NSMutableArray 数组越界、插入空值等
• NSDictionary、NSMutableDictionary 初始化有nil值、key为nil等

二、崩溃类型及解决方案

unrecognized selector sent to instance
产生的原因
找不到该对象的方法，系统发出异常

解决方案

对象调用方法经过三个阶段
1.消息发送：查询cache和方法列表，找到了直接调用，找不到方法会进入下个阶段
2.动态解析: 调用resolveInstanceMethod或resolveClassMethod方法里面可以有一次动态添加方法的机会
3.消息转发：1.首先会判断是否有其他对象可以处理方法forwardingTargetForSelector返回一个新的对象2.如果没有新的对象进行处理，会调用methodSignatureForSelector方法返回方法签名，然后调用forwardInvocation

#import "NSObject+Extension.h"
#import <objc/runtime.h>

@implementation NSObject (Extension)

+(void)load{
    
    Method method1 = class_getInstanceMethod([self class], @selector(methodSignatureForSelector:));
    Method method2 = class_getInstanceMethod(self, @selector(pf_methodSignatureForSelector:));
    method_exchangeImplementations(method1, method2);
    
    Method method3 = class_getInstanceMethod([self class], @selector(forwardInvocation:));
    Method method4 = class_getInstanceMethod(self, @selector(pf_forwardInvocation:));
    method_exchangeImplementations(method3, method4);
    
}

// 返回处理对象
//-(id)forwardingTargetForSelector:(SEL)aSelector{}

-(NSMethodSignature *)pf_methodSignatureForSelector:(SEL)aSelector{
    
    // 获取方法签名
//    NSMethodSignature *signature = [self pf_methodSignatureForSelector:aSelector];
    
    NSMethodSignature *signature = [NSObject instanceMethodSignatureForSelector:@selector(proxyMethod)];
    return signature;
}

-(void)pf_forwardInvocation:(NSInvocation *)anInvocation{
    
    //可以做些别的什么事情
   
}

-(void)proxyMethod{
    
}

@end

NSArray、NSMutableArray 数组越界、插入空值等

NSArray相关

   NSArray *array = @[@"12",@"31"];
    // 1.1 读取下标越界
    // 通过下标访问元素，会调用objectAtIndexedSubscript方法
    NSString *value = array[3];//数组越界，导致崩溃
    // 1.2通过方法objectAtIndex访问元素
    [array objectAtIndex:3]; // 数组越界、导致崩溃

解决方法

注意NSArray 是一个类簇，它真正的类型是__NSArrayI
为NSArray写一个分类，利用runtime 替换系统的objectAtIndexedSubscript方法，判断是否越界

+(void)load{
    
    Class cls = NSClassFromString(@"__NSArrayI");
    Method method1 = class_getInstanceMethod(cls, @selector(objectAtIndexedSubscript:));
    Method method2 = class_getInstanceMethod(self, @selector(pf_objectAtIndexedSubscript:));
    method_exchangeImplementations(method1, method2);

    Method method3 = class_getInstanceMethod(cls, @selector(objectAtIndex:));
    Method method4 = class_getInstanceMethod(self, @selector(pf_objectAtIndex:));
    method_exchangeImplementations(method3, method4);
}

-(id)pf_objectAtIndexedSubscript:(NSUInteger)idx{
    if (idx > self.count - 1) {
        NSAssert(NO, @"数组越界了");
        return nil;
    }else{
        return [self pf_objectAtIndexedSubscript:idx];
    }
}

-(id)pf_objectAtIndex:(NSUInteger)index{
    if (index > self.count - 1) {
        NSAssert(NO, @"数组越界了");
        return nil;
    }else{
        return [self pf_objectAtIndex:index];
    }
}

NSMutableArray相关

注意NSMutableArray 真正的类型是__NSArrayM

   NSArray *array = @[@"12",@"31"];
    // 1.1 读取下标越界
    // 通过下标访问元素，会调用objectAtIndexedSubscript方法
    NSString *value = array[3];//数组越界，导致崩溃
    // 1.2通过方法objectAtIndex访问元素
    [array objectAtIndex:3]; // 数组越界、导致崩溃
    
