C++对象模型探索--04数据语义

数据成员布局

1. 普通成员变量的存储顺序是按照在类中定义的顺序从上到下来的
2. 类定义中public、private、protected的数量不影响类对象的sizeof
3. 边界调整，字节对齐

数据成员存取

• 静态成员变量的存取
  类的静态成员变量可以当作一个全局变量，它只是在类的空间内可见，引用时用类名::静态成员变量名，静态成员变量只有一个实体，保存在可执行文件的数据段。

class A 
{
public:
    int m_a;
    int m_b;
    static int m_c; // 声明
}

int A::m_c = 0; // 定义
1
2
3
4
5
6
7
8
9

• 非静态的成员变量的存取
  对于普通成员变量的访问，编译器是把类对象的首地址加上成员变量的偏移值

单一继承下的数据成员布局

• 一个子类对象所包含的内容是它自己的成员+父类的成员的总和
• 从偏移值看，父类成员先出现，然后才是子类成员,即子类对象中包含父类子对象

#include 
#include 

class Base
{
public:
    int m_a;
    int m_b;
};

class Derived : public Base
{
public:
    int m_i;
    int m_j;
};

int main(int argc, char **argv)
{
    // 打印成员变量偏移值
    printf("Base::m_a = %d\n", &Base::m_a);
    printf("Base::m_b = %d\n", &Base::m_b);

    printf("Derived::m_a = %d\n", &Derived::m_a);
    printf("Derived::m_b = %d\n", &Derived::m_b);

    printf("Derived::m_i = %d\n", &Derived::m_i);
    printf("Derived::m_j = %d\n", &Derived::m_j);

    Base b;    // m_a | m_b
    Derived d; // m_a | m_b | m_i | m_j

    return 0;
}  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#include 
#include 

class Base1
{
public:
    int m_a;
    char m_c1;
};

class Base2 : public Base1
{
public:
    char m_c2;
};

class Base3 : public Base2
{
public:
    char m_c3;
};

int main(int argc, char **argv)
{
    Base1 b1; //  8byte: 4 | 1 | 3padding
    Base2 b2; // 12byte: 4 | 1 | 3padding | 1 | 3padding
    Base3 b3; // 12byte: 4 | 1 | 3padding | 1 | 1 | 2padding
	
    printf("sizeof(Base1) = %d\n", sizeof(Base1));
    printf("sizeof(Base2) = %d\n", sizeof(Base2));
    printf("sizeof(Base3) = %d\n", sizeof(Base3));
	// 打印成员变量偏移值
    printf("Base3::m_a = %d\n", &Base3::m_a);
    printf("Base3::m_c1 = %d\n", &Base3::m_c1);
    printf("Base3::m_c2 = %d\n", &Base3::m_c2);
    printf("Base3::m_c3 = %d\n", &Base3::m_c3);

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

输出结果

sizeof(Base1) = 8
sizeof(Base2) = 12
sizeof(Base3) = 12
Base3::m_a = 0
Base3::m_c1 = 4
Base3::m_c2 = 8
Base3::m_c3 = 9
1
2
3
4
5
6
7

单类单继承虚函数下的数据成员布局

单个类带虚函数的数据成员布局

类中引入虚函数时会有额外的成本付出：

1. 编译时编译器会产生虚函数表
2. 对象中会产生虚函数表指针vptr，用以指向虚函数表
3. 增加或扩展构造函数，增加给虚函数表指针vptr，让vptr指向虚函数表
4. 如果多重继承，比如继承2个父类，每个父类都有虚函数的话，每个父类都有vptr，那么继承时，子类会把这2个vptr都继承过来，如果子类还有自己额外的虚函数，子类与第一个基类共用一个vptr

class Base
{
public:
    int m_i;
    int m_j;

    Base() {}
    ~Base(){}
    virtual void func() {}
};
//内存布局为
// vptr | m_i | m_j
1
2
3
4
5
6
7
8
9
10
11
12

单一继承下父类带虚函数的数据成员布局

#include 
#include 

class Base
{
public:
    int m_i;

