"Turn" C + + virtual function parsing

This article turns from Chenhao (left ear mouse) blog www.coolshell.com.

The article was written a long time ago, last year was written in C + + was fortunate to read, and now think it is quite worth a turn, if there is a certain C + + foundation (especially read the "Deep Exploration C + + object Model") should be able to understand this article more painless. In addition, I deeply admire those who are willing to spend a lot of time and painstaking efforts to write these high-quality articles predecessors.

==========================================================================================

The function of virtual function in C + + is mainly to realize the mechanism of polymorphism. In terms of polymorphism, in short, a pointer to the parent type points to an instance of its child class, and then invokes the member function of the actual subclass through a pointer to the parent class. This technique allows the parent class to have a "multiple form" pointer, which is a generic technique. The so-called generic technology, plainly, is trying to use immutable code to implement a mutable algorithm. For example: template technology, RTTI technology, virtual function technology, either try to do at compile time resolution, or try to achieve runtime resolution.

On the use of virtual functions, I do not do much elaboration here. You can take a look at the relevant C + + books. In this article, I just want to from the virtual function of the implementation mechanism above for everyone a clear analysis.

Of course, the same article appeared on the Internet some, but I always feel that these articles are not very easy to read, large sections of the code, no pictures, no detailed instructions, no comparison, no extrapolate. Not conducive to learning and reading, so this is why I want to write this article. I hope you will give me more advice.

Let's go to the world of virtual functions. virtual function table

Anyone who understands C + + should know that virtual functions are implemented by a virtual function table (virtual table). Referred to as v-table. In this table, the master is the Address table of the virtual function of a class, which solves the problem of inheritance, overwriting, and guarantees the actual function of the real response. Thus, in an instance of a class with virtual functions, the table is assigned to the memory of this instance, so when we manipulate a subclass with a pointer to the parent class, the virtual function table is important, and it is like a map that indicates the function that should actually be called.

Here we focus on this virtual function table. The C + + compiler should be a pointer to the virtual function table that exists in the first place in the object instance (this is to ensure the highest performance of the virtual function table if there are multiple layers of inheritance or multiple inheritance). This means that we get this virtual function table from the address of the object instance, and then we can iterate over the function pointer and call the corresponding function.

Listen to me so much, I can feel it. You may be more disoriented than before. It doesn't matter, the following is the actual example, I believe that smart you see it.

Let's say we have a class like this:

classBase { Public:Virtual voidF () {cout <<"Base::f"<<Endl;}Virtual voidG () {cout <<"base::g"<<Endl;}Virtual voidH () {cout <<"base::h"<<Endl;}};

According to the above, we can get the virtual function table through the example of base. Here is the actual routine:

typedefvoid(*fun) (void); Base b; Fun Pfun=Null;cout<<"virtual function table address:"<< (int*) (&AMP;B) <<Endl;cout<<"virtual function table-First function address:"<< (int*)*(int*) (&AMP;B) <<Endl;//Invoke The first virtual functionPfun= (Fun) * ((int*)*(int*) (&b)); Pfun ();

The actual run-through results are as follows: (Windows xp+vs2003, Linux 2.6.22 + GCC 4.1.3)

virtual function table Address: 0012FED4
virtual function table-First function address: 0044f148
Base::f

With this example, we can see that we can get the address of the virtual function table by forcing the &b into int *, and then, once again, the address of the first virtual function can be obtained, that is, Base::f (), which is verified in the above program (int* Forced to turn into a function pointer). With this example, we know that if you want to invoke Base::g () and Base::h (), the code is as follows:

(Fun) * ((int*) * (int*) (&b) +0);  // base::f () (Fun )* ((int*) * (int*) (&B) +1);  // base::g () (Fun )* ((int*) * (int*) (&B) +2);  // base::h ()

You should understand this time. What the? Still a little dizzy. Also, such code looks too messy. No problem, let me draw a diagram to explain. As shown below:

Note: In the above diagram, I added a node at the end of the virtual function table, which is the end node of the virtual function table, just like the Terminator "/0" of the string, which marks the end of the virtual function table. The value of this end flag is different under different compilers. Under Winxp+vs2003, this value is null. And in Ubuntu 7.10 + Linux 2.6.22 + GCC 4.1.3, this value is if 1, indicating there is also the next virtual function table, if the value is 0, represents the last virtual function table.