    NSMutableArray *mArray = [NSMutableArray arrayWithArray:array];
    // 2.1 读取下标越界
    NSString *str = mArray[3];// 数组越界、导致崩溃
    // 2.2 通过下标进行赋值
    NSString *s;
    mArray[4] = s; // 1.数组越界 2.空值导致崩溃
    // 2.3 插入数据 会调用insertObject:atIndex:
    [mArray addObject:nil]; // 插入nil值导致崩溃
    // 2.4 移除元素越界 会调用removeObjectsInRange方法
    [mArray removeObjectAtIndex:4];

解决方案

#import "NSMutableArray+Extension.h"
#import <objc/runtime.h>

@implementation NSMutableArray (Extension)

+(void)load{
    
    Class cls = NSClassFromString(@"__NSArrayM");
    // mArray[4] 会调用方法objectAtIndexedSubscript 取值
    Method method1 = class_getInstanceMethod(cls, @selector(objectAtIndexedSubscript:));
    Method method2 = class_getInstanceMethod(self, @selector(pf_objectAtIndexedSubscript:));
    method_exchangeImplementations(method1, method2);
    
    // mArray[4] 会调用setObject:atIndexedSubscript: 赋值
    Method method3 = class_getInstanceMethod(cls, @selector(setObject:atIndexedSubscript:));
    Method method4 = class_getInstanceMethod(self, @selector(pf_setObject:atIndexedSubscript:));
    method_exchangeImplementations(method3, method4);
    
//    [marray addobject] 会调用insertObject atIndex
    Method method5 = class_getInstanceMethod(cls, @selector(insertObject:atIndex:));
    Method method6 = class_getInstanceMethod(self, @selector(pf_insertObject:atIndex:));
    method_exchangeImplementations(method5, method6);
    
    Method method7 = class_getInstanceMethod(cls, @selector(removeObjectAtIndex:));
    Method method8 = class_getInstanceMethod(self, @selector(pf_removeObjectAtIndex:));
    method_exchangeImplementations(method7, method8);
    
}

// 防止数组越界导致崩溃
-(id)pf_objectAtIndexedSubscript:(NSUInteger)idx{
    if (idx > self.count - 1) {
//        NSAssert(NO, @"index %zd 越界",idx);
        return nil;
    }
    return [self pf_objectAtIndexedSubscript:idx];
}

-(void)pf_setObject:(id)obj atIndexedSubscript:(NSUInteger)idx{
    // 不能越界
    if (idx > self.count - 1) {
//        NSAssert(NO, @"index %zd 越界",idx);
        return;
    }
    // 不能插入空值
    if (obj == nil) {
//        NSAssert(NO, @"不能插入nil值");
        return;
    }
    
    [self pf_setObject:obj atIndexedSubscript:idx];
}


-(void)pf_insertObject:(id)anObject atIndex:(NSUInteger)index{
    if (!anObject) {
//        NSAssert(NO, @"不能插入nil值");
        return;
    }
    [self pf_insertObject:anObject atIndex:index];
    
}

-(void)pf_removeObjectAtIndex:(NSUInteger)index{
    if (index > self.count - 1) {
        return;
    }
    [self pf_removeObjectAtIndex:index];
}
@end

NSDictionary 相关

NSDictionary 也是一个类簇，它有多种类型

有时候，我们创建一个NSDictionary对象的时候，会直接使用@{}方法创建，而当有一个value为nil 的时候，也会导致崩溃的现象

NSString *str;
// 这种创建方式会调用__NSPlaceholderDictionary 的initWithObjects:forKeys:count:方法
    NSDictionary *dict = @{
        @"a":@"A",
        @"b":str
    };
// 如果key为nil 获取值也会导致崩溃，调用的是__NSDictionaryI的objectForKeyedSubscript方法
NSString *value = dict[str]