    Base() {}
    ~Base() {}
    virtual void b_func() {}
};

class Derived : public Base
{
public:
    int m_a;
    int m_b;

    Derived() {}
    ~Derived() {}

    virtual void d_func() {}
};

int main(int argc, char **argv)
{
    printf("sizeof(Base) = %d\n", sizeof(Base));
    printf("sizeof(Derived) = %d\n", sizeof(Derived));
    Base b;
    Derived d;

    printf("Base::m_i = %d\n", &Base::m_i);
    printf("Derived::m_i = %d\n", &Derived::m_i);
    printf("Derived::m_a = %d\n", &Derived::m_a);
    printf("Derived::m_b = %d\n", &Derived::m_b);

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

输出结果为

sizeof(Base) = 16
sizeof(Derived) = 24
Base::m_i = 8
Derived::m_i = 8
Derived::m_a = 12
Derived::m_b = 16

//内存布局为
//Base： vptr | m_i | padding4
//Derived： vptr | m_i | m_a | m_b | padding4
1
2
3
4
5
6
7
8
9
10

单一继承下父类不带虚函数的数据成员布局

#include 
#include 

class Base
{
public:
    int m_i;

    Base() {}
    ~Base() {}
};

class Derived : public Base
{
public:
    int m_a;
    int m_b;

    Derived() {}
    ~Derived() {}

    virtual void d_func() {}
};

int main(int argc, char **argv)
{
    printf("sizeof(Base) = %d\n", sizeof(Base));
    printf("sizeof(Derived) = %d\n", sizeof(Derived));
    Derived d;

    d.m_i = 1;
    d.m_a = 2;
    d.m_b = 3;
    
    printf("Base::m_i = %d\n", &Base::m_i);
    printf("Derived::m_i = %d\n", &Derived::m_i);
    printf("Derived::m_a = %d\n", &Derived::m_a);
    printf("Derived::m_b = %d\n", &Derived::m_b);

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

gdb查看

 gdb main
(gdb) set print pretty on
(gdb) set print object on
(gdb) set print vtbl on
(gdb) b 35
Breakpoint 1 at 0x123f: file main.cpp, line 35.
(gdb) r
sizeof(Base) = 4
sizeof(Derived) = 24

Breakpoint 1, main (argc=1, argv=0x7fffffffdd48) at main.cpp:35
35          printf("Base::m_i = %d\n", &Base::m_i);
(gdb) p/a &d
$1 = 0x7fffffffdc00
(gdb) x/10xw &d
0x7fffffffdc00: 0x55557d40      0x00005555      0x00000001      0x00000002
0x7fffffffdc10: 0x00000003      0x00007fff      0x342a4e00      0xa0066d24
0x7fffffffdc20: 0xf7fb3940      0x00007fff
(gdb) info vtbl d
vtable for 'Derived' @ 0x555555557d40 (subobject @ 0x7fffffffdc00):
[0]: 0x5555555553e4 <Derived::d_func()>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

从gdb调试信息可以看出
d的vptr为0x555555557d40 即从虚拟地址0x7fffffffdc00~0x7fffffffdc07
地址0x7fffffffdc08~0x7fffffffdc0b的值为0x00000001即d.m_i的值
地址0x7fffffffdc0c~0x7fffffffdc0f的值为0x00000002即d.m_a的值
地址0x7fffffffdc10~0x7fffffffdc13的值为0x00000003即d.m_b的值
由此可得d的内存布局为：vptr | m_i | m_a | m_b | padding4

多重继承且父类都带虚函数的数据成员布局

#include 
#include 

class Base1
{
public:
    int m_b1;

    Base1() { printf("    Base1::Base1() 的this指针是:%p\n", this); }
    ~Base1() {}
    virtual void func_b1() {}
};

class Base2
{
public:
    int m_b2;

    Base2() { printf("    Base2::Base2() 的this指针是:%p\n", this); }
    ~Base2() {}
    virtual void func_b2() {}
};

class Derived : public Base1, public Base2
{
public:
    int m_a;
    int m_b;