Below, I will explain the appearance of the virtual function table when there is no overwrite and overwrite. It is meaningless not to overwrite the virtual function of the parent class. I want to tell the story of the absence of coverage, the main purpose is to give a contrast. In comparison, we can know more clearly the specific implementation of its internal. General Inheritance (no virtual function overrides)

Next, let's look at what the virtual function table looks like when inheriting. Suppose you have an inheritance relationship that looks like this:

Note that in this inheritance relationship, subclasses do not overload functions of any parent class. So, in an instance of a derived class, its virtual function table looks like this:

For example: Derive D; The virtual function table is as follows:

We can see the following points:
1) Virtual functions are placed in the table in the order in which they are declared.
2) The virtual function of the parent class precedes the virtual function of the child class.

I believe that smart you can certainly refer to the previous program, to write a program to verify. General inheritance (with virtual function overrides)

Overriding the virtual function of the parent class is a very obvious thing, otherwise the virtual function becomes meaningless. Let's take a look at what it looks like if a virtual function in a subclass overloads the virtual function of the parent class. Let's say we have an inheritance relationship like the one below.

In order to let you see the effect after the inheritance, in the design of this class, I only covered a function of the parent class: F (). Then, for instances of derived classes, the virtual function table will look like this:

We can see the following points from the table,
1) the covered F () function is placed in the location of the original parent virtual function in the virtual table.
2) functions that are not covered are still.

In this way, we can see that for the following program,

New Derive (); b->f ();

The position of the F () of the virtual function table in memory referred to by B has been replaced by the Derive::f () function address, and derive::f () is called when the actual call occurs. This enables polymorphism. Multiple inheritance (no virtual function overrides)

Next, let's look at the case in multiple inheritance, assuming that there is an inheritance relationship for one of the following classes. Note: The subclass does not have a function that overrides the parent class.

For a virtual function table in a subclass instance, the following looks like this:

We can see:
1) Each parent class has its own virtual table.
2) The member function of the subclass is placed in the table of the first parent class. (The so-called first parent class is judged in order of declaration)

This is done in order to resolve pointers to different parent class types to the same child class instance, and to invoke the actual function. Multiple inheritance (with virtual function overrides)

Let's take a look at the case where virtual function overrides occur.

, we overwrite the F () function of the parent class in the subclass.

The following is a diagram of a virtual function table in a subclass instance:

As we can see, the position of F () in the three parent virtual function table is replaced by the function pointer of the subclass. This allows us to refer to the subclass as a parent of a static type and call F () of the subclass. Such as:

*B1 = &*b2 = &*b3 = &d;b1//derive::f ()B2//  derive::f ()B3//derive::f ()B1//base1::g ()B2//base2::g ()B3//base3::g ()

Security

Every time you write a C + + article, you always have to criticize C + +. This article is no exception. Through the above, I believe we have a more detailed understanding of the virtual function table. Water can carry boat, can also overturn it. Let's take a look at what we can do with a virtual function table. First, access the subclass's own virtual function through a pointer to the parent type

We know that subclasses do not have to reload the virtual functions of the parent class as a meaningless thing. Because polymorphism is also based on function overloading. Although we can see in the above figure that there are derive virtual functions in the virtual table of BASE1, it is not possible to use the following statement to invoke the subclass's own virtual function:

New Derive (); B1->f1 ();  // compilation Error

Any attempt to use a parent pointer to call a member function in a subclass that does not overwrite a parent class is considered illegal by the compiler, so that such a program cannot be compiled at all. But at run time, we can access the virtual function table in a pointer way to violate C + + semantics. (For this attempt, by reading the code in the appendix below, I believe you can do it) ii. accessing virtual functions of Non-public

In addition, if the virtual function of the parent class is private or protected, but these non-public virtual functions also exist in the virtual function table, we can also access the virtual function table in the way of accessing these non-public virtual functions, which is very easy to do.

