C ++ keyword operator delete exception analysis

In C, the delete expression executes the following operations: 1. It calls the destructor; 2. It releases the object memory (operator delete (...)).

If the destructor of the parent class is not declared as a virtual function and at least one virtual function exists in the subclass, assign the object address of the subclass to the parent class pointer. When performing the delete operation on the parent class pointer, the parent class destructor will be called, and then the memory will be released (that is, 2 of the operation executed by the delete expression, releasing the object memory) crash.

However, if a virtual function does not exist in the subclass, the same operation will not crash.

Cause analysis:
// The destructor of the parent class in this example should be declared as a virtual function. However, because this program does not need to perform special operations on the destructor, the delete parent class pointer pB can also release the memory. However, an unexpected exception occurs when the internal/memory is released. Therefore, this program is analyzed as follows:

# Include <iostream>
# Include <cstdio>
Using namespace std;

Class Base
{
Public:
~ Base () {printf ("nBase: destructor .");}
};

Class Derived: public Base
{
Virtual void show ()
{
Cout <"show" <endl;
}
Public:
~ Derived () {printf ("nDerived: destructor .");}
};

Int main ()
{
Base * pB = NULL;
Derived * pD = new Derived;
PB = pD; // in this case, pD obtains the address of (unsigned char *) pD 4, therefore, the execution of operator delete will crash (because the vptr memory is regarded as the size of the memory block to be released ).
/* Unsigned char * pC = (unsigned char *) pB;
PC = pC-4;
Delete pC; // you can release the memory allocated by new Derived without crashing.
*/
Delete pB;
}

The compilation code corresponding to its main function is as follows (VC6.0 ):
Int main ()
{
00401060 push ebp
00401061 mov ebp, esp
00401063 push 0FFh
00401065 push offset _ ehhandler $ _ main (00416a0b)
0040106A mov eax, fs: [00000000]
00401070 push eax
00401071 mov dword ptr fs: [0], esp
00401078 sub esp, 64 h
00401_ B push ebx
00401_c push esi
0040107D push edi
0040da-e lea edi, [ebp-70h]
00401081 mov ecx, 19 h
00401086 mov eax, 0 CCCCCCCCh
00401_ B rep stos dword ptr [edi]

Base * pB = NULL;
0040108D mov dword ptr [ebp-10h], 0
Derived * pD = new Derived;
00401094 push 4
00401096 call operator new (00403780)
00401_ B add esp, 4
0040da-e mov dword ptr [ebp-1Ch], eax // eax stores operator new (...) The first address of the memory allocated by the function.
004010A1 mov dword ptr [ebp-4], 0
004010A8 cmp dword ptr [ebp-1Ch], 0 // judge operator new (...) Whether the memory allocated by the function is successful.
004010AC je main 5Bh (004010bb)
004010AE mov ecx, dword ptr [ebp-1Ch] // call the Derived: Derived () function, ecx saves the memory pointer.
004010B1 call @ ILT 35 (Derived: Derived) (00401028)
004010B6 mov dword ptr [ebp-28h], eax
004010B9 jmp main 62 h (004010c2)
004010BB mov dword ptr [ebp-28h], 0
004010C2 mov eax, dword ptr [ebp-28h]
004010C5 mov dword ptr [ebp-18h], eax
004010C8 mov dword ptr [ebp-4], 0 FFFFFFFFh
004010CF mov ecx, dword ptr [ebp-18h]
004010D2 mov dword ptr [ebp-14h], ecx
PB = pD;
004010D5 cmp dword ptr [ebp-14h], 0
004010D9 je main 86 h (004010e6)
004010DB mov edx, dword ptr [ebp-14h]
004010DE add edx, 4
007 4010e1 mov dword ptr [ebp-2Ch], edx
004010E4 jmp main 8Dh (004010ed)
004010E6 mov dword ptr [ebp-2Ch], 0
004010ED mov eax, dword ptr [ebp-2Ch]
004010F0 mov dword ptr [ebp-10h], eax // pB = (unsinged char *) (pD) 4

Delete pB;
004010F3 mov ecx, dword ptr [ebp-10h]
004010F6 mov dword ptr [ebp-24h], ecx
004010F9 mov edx, dword ptr [ebp-24h]
004010FC mov dword ptr [ebp-20h], edx
004010FF cmp dword ptr [ebp-20h], 0
00401103 je main 0B4h (00401114)
00401105 push 1
00401107 mov ecx, dword ptr [ebp-20h]
0040110A call @ ILT 20 (Base: 'scalar deleting destructor