    Derived()
    {
        printf("Derived::Derived() 的this指针是:%p\n", this);
    }
    ~Derived() {}

    virtual void d_func() {}
};

int main(int argc, char **argv)
{
    printf("sizeof(Base1) = %d\n", sizeof(Base1));
    printf("sizeof(Base2) = %d\n", sizeof(Base2));
    printf("sizeof(Derived) = %d\n", sizeof(Derived));

    Derived d;
    d.m_b1 = 1;
    d.m_b2 = 2;
    d.m_a = 3;
    d.m_b = 4;

    printf("Base1::m_b1 = %d\n", &Base1::m_b1);
    printf("Base2::m_b2 = %d\n", &Base2::m_b2);

    printf("Derived::m_b1 = %d\n", &Derived::m_b1);
    printf("Derived::m_b2 = %d\n", &Derived::m_b2);
    printf("Derived::m_a = %d\n", &Derived::m_a);
    printf("Derived::m_b = %d\n", &Derived::m_b);

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

gdb查看

gdb main

(gdb) set print pretty on
(gdb) set print object on
(gdb) set print vtbl on
(gdb) b 51
Breakpoint 1 at 0x125f: file main.cpp, line 51.
(gdb) r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
sizeof(Base1) = 16
sizeof(Base2) = 16
sizeof(Derived) = 40
    Base1::Base1() 的this指针是:0x7fffffffdbf0
    Base2::Base2() 的this指针是:0x7fffffffdc00
Derived::Derived() 的this指针是:0x7fffffffdbf0

Breakpoint 1, main (argc=1, argv=0x7fffffffdd48) at main.cpp:51
51          printf("Base1::m_b1 = %d\n", &Base1::m_b1);
(gdb) p d
$1 = (Derived) {
  <Base1> = {
    _vptr.Base1 = 0x555555557cd0 <vtable for Derived+16>,
    m_b1 = 1
  }, 
  <Base2> = {
    _vptr.Base2 = 0x555555557cf0 <vtable for Derived+48>,
    m_b2 = 2
  }, 
  members of Derived:
  m_a = 3,
  m_b = 4
}
(gdb) x/10xw &d
0x7fffffffdbf0: 0x55557cd0      0x00005555      0x00000001      0x00007fff
0x7fffffffdc00: 0x55557cf0      0x00005555      0x00000002      0x00000003
0x7fffffffdc10: 0x00000004      0x00007fff
(gdb) info vtbl d
vtable for 'Derived' @ 0x555555557cd0 (subobject @ 0x7fffffffdbf0):
[0]: 0x55555555540c <Base1::func_b1()>
[1]: 0x555555555576 <Derived::d_func()>

vtable for 'Base2' @ 0x555555557cf0 (subobject @ 0x7fffffffdc00):
[0]: 0x555555555476 <Base2::func_b2()>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

从gdb调试信息可以看出
Base1的虚函数指针vptr1和继承Derived的虚函数指针vptr同在0x7fffffffdbf0处，即继承类和多个基类的第一个类共用一个vptr
地址0x7fffffffdbf0~0x7fffffffdbf7的值为0x0000555555557cd0即_vptr.Base1
地址0x7fffffffdbf8~0x7fffffffdbfb的值为0x00000001即m_b1的值
地址0x7fffffffdbfc~0x7fffffffdbff的值为4字节的填充
地址0x7fffffffdc00~0x7fffffffdc07的值为0x0000555555557cf0即_vptr.Base2
地址0x7fffffffdc08~0x7fffffffdc0b的值为0x00000002即m_b2的值
地址0x7fffffffdc0c~0x7fffffffdc0f的值为0x00000003即m_a的值
地址0x7fffffffdc10~0x7fffffffdc13的值为0x00000004即m_b的值
由此可得d的内存布局为：_vptr.Base1 | m_b1 | 4padding |_vptr.Base2 | m_b2 | m_a | m_b | padding4

