为什么会崩溃？

Question

代码如下：

+ (void)load{
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        Class class = [NSURLConnection class];
        SEL selector = @selector(initWithRequest:delegate:);
        SEL swizzledSelector = @selector(test_initWithRequest:delegate:);
        Method originalinitWithRequest = class_getInstanceMethod(class, selector);
        NSURLConnection* (^swizzleBlock)(NSURLConnection *,SEL,NSURLRequest*,id )= ^(NSURLConnection *slf,SEL swizzledSelector,NSURLRequest *request,id delegate) {
            return ((NSURLConnection*(*)(NSURLConnection*,SEL,NSURLRequest*,id))objc_msgSend)(slf,swizzledSelector,request,delegate);
            
        };
        
        IMP implementation = imp_implementationWithBlock(swizzleBlock);
        class_addMethod(class, swizzledSelector, implementation, method_getTypeEncoding(originalinitWithRequest));
        Method newConnectionWithRequestClassMethod = class_getInstanceMethod(class, swizzledSelector);
        method_exchangeImplementations(originalinitWithRequest, newConnectionWithRequestClassMethod);
    });
}

我看了半天没发现什么问题，为什么这样一交换之后运行就会崩溃。
在return 时候打断点，信息如下：

(lldb) po slf
<NSURLConnection: 0x60000000dea0> { request: (null) }

(lldb) po swizzledSelector
<NSURLRequest: 0x60000000e020> { URL: http://httpstat.us/200 }

(lldb) po request
<ViewController: 0x7fdd4bf03fe0>

(lldb) po delegate
 nil

崩溃信息如下：

2017-12-19 15:09:25.923 HookNetwork2[4030:501650] *** NSForwarding: warning: selector (0x60000000e020) for message 'Xˆü' does not match selector known to Objective C runtime (0x608000004340)-- abort
2017-12-19 15:09:25.924 HookNetwork2[4030:501650] (null): unrecognized selector sent to instance 0x60000000dea0
2017-12-19 15:09:25.928 HookNetwork2[4030:501650] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '(null): unrecognized selector sent to instance 0x60000000dea0'
*** First throw call stack:
(
    0   CoreFoundation                      0x000000010926fb0b __exceptionPreprocess + 171
    1   libobjc.A.dylib                     0x0000000108cd4141 objc_exception_throw + 48
    2   CoreFoundation                      0x00000001092df134 -[NSObject(NSObject) doesNotRecognizeSelector:] + 132
    3   CoreFoundation                      0x00000001091f6840 ___forwarding___ + 1024
    4   CoreFoundation                      0x00000001091f63b8 _CF_forwarding_prep_0 + 120
    5   HookNetwork2                        0x00000001086fc379 __20+[RAObserverer load]_block_invoke_2 + 153
    6   HookNetwork2                        0x00000001086fd6a3 -[ViewController connectTest:] + 1731
    7   UIKit                               0x0000000109694d82 -[UIApplication sendAction:to:from:forEvent:] + 83
    8   UIKit                               0x00000001098195ac -[UIControl sendAction:to:forEvent:] + 67
    9   UIKit                               0x00000001098198c7 -[UIControl _sendActionsForEvents:withEvent:] + 450
    10  UIKit                               0x0000000109818802 -[UIControl touchesEnded:withEvent:] + 618
    11  UIKit                               0x00000001097027ea -[UIWindow _sendTouchesForEvent:] + 2707
    12  UIKit                               0x0000000109703f00 -[UIWindow sendEvent:] + 4114
    13  UIKit                               0x00000001096b0a84 -[UIApplication sendEvent:] + 352
    14  UIKit                               0x0000000109e945d4 __dispatchPreprocessedEventFromEventQueue + 2926
    15  UIKit                               0x0000000109e8c532 __handleEventQueue + 1122
    16  CoreFoundation                      0x0000000109215c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
    17  CoreFoundation                      0x00000001091fb0cf __CFRunLoopDoSources0 + 527
    18  CoreFoundation                      0x00000001091fa5ff __CFRunLoopRun + 911
    19  CoreFoundation                      0x00000001091fa016 CFRunLoopRunSpecific + 406
    20  GraphicsServices                    0x000000010d044a24 GSEventRunModal + 62
    21  UIKit                               0x0000000109693134 UIApplicationMain + 159
    22  HookNetwork2                        0x00000001086ff2bf main + 111
    23  libdyld.dylib                       0x000000010c0d965d start + 1
    24  ???                                 0x0000000000000001 0x0 + 1
)
libc++abi.dylib: terminating with uncaught exception of type NSException

前面的代码哪里有问题，为什么断点信息是这样的？
这里有一个crash demo，可以下载下来看一看。

Answer 1

建议阅读一下imp_implementationWithBlock的文档。

Parameters

block
The block that implements this method. The signature of block should be method_return_type ^(id self, self, method_args …). The selector of the method is not available to block. block is copied with Block_copy().

你的代码里面的block的类型里面是需要了一个seletor, 打断点的得知，此时swizzle selector的值是一个NSURLRequest，明显不是我们想要的selector，所以objc_msgSend就失败了。

查阅文档可知，block的签名应该是method_return_type ^(id self, self, method_args …).是不需要SEL的，所以将上述的代码改为：

    id swizzleBlock = ^(NSURLConnection *slf, NSURLRequest *request,id delegate) {
        return ((NSURLConnection*(*)(NSURLConnection*,SEL,NSURLRequest*,id))objc_msgSend)(slf,swizzledSelector,request,delegate);
    };

运行可以成功，点击按钮也OK了。

Answer 2

那个RAObserverer是什么东西？代码里没有，奔溃调用栈里看起来跟上面代码没关系。

需要知道这两句是干了什么,从调用栈看是RAObserverer没有load方法的实现

5   HookNetwork2                        0x00000001086fc379 __20+[RAObserverer load]_block_invoke_2 + 153
6   HookNetwork2                        0x00000001086fd6a3 -[ViewController connectTest:] + 1731

关键：imp_implementationWithBlock这个block的参数里是没有SEL的

Answer 3

遇到问题找不到原因时可以多看看官方文档，说不定会有思路。