How does compiler allocate memory for Class Objects? - objective-c

Question

Given the following variable declaration,
Foo* foo;
how is memory actually being allocated?
This is my guess. There are actually two pieces of memory being allocated here.
A 32 bit number representing a memory address stored at foo [The pointer]. How exactly does the compiler mark or signal that the pointer is actually storing a reference to memory that is of type of Foo?
A contiguous memory segment that is uninitialized and typed as Foo. How does it know how much memory to allocate? How does it mark the memory segment as being of type Foo?

Answer 1

The line of code you've given doesn't allocate any memory. At most, it moves the stack pointer sufficiently to make room for a one-word value (though after optimization, it may not even do that).
A 32 bit number representing a memory address stored at foo [The pointer].
By "32 bit number" I assume you mean "a pointer-sized integer" which is 64 bits on most modern processors. This may, if it's not optimized, be aliased to some location on the stack.
How exactly does the compiler mark or signal that the pointer is actually storing a reference to memory that is of type of Foo?
It doesn't signal this, and it doesn't store a reference to memory that is of any type at all. The above line of code just (at most) makes room for a pointer. In ObjC, at runtime there are no object types. Every pointer to an object is considered id. ObjC absolutely does not promise that this represents a "contiguous memory segment" (there are plenty of cases where what you would think of as "the data" is not contiguous). At a deeper level, the processor does not care about "types" at all. There is just memory and pointers (void *) to memory. (At a deeper level than that, there isn't even "memory." There's physical RAM, caches, registers, and many other things that are generally abstracted away, even in C. For more on that, see C is not a Low-Level Language.)
A contiguous memory segment that is uninitialized and typed as Foo. How does it know how much memory to allocate? How does it mark the memory segment as being of type Foo?
This isn't allocated at all by the above line. If you want to allocate memory for Foo, you must call +[Foo alloc]. Since it is a class method on Foo, it knows how much memory Foo requires. Nothing marks that memory of being of any type, and Objective-C does not actually care what type it is. All it cares is that theres a pointer in the right place called the isa pointer that it can use to lookup how to dispatch messages via objc_msgSend.
There are plenty of cases where something called *Foo does not point to a Foo. It's very common that the actual thing pointed to is a toll-free-bridged type, which is a data structure for a completely different type (a CF structure) that happens to have an isa pointer in the right place so that it can pretend to be an ObjC object. All that is required for the system to work is for things to line up "close enough" that objc_msgSend can function. There is no need (or mechanism) for marking memory as being some particular type.