Such as:

classBase {Private:Virtual voidF () {cout <<"Base::f"<<Endl;}};classDerive: PublicBase{};typedefvoid(*fun) (void);voidMain () {Derive D; Fun Pfun= (Fun) * ((int*)*(int*) (&AMP;D) +0);p fun ();}

Conclusion

C + + This language is a magic language, for programmers, we never seem to understand the language behind what we are doing. To be familiar with this language, we need to understand what's in C + + and what's dangerous in C + +. Otherwise, it's a programming language that moves stones to their feet. Appendix I: View virtual function table in VC

We can expand an instance of the class in the debug state of the VC IDE environment to see the virtual function table (not very complete) Appendix II: Routines

The following is a routine about virtual function table access for multiple inheritance:

#include <iostream>using namespacestd;classBase1 { Public:Virtual voidF () {cout <<"Base1::f"<<Endl;}Virtual voidG () {cout <<"base1::g"<<Endl;}Virtual voidH () {cout <<"base1::h"<<Endl;}};classBase2 { Public:Virtual voidF () {cout <<"Base2::f"<<Endl;}Virtual voidG () {cout <<"base2::g"<<Endl;}Virtual voidH () {cout <<"base2::h"<<Endl;}};classBASE3 { Public:Virtual voidF () {cout <<"Base3::f"<<Endl;}Virtual voidG () {cout <<"base3::g"<<Endl;}Virtual voidH () {cout <<"base3::h"<<Endl;}};classDerive: PublicBASE1, PublicBase2, PublicBASE3 { Public:Virtual voidF () {cout <<"Derive::f"<<Endl;}Virtual voidG1 () {cout <<"DERIVE::G1"<<Endl;}}; typedefvoid(*fun) (void);intMain () {fun Pfun=null;derive D;int* * Pvtab = (int* *) &D;//Base1 ' s vtable//Pfun = (fun) * ((int*) * (int*) ((int*) &d+0) +0);Pfun= (fun) pvtab[0][0];p fun ();//Pfun = (fun) * ((int*) * (int*) ((int*) &d+0) +1);Pfun= (fun) pvtab[0][1];p fun ();//Pfun = (fun) * ((int*) * (int*) ((int*) &d+0) +2);Pfun= (fun) pvtab[0][2];p fun ();//Derive ' s vtable//Pfun = (fun) * ((int*) * (int*) ((int*) &d+0) +3);Pfun= (fun) pvtab[0][3];p fun ();//The tail of the vtablePfun= (fun) pvtab[0][4];cout<<pFun<<Endl;//Base2 ' s vtable//Pfun = (fun) * ((int*) * (int*) ((int*) &d+1) +0);Pfun= (fun) pvtab[1][0];p fun ();//Pfun = (fun) * ((int*) * (int*) ((int*) &d+1) +1);Pfun= (fun) pvtab[1][1];p fun ();p Fun= (fun) pvtab[1][2];p fun ();//The tail of the vtablePfun= (fun) pvtab[1][3];cout<<pFun<<Endl;//Base3 ' s vtable//Pfun = (fun) * ((int*) * (int*) ((int*) &d+1) +0);Pfun= (fun) pvtab[2][0];p fun ();//Pfun = (fun) * ((int*) * (int*) ((int*) &d+1) +1);Pfun= (fun) pvtab[2][1];p fun ();p Fun= (fun) pvtab[2][2];p fun ();//The tail of the vtablePfun= (fun) pvtab[2][3];cout<<pFun<<Endl;return 0;}

Note: In this article, all the examples are running on a 32-bit machine.

(End of full text)

"Turn" C + + virtual function parsing