[crash详解与防护] NSNotification crash
前言：
NSNotificationCenter 较之于 Delegate 可以实现更大的跨度的通信机制，可以为两个无引用关系的两个对象进行通信。NSNotification是iOS中一个调度消息通知的类，采用单例模式设计。因此，注册观察者后，没有在观察者dealloc时及时注销观察者，极有可能通知中心再发送通知时发送给僵尸对象而发生crash。
苹果在iOS9之后专门针对于这种情况做了处理，所以在iOS9之后，即使开发者没有移除observer，Notification crash也不会再产生了。
不过针对于iOS9之前的用户，我们还是有必要做一下NSNotification Crash的防护。
本文从notification的使用情况、crash情况进行讲解，最后提出了两种crash防护的方案：第一种方案是被动防护，就是crash的代码可能已经在代码中了，我们在底层使用swizzle的方法进行了改进；第二种方案是主动防护，就是在写代码之前，我们自己写一套机制，可以有效的防护crash的发生。
一、NSNotification的使用
(1) Notification的观察者类
//.h文件 extern NSString *const CRMPerformanceNewCellCurrentPageShouldChange; //.m文件 NSString *const CRMPerformanceNewCellCurrentPageShouldChange = @"CRMPerformanceNewCellCurrentPageShouldChange"; //addObserver [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(currentPageShouldChange:) name:CRMPerformanceNewCellCurrentPageShouldChange object:nil]; // 执行函数 - (void)currentPageShouldChange:(NSNotification*)aNotification { NSNumber *number = [aNotification object]; self.pageControl.currentPage = [number integerValue]; } - (void)dealloc{ [[NSNotificationCenter defaultCenter] removeObserver:self]; //或者 [[NSNotificationCenter defaultCenter] removeObserver:self name:aName object:anObject]; }
（2）post Notification类
[[NSNotificationCenter defaultCenter] postNotificationName:CRMPerformanceNewCellCurrentPageShouldChange object:@(performanceTabConfigure.tab)］;
二、NSNotification的crash情况
“僵尸对象”（出现僵尸对象会报reason=SIGSEGV）
在退出A页面的时候没有把自身的通知观察者A给注销，导致通知发过来的时候抛给了一个已经释放的对象A，但该对象仍然被通知中心引用，也就是僵尸对象，从而导致程序崩溃 。（也就是说，在一个页面dealloc的时候，一定要把这个页面在通知中心remove掉，否则这个页面很有可能成为僵尸对象）。
但有两种情况需要注意：
（1）单例里不用dealloc方法，应用会统一管理；
（2）类别里不要用dealloc方法removeObserver，在类别对应的原始类里的dealloc方法removeObserver，因为类别会调用原始类的dealloc方法。（如果在类别里新写dealloc方法，原类里的dealloc方法就不执行了）。
三、crash 防护方案
方案一、
利用method swizzling hook NSObject的dealloc函数，在对象真正dealloc之前先调用一下[[NSNotificationCenter defaultCenter] removeObserver:self]即可。
注意到并不是所有的对象都需要做以上的操作，如果一个对象从来没有被NSNotificationCenter 添加为observer的话，在其dealloc之前调用removeObserver完全是多此一举。 所以我们hook了NSNotificationCenter的 addObserver:(id)observer selector:(SEL)aSelector name:(NSString *)aName object:(id)anObject。函数，在其添加observer的时候，对observer动态添加标记flag。这样在observer dealloc的时候，就可以通过flag标记来判断其是否有必要调用removeObserver函数了。
//NSNotificationCenter+CrashGuard.m #import "NSNotificationCenter+CrashGuard.h" #import <objc/runtime.h> #import <UIKit/UIDevice.h> #import "NSObject+NotificationCrashGuard.h" @implementation NSNotificationCenter (CrashGuard) + (void)load{ if([[[UIDevice currentDevice] systemVersion] floatValue] < 9.0) { static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ [[self class] swizzedMethod:sel_getUid("addObserver:selector:name:object:") withMethod:@selector(crashGuard_addObserver:selector:name:object:)]; }); } } +(void)swizzedMethod:(SEL)originalSelector withMethod:(SEL )swizzledSelector { Class class = [self class]; Method originalMethod = class_getInstanceMethod(class, originalSelector); Method swizzledMethod = class_getInstanceMethod(class, swizzledSelector); BOOL didAddMethod = class_addMethod(class, originalSelector, method_getImplementation(swizzledMethod), method_getTypeEncoding(swizzledMethod)); if (didAddMethod) { class_replaceMethod(class, swizzledSelector, method_getImplementation(originalMethod), method_getTypeEncoding(originalMethod)); }else{ method_exchangeImplementations(originalMethod, swizzledMethod); } } -(void)crashGuard_addObserver:(id)observer selector:(SEL)aSelector name:(NSString *)aName object:(id)anObject { NSObject *obj = (NSObject *)observer; obj.notificationCrashGuardTag = notificationObserverTag; [self crashGuard_addObserver:observer selector:aSelector name:aName object:anObject]; } @end // NSObject+NotificationCrashGuard.h #import <Foundation/Foundation.h> extern NSInteger notificationObserverTag; @interface NSObject (NotificationCrashGuard) @property(nonatomic, assign)NSInteger notificationCrashGuardTag; @end // NSObject+NotificationCrashGuard.m #import "NSObject+NotificationCrashGuard.h" #import "NSObject+Swizzle.h" #import <UIKit/UIDevice.h> #import <objc/runtime.h> NSInteger notificationObserverTag = 11118; @implementation NSObject (NotificationCrashGuard) #pragma mark Class Method + (void)load{ if([[[UIDevice currentDevice] systemVersion] floatValue] < 9.0) { static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ [[self class] swizzedMethod:sel_getUid("dealloc") withMethod:@selector(crashGuard_dealloc)]; }); } } #pragma Setter & Getter -(NSInteger)notificationCrashGuardTag { NSNumber *number = objc_getAssociatedObject(self, _cmd); return [number integerValue]; } -(void)setNotificationCrashGuardTag:(NSInteger)notificationCrashGuardTag { NSNumber *number = [NSNumber numberWithInteger:notificationCrashGuardTag]; objc_setAssociatedObject(self, @selector(notificationCrashGuardTag), number, OBJC_ASSOCIATION_RETAIN); } -(void)crashGuard_dealloc { if(self.notificationCrashGuardTag == notificationObserverTag) { [[NSNotificationCenter defaultCenter] removeObserver:self]; } [self crashGuard_dealloc]; }
此方案有以下缺点：
（1）ARC开发下，dealloc作为关键字，编译器是有所限制的。会产生编译错误“ARC forbids use of 'dealloc' in a @selector”。不过我们可以用运行时的方式进行解决。
（2）dealloc作为最为基础，调用次数最为频繁的方法之一。如对此方法进行替换，一是代码的引入对工程影响范围太大，二是执行的代价较大。因为大多数dealloc操作是不需要引入自动注销的，为了少数需求而对所有的执行都做修正是不适当的。
方案二、
基于以上的分析，Method Swizzling可以作为最后的备选方案，但不适合作为首选方案。
另外一个思路是在宿主释放过程中嵌入我们自己的对象，使得宿主释放时顺带将我们的对象一起释放掉，从而获取dealloc的时机点。显然AssociatedObject是我们想要的方案。相比Method Swizzling方案，AssociatedObject方案的对工程的影响范围小，而且只有使用自动注销的对象才会产生代价。
鉴于以上对比，于是采用构建一个释放通知对象，通过AssociatedObject方式连接到宿主对象，在宿主释放时进行回调，完成注销动作。
首先，看一下OC对象销毁时的处理过程，如下objc_destructInstance函数：
/****************** * objc_destructInstance * Destroys an Instance without freeing memory. * Calls C++ destructors. * Calls ARR ivar cleanup. * Remove associative references. * Returns 'obj'. Does nothing if 'obj' is nil. * Be warned that GC DOES NOT CALL THIS. if you edit this, also edit finalize. * CoreFoundation and other clients do call this under GC. ******************/ void *objc_destructInstance(id obj){ if(obj){ bool cxx = obj->hasCxxDtor(); bool assoc = !UseGC && obj->hasAssociatedObject(); bool dealloc = !UseGC; if(cxx) object_cxxDestruct(obj); if(assoc) _object_remove_assocations(obj); if(dealloc) obj->clearDeallocating(); } return obj; }
objc_destructInstance函数中：（1）object_cxxDestruct负责遍历持有的对象，并进行析构销毁。（2）_object_remove_assocations负责销毁关联对象。（3）clearDeallocating清空引用计数表并清除弱引用表, 并负责对weak持有本对象的引用置nil（Weak表是一个hash表，然后里面的key是指向对象的地址，Value是Weak指针的地址的数组）。（附《ARC下dealloc过程》《iOS 底层解析weak的实现原理》）
根据上面的分析，我们对通知添加观察时，可以为观察者动态添加一个associate Object，由这个associate Object进行添加观察操作，在观察者销毁时，associate Object会自动销毁，我们在associate Object的销毁动作中，自动remove掉观察者。
具体实现如下：
（1）我们创建一个NSObject的分类NSObject+AdNotifyEvent。在这个Category中，我们创建了添加观察者的方法，其具体实现由它的associate Object实现。这里的associate Object是类SLVObserverAssociater的对象。
