virtual function Call of C + + object layout and multi-state realization exploration

Let's look at the invocation of the virtual member function. The class C041 contains virtual member functions, which are defined as follows:

struct C041
{
C041() : c_(0x01) {}
virtual void foo() { c_ = 0x02; }
char c_;
};

Execute the following code:

C041 obj;
PRINT_DETAIL(C041, obj)
PRINT_VTABLE_ITEM(obj, 0, 0)
obj.foo();
C041 * pt = &obj;
pt->foo();

The results are as follows:

The detail of C041 is 14 b3 45 00 01
obj : objadr:0012F824 vpadr:0012F824 vtadr:0045B314 vtival(0):0041DF1E

We print out the C041 Object memory layout and its virtual table information.

First look at the assembly Code of Obj.foo ():

004230DF lea ecx,[ebp+FFFFF948h]
004230E5 call 0041DF1E

Same as the assembly code produced by the ordinary member function call that was seen in the previous article. This shows that a function call is made through an object, even if the called function is a virtual function and is statically bound, that is, the address of the function is resolved at compile time. There will be no polymorphic behavior to occur.

We tracked it to see the assembly code for the function.

01 004263F0 push ebp
02 004263F1 mov ebp,esp
03 004263F3 sub esp,0CCh
04 004263F9 push ebx
05 004263FA push esi
06 004263FB push edi
07 004263FC push ecx
08 004263FD lea edi,[ebp+FFFFFF34h]
09 00426403 mov ecx,33h
10 00426408 mov eax,0CCCCCCCCh
11 0042640D rep stos dword ptr [edi]
12 0042640F pop ecx
13 00426410 mov dword ptr [ebp-8],ecx
14 00426413 mov eax,dword ptr [ebp-8]
15 00426416 mov byte ptr [eax+4],2
16 0042641A pop edi
17 0042641B pop esi
18 0042641C pop ebx
19 0042641D mov esp,ebp
20 0042641F pop ebp
21 00426420 ret

It is worth noting that line 14th, 15. Line 14th moves the value of this pointer to the EAX register, and the 15th row assigns a value to the first member variable of the class, at which point we see the address of the variable with [eax+4], which skips the 4-byte virtual table pointer at the front of the object layout.