Thinking from a pen mistake

A colleague in the Group shared the technology a few days ago. One of the questions was raised: What would happen if a new object but a delete object was written as Delete. Some colleagues found in the actual test that if the debug version is used, an exception is thrown, but the release repeatedly executes the destructor of the object. The debug release version has an exception and is easy to understand. This is not the case, but why does the release version continuously execute the Destructor? If so, how many times will the execution end? The author makes a simple analysis and finds the cause. Before solving this problem, let's take a look at the following code and memory layout:

#include "stdafx.h"#include <windows.h>DWORDLONG g_dwTestCount = 0;class CTest{public:~CTest(){         ++g_dwTestCount;}int i;};int _tmain(int argc, _TCHAR* argv[]){CTest *pTestAry = new CTest[10];delete[] pTestAry;CTest *pTest = new CTest;printf("%p\n",pTest);delete [] pTest;printf("%x",g_dwTestCount);getchar();return 0;}

When the program has executed ctest * ptestary = new ctest [10];, view the ptestary memory found data as follows:

The front-end CD part is the available memory allocated to the user by the system. The red part indicates the number of the following elements, and the Delete [] part will first read the value here, obviously, in the actually allocated heap memory, the first four represent the number of allocated elements, but they do not have this identifier for a new object. But what if I modify this value? In the actual test, the value in the memory is directly modified before the delete operation, and the result shows how many times the Destructor will be executed.

I believe that you can already think of the release situation, because the Heap Structure of the release version is different from that of the debug version. In actual debugging, there are no four FD cases. The previous number is not fixed, so the number of times the Destructor is executed is not fixed. However, considering that the maximum value of the 4-byte unsigned integer is 4294967295, therefore, the number of executions is between 0 and '(* worker _ worker *)′

Figure: execution results and memory data of the release version with windbg:

 

Thinking from a pen mistake