Call any super class’s implementation of any method

Jared Pochtar
6 min readSep 1, 2010


In Objective-C, you can only call an overridden implementation of a method from an immediate subclass of that method’s class. This works well to provide encapsulation, and based on the way super is handled, a super method implementation cannot be called from any but the immediate superclass (inheritance notwithstanding). This is a good thing, as it would break large bits of encapsulation if subclasses could call arbitrary super implementations, or worse, if other objects could call super implementations of methods on foreign objects.

What we’re going to do

Keeping in mind that you should never do this, let’s implement a way to call arbitrary super implementations of arbitrary objects. This includes calling a super implementation of arbitrary level on self, which is not as awful, but still implementation dependent.

This encapsulation-breaking design-pattern destroyer will also have a -super method that takes no arguments and messages the immediate superclass, but can be chained together, so that we may use dot-syntax. However, the use of this method is a malfeasance in the world of Objective-C, where the actual class of an object may be a subclass of the class which you have declared it a pointer to an object of, and you will end up calling the implementation of the wrong superclass. Additionally, in the case where you are using it on self, the runtime lookup of the superclass may result in the calling of the implementation from the class of the caller, if self is actually a subclass which happened to be in a call to a super implementation of its own, which is absolutely a Very Bad Thing and will likely lead to a crash.

All in all, by the end of this we will be able to write things like this:

[[Superclass levelSuperOf:self] dosomething];
[[Superclass levelSuperOf:self] performSelector:@selector(dosomething)];
[object.super dosomething];
[object_getSuper(myNonNSObjectInheritingObject, itsClass) dosomething];
[[object superWithClass:[Superclass class]] dosomething];

The implementation

The object_getSuper function works for any object, so we're not restricted to NSObject subclasses for these methods, and their implementations' consist of calling object_getSuper with the correct parameters, so we will not be spending time writing them out.

One additional note is that we must implement +(id)superWithClass:(Class)superclass, should never actually be called when one could simply call the method on the superclass directly, if it were at hand. However, the metaclass of NSObject actually inherits from NSObject, which is unbelievably confusing (explained rather well here, especially in the comments), but basically means that -superWithClass: would be available in something like [NSObjectSubclass superWithClass:NSObject], unless you actually 'overload' it with +superWithClass:. At any rate, for my +superWithClass:, I simply return the passed superclass.

For the actual implementation of object_getSuper, we return a HigherOrderMessage object (full code on my github repo, abbreviated here)

id object_getSuper(id object, Class superclass) {return [HigherOrderMessage HOMWithGetSignatureForSelector:^NSMethodSignature *(SEL aSelector) {
return [object methodSignatureForSelector:aSelector];
} capture:^(NSInvocation *message) {
//Snip. Extra code handling performSelector:, its variants, and super
[message invokeWithTarget:object superclass:superclass];

…which hands off the work to a NSInvocation category,

@implementation NSInvocation (SuperMessenger)- (void)invokeWithTarget:(id)target superclass:(Class)superclass {
[SuperMessenger superMessage:self withObject:target class:superclass];

...which hands off the work to a class called SuperMessenger

Some Background

In Objective-C, the super keyword is the way to call a superclass's implementation of a method. When the compiler finds a method call, it generates code as if it was a function call to (an appropriately casted) objc_msgSend, with two additional arguments preceding the ones passed to the method: receiver and selector, corresponding to the 'hidden parameters' self and _cmd in the callee. However, the compiler special cases a method call with a target of super, and instead generates a call to objc_msgSendSuper, which also takes a selector parameter, but instead of a receiver, uses a pointer to a struct of the receiver (self) and the (super)class whose implementation we are calling, which in Objective-C is always the immediate superclass of the caller's class.

All of the above can be found in Apple's official Objective-C language documentation, especially the first two sections.

Keep in mind that the difference between the signatures of objc_msgSendSuper is the destination type of the first argument. This is so after objc_msgSendSuper has done the method implementation lookup, it can swap the pointer for the actual receiver without any additional fuss. (It cannot however simply look up the superclass of the receiver at runtime, for reasons mentioned above in 'What We're Going To Do'.) Both of these methods lookup the method implementation in the superclasses (sequentially) of the target class if the method is not found in the target class.

