I think I figured out how Apple did their toll-free bridging.

[Chan Maxthon]

I discovered this from stack traces of toll-free bridged calls.

All CoreFoundation objects have an Objective-C isa pointer. For toll-free 
bridged objects, this pointer points to an Objective-C class which is a 
subclass of the corresponding class cluster public class, like for CFArray the 
subclass is called __NSCFArray. This Objective-C class maps calls from 
Objective-C public API to corresponding CoreFoundation calls.

All CoreFoundation functions that take toll-free-bridge-able objects detects if 
the argument passed in is CoreFoundation object. If Cocoa objects are used, 
base on the situation, either the object will be copied into its CoreFoundation 
counterpart, or the call will be mapped back to Cocoa.

This entangled nature guaranteed that at least all toll-free bridging private 
Cocoa classes, their public base classes and NSObject are inside CoreFoundation 
binary, or the linker will be seriously confused.

发自我的 iPhone