Answer 2

The size of a pointer like Foo * depends on the target platform. On most current Apple platforms, it is 64-bit, but Apple Watch prior to Series 4 is 32-bit.
There are several contexts in which you might write this:
Foo *foo;
You could write this as a global variable, outside of any #interface or #implementation variable declaration and outside of any function. Then, each time the program is started, it allocates space for one pointer and sets that pointer to nil.
You could write this in an #implementation variable declaration, like this:
#implementation MyObject {
Foo *foo;
}
In this case, you have declared an instance variable (or “ivar”). Each time the program creates an instance of MyObject, the instance includes space for one pointer and sets the pointer to nil.
You could write this as a local variable in a function or a method, like this:
- (void)doSomething {
Foo *foo;
}
In this case, you have declared a local variable. Each time the function or method is called, it allocates one pointer in its stack frame and (assuming you compiled with ARC enabled, which is the default) it initializes the pointer to nil.
Note that in all of these cases, foo does not point to an instance of Foo. It points to nil. To make foo point to an instance of Foo, you must set it to reference to Foo that you got from somewhere else. You could get that reference by calling a function or method, like this:
- (void)doSomething {
Foo *foo;
// foo is nil here.
foo = [[Foo alloc] init];
// If [[Foo alloc] init] succeeded, then foo now points to an
// instance of Foo. If [[Foo alloc] init] returned nil, which
// indicates failure, then foo is still nil.
}
Or you could be passed a Foo reference as a function argument:
- (void)doSomethingWithFoo:(Foo *)incomingFoo {
Foo *foo;
// foo is nil here.
foo = incomingFoo;
// foo now points to whatever incomingFoo points to, which should be
// either an instance of Foo, or nil.
}
Or you could get it from some other global, local, or instance variable.
As to “How exactly does the compiler mark or signal that the pointer is actually storing a reference to memory that is of type of Foo”: It doesn't. At compile-time, the compiler knows that foo should only point to a Foo (or nil), and tries to prevent you from assigning it to things that aren't a pointer to Foo. For example, the compiler will issue a warning or an error for this:
Foo *foo = #"hello";
because the compiler knows that an NSString is not a Foo. (I assume you didn't make Foo a typedef or subclass of NSString.)
However, you can override the compiler's type concerns using a cast:
Foo *foo = (Foo *)#"hello";
or by using the id type:
id something = #"hello";
Foo *foo = something;
This compiles, and it runs fine until you try to do something with foo that an NSString doesn't know how to do.
So it's not the compiler that knows “the pointer is actually storing a reference to memory that is of type of Foo”.
The Objective-C runtime knows that the pointer is actually storing a reference to a Foo. To understand how the runtime tracks the type of an object, you first need to know about the Foo class object.
For every Objective-C class in a program, there is, at runtime, one special object called the “class object”. So for NSObject, there is a single NSObject class object, and for NSString, there is a single NSString class object, and for Foo, there is a single Foo class object. Note that in general, a class object is not an instance of itself! That is, the NSString class object is not itself an instance of NSString, and the Foo class object is not itself an instance of Foo.
The Foo class object knows what makes up an instance of Foo:
The superclass of Foo (maybe NSObject, maybe something else).
The name, type, and size of each instance variable of a Foo (except those inherited from the super class of Foo).
The name, type signature, and implementation address of each message understood by a Foo (except those inherited from the superclass of Foo).
The first bytes of every Objective-C object contain a pointer to a class object.1 This pointer is called the isa pointer, and it determines the type of the object. When you use the syntax that sends a message to an object, like [foo length], the compiler generates a call to objc_msgSend. Recall that in [foo length], the object referenced by foo is called the receiver. The objc_msgSend function uses the isa pointer of the receiver to find the receiver's class object. It looks through the class object's table of messages to find the implementation of length and jumps to it. If Foo doesn't define a length message, then objc_msgSend looks in Foo's superclass for the message, and so on up the superclass chain.2
So, it is this isa pointer that determines the type of the object at runtime.
So how does a Foo object get allocated? When you say [[Foo alloc] init], that means “send the alloc message to the Foo class object, and then send the init message to whatever comes back from alloc”. So the Foo class object receives the alloc message. But the Foo class object probably doesn't implement alloc directly. It inherits the NSObject implementation of alloc.
So +[NSObject alloc] actually allocates the memory for a new Foo. As you say, it allocates a “contiguous memory segment”, but it is not “uninitialized and typed as Foo”. It is initialized and type as Foo. The +[NSObject alloc] documentation says:
The isa instance variable of the new instance is initialized to a data structure that describes the class; memory for all other instance variables is set to 0.
You can look at the implementation here. It's the callAlloc function. It uses the standard C library function calloc to allocate memory, and calloc fills the memory to 0. Then it sets the isa pointer.
As to “How does it know how much memory to allocate”: remember that each class object knows all of the instance variables of its instances. So to allocate a Foo, +[NSObject alloc] sums the sizes of all of the instance variables of a Foo, plus the sizes of all of the instance variables of Foo's superclass, recursively to the end of the superclass chain. That tells it how many bytes to allocate. Except that it would be too slow to do that every time it allocates an object. So the program pre-computes the instance size for every class object at startup, and +[NSObject alloc] looks up the precomputed size of a Foo in the Foo class object.
Unless the object is represented as a tagged pointer, but don't worry about that.
If you want to know what happens when objc_msgSend reaches the end of the superclass chain without finding an implementation, read Objective-C Message Forwarding.