// NSObject+AdNotifyEvent.h #import <Foundation/Foundation.h> #import "SLVObserverAssociater.h" @interface NSObject (AdNotifyEvent) - (void)slvWatchObject:(id)object eventName:(NSString *)event block:(SLVNotifyBlock)block; - (void)slvWatchObject:(id)object eventName:(NSString *)event level:(double)level block:(SLVNotifyBlock)block; @end // NSObject+AdNotifyEvent.m #import "NSObject+AdNotifyEvent.h" #import <objc/runtime.h> #import <objc/message.h> @implementation NSObject (AdNotifyEvent) - (SLVObserverAssociater *)observerAssociater { SLVObserverAssociater *observerAssociater = (SLVObserverAssociater *)objc_getAssociatedObject(self, _cmd); if (observerAssociater == nil) { observerAssociater = [[SLVObserverAssociater alloc] initWithObserverObject:self]; objc_setAssociatedObject(self, _cmd, observerAssociater, OBJC_ASSOCIATION_RETAIN_NONATOMIC); } return observerAssociater; } - (void)slvWatchObject:(id)object eventName:(NSString *)event block:(SLVNotifyBlock)block { [[self observerAssociater] addNotifyEvent:event watchObject:object observerObject:self level:RFEventLevelDefault block:block]; } - (void)slvWatchObject:(id)object eventName:(NSString *)event level:(double)level block:(SLVNotifyBlock)block { [[self observerAssociater] addNotifyEvent:event watchObject:object observerObject:self level:level block:block]; } @end
（2）SLVObserverAssociater的实现
头文件：
// SLVObserverAssociater.h #import <Foundation/Foundation.h> #import "SLVNotifyLevelBlocks.h" @interface SLVObserverAssociater : NSObject @property (nonatomic, weak) id observerObject; // selfRef,观察者 @property (nonatomic, strong) NSMutableDictionary *notifyMap; // key:通知名_watchObject value:RFNotifyEventObject - (id)initWithObserverObject:(id)observerObject; - (void)addNotifyEvent:(NSString *)event watchObject:(id)watchObject observerObject:(id)observerObject level:(double)level block:(SLVNotifyBlock)block; @end @interface SLVNotifyInfo : NSObject @property (nonatomic, weak) SLVObserverAssociater *associater; @property (nonatomic, unsafe_unretained) id watchObject; // 被观察对象 @property (nonatomic, strong) NSString *event; @property (nonatomic, strong) NSMutableArray *eventInfos; @property (nonatomic, weak) id sysObserverObj; // 观察者 - (id)initWithRFEvent:(SLVObserverAssociater *)rfEvent event:(NSString *)event watchObject:(id)watchObject; - (void)add:(SLVNotifyLevelBlocks *)info; - (void)removeLevel:(double)level; - (void)handleRFEventBlockCallback:(NSNotification *)note; @end
实现文件，分三部分：（a）初始化方法（b）添加观察的方法 （c）dealloc时，注销观察的方法
// SLVObserverAssociater.m #import "SLVObserverAssociater.h" #pragma mark - SLVObserverAssociater @implementation SLVObserverAssociater #pragma mark Init - (id)initWithObserverObject:(id)observerObject { self = [super init]; if (self) { _notifyMap = [NSMutableDictionary dictionary]; _observerObject = observerObject; } return self; } #pragma mark Add Notify - (void)addNotifyEvent:(NSString *)event watchObject:(id)watchObject observerObject:(id)observerObject level:(double)level block:(SLVNotifyBlock)block { NSString *key = [NSString stringWithFormat:@"%@_%p", event, watchObject]; SLVNotifyInfo *ne = [self.notifyMap objectForKey:key]; if (ne == nil) { // 添加监听 ne = [[SLVNotifyInfo alloc] initWithRFEvent:self event:event watchObject:watchObject]; [self addNotifyEvent:ne forKey:key]; } SLVNotifyLevelBlocks *nei = [[SLVNotifyLevelBlocks alloc] init]; nei.level = level; nei.block = block; [ne add:nei]; } - (void)addNotifyEvent:(SLVNotifyInfo *)ne forKey:(NSString *)key { self.notifyMap[key] = ne; __weak SLVNotifyInfo *neRef = ne; ne.sysObserverObj = [[NSNotificationCenter defaultCenter] addObserverForName:ne.event object:ne.watchObject queue:[NSOperationQueue mainQueue] usingBlock:^(NSNotification *note){ [neRef handleRFEventBlockCallback:note]; }]; } #pragma mark Remove Observer - (void)dealloc { [self removeNotifyEvent:nil