利用IDA和LLDB探索WebCore的C++类的继承关系

开刀的类名叫 PluginWidgetIOS，利用lldb可以得到：

(lldb) image lookup -r -s PluginWidgetIOS
7 symbols match the regular expression 'PluginWidgetIOS' in /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator6.1.sdk/System/Library/PrivateFrameworks/WebKit.framework/WebKit:
        Address: WebKit[0x0003a5a0] (WebKit.__TEXT.__text + 231680)
        Summary: WebKit`PluginWidgetIOS::~PluginWidgetIOS()        Address: WebKit[0x0003a5b0] (WebKit.__TEXT.__text + 231696)
        Summary: WebKit`PluginWidgetIOS::~PluginWidgetIOS()        Address: WebKit[0x0003a6f0] (WebKit.__TEXT.__text + 232016)
        Summary: WebKit`PluginWidgetIOS::platformLayer() const        Address: WebKit[0x0003a750] (WebKit.__TEXT.__text + 232112)
        Summary: WebKit`PluginWidgetIOS::willProvidePluginLayer() const        Address: WebKit[0x0003a7b0] (WebKit.__TEXT.__text + 232208)
        Summary: WebKit`PluginWidgetIOS::attachPluginLayer()        Address: WebKit[0x0003a810] (WebKit.__TEXT.__text + 232304)
        Summary: WebKit`PluginWidgetIOS::detachPluginLayer()        Address: WebKit[0x001335e0] (WebKit.__DATA.__data + 560)
        Summary: vtable for PluginWidgetIOS

其中有用的信息是：

Address: WebKit[0x001335e0] (WebKit.__DATA.__data + 560)
        Summary: vtable for PluginWidgetIOS