虚基类问题剖析

虚基类（虚继承/虚派生）问题的提出

传统多重继承的问题：空间问题、效率问题、二义性问题

	|-----------|   |-----------|
	|    Base   |   |    Base   |
	|-----------|   |-----------|
		  |               |
		 \|/             \|/ 
	|----------|     |----------|
	| Derived1 |     | Derived2 |
	|----------|     |----------|
		 |               |	
		 |---------------|           
				|
			   \|/
		   |----------|
		   |     C    |
		   |----------|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

#include 
#include 

class Base
{
public:
    int m_b1;
};

class Derived1 : public Base
{
public:
};

class Derived2 : public Base
{
public:
};

class C : public Derived1, public Derived2
{
};

int main(int argc, char **argv)
{
    printf("sizeof(Base) = %ld\n", sizeof(Base));
    printf("sizeof(Derived1) = %ld\n", sizeof(Derived1));
    printf("sizeof(Derived2) = %ld\n", sizeof(Derived2));
    printf("sizeof(C) = %ld\n", sizeof(C));

    C c; // c的内存布局为：m_b1 | m_b1
    c.Derived1::m_b1 = 1;
    c.Derived2::m_b1 = 1;
    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

虚基类初探

虚基类表vbtable（virtual base table）
虚基类表指针vbptr（virtual base table pointer）

2层结构时虚基类表内容分析

示例1

			|-----------|
			|    Base   |
			|-----------|
		          | 
		   ---------------
virtual   |               |  virtual
		 \|/             \|/ 
	|----------|     |----------|
	| Derived1 |     | Derived2 |
	|----------|     |----------|
1
2
3
4
5
6
7
8
9
10
11

#include 
#include 

class Base
{
public:
    int m_b;
};

class Derived1 : virtual public Base
{
public:
    int m_d1;
};

class Derived2 : virtual public Base
{
public:
    int m_d2;
};

int main(int argc, char **argv)
{
    printf("sizeof(Base) = %ld\n", sizeof(Base));
    printf("sizeof(Derived1) = %ld\n", sizeof(Derived1));

    Derived1 d1;
    d1.m_b = 0x1111;
    d1.m_d1 = 0x2222;

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

gdb查看

gdb main
(gdb) b 31
Breakpoint 1 at 0x1230: file main.cpp, line 32.
(gdb) set print pretty on
(gdb) r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
sizeof(Base) = 4
sizeof(Derived1) = 16

Breakpoint 1, main (argc=1, argv=0x7fffffffdd48) at main.cpp:32
32          return 0;
(gdb) p &d1
$1 = (Derived1 *) 0x7fffffffdc10
(gdb) p d1
$2 = {
  <Base> = {
    m_b = 4369
  }, 
  members of Derived1:
  _vptr.Derived1 = 0x555555557d58 <VTT for Derived1>,
  m_d1 = 8738
}
(gdb) x/2xg 0x7fffffffdc10
0x7fffffffdc10: 0x0000555555557d58      0x0000111100002222
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

其中：
sizeof(Derived1) = 16, &d=0x7fffffffdc10
0x7fffffffdc10~0x7fffffffdc17内容为0x0000555555557d58即_vptr.Derived1
0x7fffffffdc18~0x7fffffffdc1b内容为00002222即d1.m_d1 = 0x2222;
0x7fffffffdc1c~0x7fffffffdc1f内容为00001111即d1.m_b = 0x1111;
由此可得d1的内存布局为： vptr | m_d1 | m_b(虚基类对象大小)
virtual虚继承之后，Derived1、Derived2会被编译器插入一个虚基类表指针

示例2

	|-----------|   |-----------|
	|   Base1   |   |    Base2  |
	|-----------|   |-----------|
 virtual |               | public
		 |---------------|           
				|
			   \|/
		   |----------|
		   | Derived1 |
		   |----------|
1
2
3
4
5
6
7
8
9
10
11