watchObject:nil ignoreLevel:YES level:0]; } - (void)removeNotifyEvent:(NSString *)event watchObject:(id)watchObject ignoreLevel:(BOOL)bIgnoreLevel level:(double)level { if (event == nil && watchObject == nil) { // 移除掉所有 NSArray *keys = [self.notifyMap allKeys]; for (NSString *key in keys) { [self removeNotifyEventKey:key]; } } else if (event != nil && watchObject == nil) { NSArray *keys = [self.notifyMap allKeys]; for (NSString *key in keys) { SLVNotifyInfo *ne = self.notifyMap[key]; if ([ne.event isEqualToString:event]) { [self removeNotifyEventKey:key]; } } } else if (event == nil && watchObject != nil) { NSArray *keys = [self.notifyMap allKeys]; for (NSString *key in keys) { SLVNotifyInfo *ne = self.notifyMap[key]; if (ne.watchObject == watchObject) { [self removeNotifyEventKey:key]; } } } else { NSArray *keys = [self.notifyMap allKeys]; for (NSString *key in keys) { SLVNotifyInfo *ne = self.notifyMap[key]; if ([ne.event isEqualToString:event] && ne.watchObject == watchObject) { if (bIgnoreLevel) { [self removeNotifyEventKey:key]; } else { [ne removeLevel:level]; if (ne.eventInfos.count == 0) { [self removeNotifyEventKey:key]; } } break; } } } } - (void)removeNotifyEventKey:(NSString *)key { SLVNotifyInfo *ne = self.notifyMap[key]; if (ne.sysObserverObj != nil) { [[NSNotificationCenter defaultCenter] removeObserver:ne.sysObserverObj]; ne.sysObserverObj = nil; } [self.notifyMap removeObjectForKey:key]; } @end #pragma mark - SLVNotifyInfo @implementation SLVNotifyInfo - (id)initWithRFEvent:(SLVObserverAssociater *)associater event:(NSString *)event watchObject:(id)watchObject { self = [super init]; if (self) { _associater = associater; _event = event; _watchObject = watchObject; _eventInfos = [NSMutableArray array]; } return self; } - (void)dealloc { _watchObject = nil; } - (void)add:(SLVNotifyLevelBlocks *)info { BOOL bAdd = NO; for (NSInteger i = 0; i < self.eventInfos.count; i++) { SLVNotifyLevelBlocks *eoi = self.eventInfos[i]; if (eoi.level == info.level) { [self.eventInfos replaceObjectAtIndex:i withObject:info]; bAdd = YES; break; } else if (eoi.level > info.level) { [self.eventInfos insertObject:info atIndex:i]; bAdd = YES; break; } } if (!bAdd) { [self.eventInfos addObject:info]; } } // 按lever从小到大添加block - (void)removeLevel:(double)level { for (NSInteger i = 0; i < self.eventInfos.count; i++) { SLVNotifyLevelBlocks *eoi = self.eventInfos[i]; if (eoi.level == level) { [self.eventInfos removeObjectAtIndex:i]; break; } } } - (void)handleRFEventBlockCallback:(NSNotification *)note { for (NSInteger i = self.eventInfos.count-1; i >= 0; i--) { SLVNotifyLevelBlocks *nei = self.eventInfos[i]; SLVNotifyBlock block = nei.block; if (block != nil) { block(note, self.associater.observerObject); } } } // 按顺序执行block，block是响应通知时候的内容
另外，为通知的回调block排了优先级：
#define RFEventLevelDefault 1000.0f typedef void (^SLVNotifyBlock) (NSNotification *note, id selfRef); @interface SLVNotifyLevelBlocks : NSObject @property (nonatomic, assign) double level; // block的优先级 @property (nonatomic, copy) SLVNotifyBlock block; //收到通知后的回调block @end
测试代码：
- (void)viewDidLoad { [super viewDidLoad]; [self slvWatchObject:nil eventName:@"lvNotification" block:^(NSNotification *aNotification, id weakSelf){ NSLog(@"收到一个通知,现在开始处理了。。。"); } ]; }
这样，我们在注册通知的观察者时，使用我们的分类NSObject+AdNotifyEvent中的注册观察方法就可以了，在类销毁时，就会自动在通知中心remove掉观察者了。
总结：
本文从notification的使用情况、crash情况进行讲解，最后提出了两种crash防护的方案：第一种方案是被动防护，就是crash的代码可能已经在代码中了，我们在底层使用swizzle的方法进行了改进；第二种方案是主动防护，就是在写代码之前，我们自己写一套机制，可以有效的防护crash的发生。根据上面的分析，比较推荐第二种方案。本文的第二种方案参考自《iOS释放自注销模式设计》。