解决方案 替换此方法

//__NSPlaceholderDictionary
    Class cls = NSClassFromString(@"__NSPlaceholderDictionary");
    Method method1 = class_getInstanceMethod(cls, @selector(initWithObjects:forKeys:count:));
    Method method2 = class_getInstanceMethod(self, @selector(pf_initWithObjects:forKeys:count:));
    method_exchangeImplementations(method1, method2);

//__NSDictionaryI
    Class cls2 = NSClassFromString(@"__NSDictionaryI");
    Method method3 = class_getInstanceMethod(cls2, @selector(objectForKeyedSubscript:));
    Method method4 = class_getInstanceMethod(self, @selector(pf_objectForKeyedSubscript:));
    method_exchangeImplementations(method3, method4);

// 初始化的时候，空值导致崩溃
-(instancetype)pf_initWithObjects:(id  _Nonnull const [])objects forKeys:(id<NSCopying>  _Nonnull const [])keys count:(NSUInteger)cnt{
    
    // 注意 objects 和keys 都是c语言的，所以要创建c语言的数组
    NSUInteger index = 0;// 数组下标，用于数据存入正确的位置
    id objectsArray[cnt]; // values
    id<NSCopying> keysArray[cnt];//keys
    
    for (int i = 0; i < cnt; i++) {
        // 如果值和key 都不为nil
        if (objects[i] != nil && keys[i] != nil) {
            objectsArray[index] = objects[i];
            keysArray[index] = keys[i];
            index++;
        }else{
            NSString *str = [NSString stringWithFormat:@"%@不能为空",keys[i]];
            NSAssert(NO, str);
        }
    }
    
    return [self pf_initWithObjects:objectsArray forKeys:keysArray count:index];
}

-(id)pf_objectForKeyedSubscript:(id)key{
    if (!key) {
        NSAssert(NO, @"key 不能为空");
        return nil;
    }
    
    id obj = [self pf_objectForKeyedSubscript:key];
    
    if ([obj isKindOfClass:[NSNull class]]) {
        return nil;
    }
    
    return [self pf_objectForKeyedSubscript:key];
}

NSMutableDictionary相关

NSMutableDictionary 一般是__NSDictionaryM

 /// 通过类名字符串创建类
    Class cls = NSClassFromString(@"__NSDictionaryM");
    Method method1 = class_getInstanceMethod(cls, @selector(setObject:forKeyedSubscript:));
    Method method2 = class_getInstanceMethod(self, @selector(pf_setObject:forKeyedSubscript:));
    
    method_exchangeImplementations(method1, method2);
    
    Method method3 = class_getInstanceMethod(cls, @selector(setValue:forKey:));
    Method method4 = class_getInstanceMethod(self, @selector(pf_setObject:forKey:));
    method_exchangeImplementations(method3, method4);
    
    Method method5 = class_getInstanceMethod(cls, @selector(objectForKeyedSubscript:));
    Method method6 = class_getInstanceMethod(self, @selector(pf_objectForKeyedSubscript:));
    method_exchangeImplementations(method5, method6);

-(void)pf_setObject:(id)obj forKeyedSubscript:(id<NSCopying>)key{
    if (!key) return;// 如果key为nil 会导致崩溃
    [self pf_setObject:obj forKeyedSubscript:key];
}

//拦截系统的setObject forKey方法
-(void)pf_setObject:(id)anObject forKey:(id<NSCopying>)aKey{
    // 1.当key为nil 的时候，set方法会崩溃
    if (!aKey) return;
    [self pf_setObject:anObject forKey:aKey];
}

-(id)pf_objectForKeyedSubscript:(id)key{
    if (!key) {
        return nil;
    }
    
    id obj = [self pf_objectForKeyedSubscript:key];
    
    if ([obj isKindOfClass:[NSNull class]]) {
        return nil;
    }
    
    return [self pf_objectForKeyedSubscript:key];
}