如何定位Obj-C野指针随机Crash(三)：如何让Crash自报家门

id objc_msgSend(id self, SEL op, ...)

libobjc.A.dylib`objc_msgSend:
0x2f879f40 <+0>:  cbz    r0, 0x2f879f7e            ; <+62>
0x2f879f42 <+2>:  ldr.w  r9, [r0]
0x2f879f46 <+6>:  ldrh.w r12, [r9, #0xc]
0x2f879f4a <+10>: ldr.w  r9, [r9, #0x8]
0x2f879f4e <+14>: and.w  r12, r12, r1
0x2f879f52 <+18>: add.w  r9, r9, r12, lsl #3
0x2f879f56 <+22>: ldr.w  r12, [r9]
0x2f879f5a <+26>: teq.w  r12, r1
0x2f879f5e <+30>: bne    0x2f879f66                ; <+38>
0x2f879f60 <+32>: ldr.w  r12, [r9, #0x4]  
0x2f879f64 <+36>: bx     r12
0x2f879f66 <+38>: cmp.w  r12, #0x1  
0x2f879f6a <+42>: blo    0x2f879f78                ; <+56>
0x2f879f6c <+44>: it     eq
0x2f879f6e <+46>: ldreq.w r9, [r9, #0x4]
0x2f879f72 <+50>: ldr    r12, [r9, #8]!
0x2f879f76 <+54>: b      0x2f879f5a                ; <+26>
0x2f879f78 <+56>: ldr.w  r9, [r0]
0x2f879f7c <+60>: b      0x2f87a1c0                ; _objc_msgSend_uncached
0x2f879f7e <+62>: mov.w  r1, #0x0
0x2f879f82 <+66>: bx     lr

struct objc_class : objc_object {
// Class ISA;
Class superclass;
cache_t cache;
uintptr_t data_NEVER_USE;  // class_rw_t * plus custom rr/alloc flags
class_rw_t *data() {
return (class_rw_t *)(data_NEVER_USE & ~CLASS_FAST_FLAG_MASK);
}
void setData(class_rw_t *newData) {
uintptr_t flags = (uintptr_t)data_NEVER_USE & CLASS_FAST_FLAG_MASK;
data_NEVER_USE = (uintptr_t)newData | flags;
}
……..
struct cache_t {
struct bucket_t *buckets;
mask_t shiftmask;
mask_t occupied;
……..
struct bucket_t {
cache_key_t key;
IMP imp;
…...
typedef uintptr_t cache_key_t;    

0x2f879f40 <+0>:  cbz    r0, 0x2f879f7e          //如果self为0就跳转到0x2f879f7e。给nil发消息的话就什么都不做
0x2f879f42 <+2>:  ldr.w  r9, [r0]    //取对象的类到r9
0x2f879f46 <+6>:  ldrh.w r12, [r9, #0xc]  //取类的偏移#0xc的数据到r12，也就是shiftmask的值
0x2f879f4a <+10>: ldr.w  r9, [r9, #0x8] //取类的偏移#0x8的成员到r9，也即是cache
0x2f879f4e <+14>: and.w  r12, r12, r1     //r1和shiftmask与，放到r12,r1是参数一，也就是sel，用来计算sel的index
0x2f879f52 <+18>: add.w  r9, r9, r12, lsl #3    //左移3位就是乘8，8是索引项 bucket_t的宽度，r12是cache索引，r9就cache的位置，r9+r12*8，就是当前sel对应的bucket_t缓存
0x2f879f56 <+22>: ldr.w  r12, [r9]   //取缓存bucket_t
0x2f879f5a <+26>: teq.w  r12, r1     //判断缓存项是不是要找的sel    key==sel？
0x2f879f5e <+30>: bne    0x2f879f66              //不是的话就要查找sel
0x2f879f60 <+32>: ldr.w  r12, [r9, #0x4]   //是的话就取出imp
0x2f879f64 <+36>: bx     r12    //调sel的实现，跳到imp里面去执行

@interface DPCatcher : NSObject
@property (readwrite,assign,nonatomic) Class origClass;
@end
@implementation DPCatcher
- (id)forwardingTargetForSelector:(SEL)aSelector{
NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,NSStringFromSelector(aSelector));
abort();
return nil;
}
-(void)dealloc{
NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"dealloc");
abort();
}
-(oneway void)release{
NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"release");
abort();
}
- (instancetype)autorelease{
NSLog(@"发现objc野指针:%s::%p=>%@",class_getName(self.origClass),self,@"autorelease");
abort();
}
@end

static void DPFree(void* p){
size_t memSiziee=malloc_size(p);
if (memSiziee>sDPCatchSize) {//有足够的空间才覆盖
id obj=(id)p;
Class  origClass=object_getClass(obj);//判断是不是objc对象 ，registeredClasses里面有所有的类，如果可以查到，说明是objc类
if (origClass && CFSetContainsValue(registeredClasses, origClass)) {
memset(obj, 0x55, memSiziee);
memcpy(obj, &sDPCatchIsa, sizeof(void*));//把我们自己的类的isa复制过去
DPCatcher* bug=(DPCatcher*)p;
bug.origClass=origClass;
}else{
memset(p, 0x55, memSiziee);
}
}else{
memset(p, 0x55, memSiziee);
}
return;
}

registeredClasses = CFSetCreateMutable(NULL, 0, NULL);
unsigned int count = 0;
Class *classes = objc_copyClassList(&count);
for (unsigned int i = 0; i < count; i++) {
CFSetAddValue(registeredClasses, (__bridge const void *)(classes[i]));
}
free(classes);
classes=NULL;
sDPCatchIsa=objc_getClass("DPCatcher");
sDPCatchSize=class_getInstanceSize(sDPCatchIsa);

UIView* testObj=[[UIView alloc] init];
[testObj release];
[testObj setNeedsLayout];