用IDA打开WebCore的静态库，goto（快捷键g） vtable所在的地址 0x1335e0，可以看到：

__data:001335E0 ; `vtable for'PluginWidgetIOS
__data:001335E0 __ZTV15PluginWidgetIOS db    0          ; DATA XREF: __nl_symbol_ptr:__ZTV15PluginWidgetIOS_ptro
__data:001335E1                 db    0
__data:001335E2                 db    0
__data:001335E3                 db    0
__data:001335E4                 db    0
__data:001335E5                 db    0
__data:001335E6                 db    0
__data:001335E7                 db    0
__data:001335E8                 dd offset __ZN15PluginWidgetIOSD1Ev ; PluginWidgetIOS::~PluginWidgetIOS()
__data:001335EC                 dd offset __ZN15PluginWidgetIOSD0Ev ; PluginWidgetIOS::~PluginWidgetIOS()
__data:001335F0                 dd offset __ZN7WebCore6Widget12setFrameRectERKNS_7IntRectE ; WebCore::Widget::setFrameRect(WebCore::IntRect  const&)
__data:001335F4                 dd offset __ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE ; WebCore::Widget::paint(WebCore::GraphicsContext *,WebCore::IntRect  const&)
__data:001335F8                 dd offset __ZN12PluginWidget14invalidateRectERKN7WebCore7IntRectE ; PluginWidget::invalidateRect(WebCore::IntRect  const&)
__data:001335FC                 dd offset __ZN7WebCore6Widget8setFocusEb ; WebCore::Widget::setFocus(bool)
__data:00133600                 dd offset __ZN7WebCore6Widget4showEv ; WebCore::Widget::show(void)
__data:00133604                 dd offset __ZN7WebCore6Widget4hideEv ; WebCore::Widget::hide(void)
__data:00133608                 dd offset __ZN7WebCore6Widget16setParentVisibleEb ; WebCore::Widget::setParentVisible(bool)
__data:0013360C                 dd offset __ZNK7WebCore6Widget11isFrameViewEv ; WebCore::Widget::isFrameView(void)
__data:00133610                 dd offset __ZNK7WebCore6Widget12isPluginViewEv ; WebCore::Widget::isPluginView(void)
__data:00133614                 dd offset __ZNK7WebCore14PluginViewBase16isPluginViewBaseEv ; WebCore::PluginViewBase::isPluginViewBase(void)
__data:00133618                 dd offset __ZNK7WebCore6Widget11isScrollbarEv ; WebCore::Widget::isScrollbar(void)
__data:0013361C                 dd offset __ZN7WebCore6Widget9setParentEPNS_10ScrollViewE ; WebCore::Widget::setParent(WebCore::ScrollView *)
__data:00133620                 dd offset __ZN7WebCore6Widget11handleEventEPNS_5EventE ; WebCore::Widget::handleEvent(WebCore::Event *)
__data:00133624                 dd offset __ZN7WebCore6Widget12notifyWidgetENS_18WidgetNotificationE ; WebCore::Widget::notifyWidget(WebCore::WidgetNotification)
__data:00133628                 dd offset __ZN7WebCore6Widget17frameRectsChangedEv ; WebCore::Widget::frameRectsChanged(void)
__data:0013362C                 dd offset __ZN7WebCore6Widget22widgetPositionsUpdatedEv ; WebCore::Widget::widgetPositionsUpdated(void)
__data:00133630                 dd offset __ZN7WebCore6Widget25transformsAffectFrameRectEv ; WebCore::Widget::transformsAffectFrameRect(void)
__data:00133634                 dd offset __ZNK7WebCore6Widget23convertToContainingViewERKNS_7IntRectE ; WebCore::Widget::convertToContainingView(WebCore::IntRect  const&)
__data:00133638                 dd offset __ZNK7WebCore6Widget25convertFromContainingViewERKNS_7IntRectE ; WebCore::Widget::convertFromContainingView(WebCore::IntRect  const&)
__data:0013363C                 dd offset __ZNK7WebCore6Widget23convertToContainingViewERKNS_8IntPointE ; WebCore::Widget::convertToContainingView(WebCore::IntPoint  const&)
__data:00133640                 dd offset __ZNK7WebCore6Widget25convertFromContainingViewERKNS_8IntPointE ; WebCore::Widget::convertFromContainingView(WebCore::IntPoint  const&)
__data:00133644                 dd offset __ZNK7WebCore6Widget13axObjectCacheEv ; WebCore::Widget::axObjectCache(void)
__data:00133648                 dd offset __ZNK15PluginWidgetIOS13platformLayerEv ; PluginWidgetIOS::platformLayer(void)
__data:0013364C                 dd offset __ZNK15PluginWidgetIOS22willProvidePluginLayerEv ; PluginWidgetIOS::willProvidePluginLayer(void)
__data:00133650                 dd offset __ZN15PluginWidgetIOS17attachPluginLayerEv ; PluginWidgetIOS::attachPluginLayer(void)
__data:00133654                 dd offset __ZN15PluginWidgetIOS17detachPluginLayerEv ; PluginWidgetIOS::detachPluginLayer(void)
__data:00133658                 dd offset __ZN7WebCore14PluginViewBase12scriptObjectEPN3JSC14JSGlobalObjectE ; WebCore::PluginViewBase::scriptObject(JSC::JSGlobalObject *)
__data:0013365C                 dd offset __ZN7WebCore14PluginViewBase27privateBrowsingStateChangedEb ; WebCore::PluginViewBase::privateBrowsingStateChanged(bool)
__data:00133660                 dd offset __ZN7WebCore14PluginViewBase12getFormValueERN3WTF6StringE ; WebCore::PluginViewBase::getFormValue(WTF::String &)
__data:00133664                 dd offset __ZN7WebCore14PluginViewBase6scrollENS_15ScrollDirectionENS_17ScrollGranularityE ; WebCore::PluginViewBase::scroll(WebCore::ScrollDirection,WebCore::ScrollGranularity)
__data:00133668                 dd offset __ZN7WebCore14PluginViewBase19horizontalScrollbarEv ; WebCore::PluginViewBase::horizontalScrollbar(void)
__data:0013366C                 dd offset __ZN7WebCore14PluginViewBase17verticalScrollbarEv ; WebCore::PluginViewBase::verticalScrollbar(void)
__data:00133670                 dd offset __ZN7WebCore14PluginViewBase16wantsWheelEventsEv ; WebCore::PluginViewBase::wantsWheelEvents(void)
__data:00133674                 align 10h

这是PluginWidgetIOS的虚函数表。从分号后的注释可以看到函数直接的执行地址，分别有指向Widget、PluginWidget、PluginViewBase的函数，可以知道PluginWidgetIOS是他们的直接或间接子类。

再利用lldb分别image lookup这三个类，就可以看出继承链为：

PluginWidgetIOS->PluginViewBase->PluginWidget->Widget

因为PluginWidget的虚表里不会出现PluginViewBase， Widget的虚表里不会出现PluginWidget和PluginViewBase。当然，这三个类在开源码中也能找到继承关系。