The SuperMessenger implementation

SuperMessenger implements a plethora of convenience methods, but they all end up saving the target of the message send and its selected superclass in an ivar (target) of type struct objc_super (the destination type of the first argument of objc_msgSendSuper). Then the -invoke: method is called with a NSInvocation. The -invoke: method saves the selector of the invocation in an ivar (selector), and then sets the invocation's selector to the appropriate forwarding method for its return type, (ABIs handle struct and sometimes floating point returns differently, depending on the ABI.) and invokes the invocation on self.

The 'forwarding methods' are all exactly the same, however they are separated for the sole purpose of giving them different return types for the runtime. They work by calling the __builtin_apply family of GCC extensions to apply all (even unknown) arguments passed to them to objc_msgSendSuper, but only after swapping the receiver (self) and selector (_cmd) for their proper values residing in ivars target and selector. Additionally, an integer containing the frame length of the method is required for __builtin_apply, but we do not have to worry about this as NSMethodSignature provides a convenient method returning just that, so all we have to do is store it in an ivar in -invoke:. Lastly, once we set self to the objc_super, ivars will become unavailable to us (although the compiler won't give us any errors), so we need to remember to set self after we get the other two ivars or we crash.

The Core Code

#define SUPERMESSAGE(method) {									\
int framelength = frameLength; \
_cmd = selector; \
self = (id)⌖ \
__builtin_return(__builtin_apply((void(*)())method, __builtin_apply_args(), framelength)); \
- (long long)superMessage SUPERMESSAGE(objc_msgSendSuper)
- (double)superMessageFpret SUPERMESSAGE(objc_msgSendSuper)
- (CGRect)superMessageStret SUPERMESSAGE(objc_msgSendSuper_stret)
//CGRect used to simulate generic struct
- (void)invoke:(NSInvocation *)invoc {
NSMethodSignature *methodSignature = invoc.methodSignature;
frameLength = methodSignature.frameLength;
char retType = methodSignature.methodReturnType[0];
selector = invoc.selector;
if (retType == 'd' || retType == 'f') {
invoc.selector = @selector(superMessageFpret);
} else if (methodSignature.methodReturnLength > 8) {
invoc.selector = @selector(superMessageStret);
} else {
invoc.selector = @selector(superMessage);
[invoc invokeWithTarget:self];

Platform/Compiler Dependence - You should never, ever, EVER use this

Alas, this code only works on GCC, as llvm-gcc does not yet support the __builtin_apply functions. Most worrisome, however, is that this code (even with the correct modifications to the forwarding method selection in -invoke:) only works on an IA-32 processor (Intel 32-bit MacOS); this means that it is code generation (read: compiler-target) dependent, so not only does this fail in 'modern' MacOS applications/iOS, it also means that it could break with an update to GCC, or conceivably even an update to the OS. Of course, we are using __builtin_apply after changing the arguments, which we're not supposed to do, so it is understandable that it would not work, and we are lucky that it functions on at least one platform. It is none the less unsettling.
I'm not quite sure what to make of this, but many of the samples I found of __builtin_apply were part of an old version of the Objective-C runtime. This may relate to the above code working only on IA-32, or it might hold an inkling of irony (if I'm guessing correctly, it may have been added to the compiler for forwarding in Objective-C).

I may eventually return to this topic, when I have fully delved into the calling conventions of the various platforms on which Objective-C runs, but regardless I dare say it necessary to wrap most/all of the code in 'The Core Code' in a platform-specific ifdef. Upon that continuation, however, I would need to make a choice to either leave the firm foundation of fact and journey into thickets of wildest guesswork with regard to the generated data structure returned by __builtin_apply_args, or write the forwarders in assembly. While assembly really is the (very, very) best tool for the job, there are two problems: I don't have any experience writing assembly, and if we were going to use assembly we should have just used libffi/libffi-iphone (which are both really cool).


We've just written a whole bunch of code that both should never be used and is extra fragile. ... That almost sounds like I just wasted 5 minutes of your time. Whoops.

So now we can, on Mac OS 32 bit applications, call an arbitrary super implementation of an arbitrary class.

You can download the project here.

The best use of this that I can think of is skipping over specific overridden implementations of a superclass method to call a higher (inheritance-wise) implementation. This could actually be rather useful, if it weren't for the fact that this means you're breaking encapsulation, however I guess it is understandable if used to hack Cocoa.