#include 
#include 

class Base1
{
public:
    int m_b1;
};

class Base2
{
public:
    int m_b2;
};

class Derived1 : virtual public Base1, public Base2
{
public:
    int m_d1;
};

int main(int argc, char **argv)
{
    printf("sizeof(Base1) = %ld\n", sizeof(Base1));
    printf("sizeof(Base2) = %ld\n", sizeof(Base2));
    printf("sizeof(Derived1) = %ld\n", sizeof(Derived1));

    Derived1 d1;
    d1.m_b1 = 0xb1;
    d1.m_b2 = 0xb2;
    d1.m_d1 = 0x2222;

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

gdb查看

gdb main 
(gdb) b 33
Breakpoint 1 at 0x1237: file main.cpp, line 33.
(gdb) set print pretty on
(gdb) r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
sizeof(Base1) = 4
sizeof(Base2) = 4
sizeof(Derived1) = 24

Breakpoint 1, main (argc=1, argv=0x7fffffffdd48) at main.cpp:33
warning: Source file is more recent than executable.
33          return 0;
(gdb) p d1
$1 = {
  <Base1> = {
    m_b1 = 177
  }, 
  <Base2> = {
    m_b2 = 178
  }, 
  members of Derived1:
  _vptr.Derived1 = 0x555555557d38 <VTT for Derived1>,
  m_d1 = 8738
}
(gdb) p d1
$2 = {
  <Base1> = {
    m_b1 = 177
  }, 
  <Base2> = {
    m_b2 = 178
  }, 
  members of Derived1:
  _vptr.Derived1 = 0x555555557d38 <VTT for Derived1>,
  m_d1 = 8738
}
(gdb) p &d1
$3 = (Derived1 *) 0x7fffffffdc10
(gdb) x/6xw 0x7fffffffdc10
0x7fffffffdc10: 0x55557d38      0x00005555      0x000000b2      0x00002222
0x7fffffffdc20: 0x000000b1      0x00007fff
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

其中：
sizeof(Derived1) = 24, &d1=0x7fffffffdc10
0x7fffffffdc10~0x7fffffffdc17内容为0x0000555555557d38即_vptr.Derived1
0x7fffffffdc18~0x7fffffffdc1b内容为0x000000b2即d1.m_b2 = 0x000000b2;
0x7fffffffdc1c~0x7fffffffdc1f内容为0x00002222即d1.m_d1 = 0x2222;
0x7fffffffdc20~0x7fffffffdc23内容为0x000000b1即d1.m_b1 = 0x000000b1;
由此可得d1的内存布局为： vptr | m_b2 | m_d1 | m_b1(虚基类对象大小) | padding4 |

3层结构时虚基类表内容分析

			|-----------|
			|    Base   |
			|-----------|
		          | 
		   ---------------
virtual   |               |  virtual
		 \|/             \|/ 
	|----------|     |----------|
	| Derived1 |     | Derived2 |
	|----------|     |----------|
		 |               |	
		 |---------------|           
				|
			   \|/
		   |----------|
		   |     C    |
		   |----------|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include 
#include 

class Base
{
public:
    int m_b1;
};

class Derived1 : virtual public Base
{
public:
    int m_d1;
};

class Derived2 : virtual public Base
{
public:
    int m_d2;
};

class C : public Derived1, public Derived2
{
public:
    int m_c;
};

int main(int argc, char **argv)
{
    printf("sizeof(Base) = %ld\n", sizeof(Base));
    printf("sizeof(Derived1) = %ld\n", sizeof(Derived1));
    printf("sizeof(Derived2) = %ld\n", sizeof(Derived2));
    printf("sizeof(C) = %ld\n", sizeof(C));

    C c;// c的内存布局为：vbptr1(from Derived1) | m_d1 | vbptr2(from Derived2) | m_d2 | m_c | m_b1(虚基类对象)
    c.m_b1 = 0xb1;
    c.m_d1 = 0xd1;
    c.m_d2 = 0xd2;
    c.m_c = 0xc;

    return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

gdb查看

 gdb main
(gdb) b 41
Breakpoint 1 at 0x1257: file main.cpp, line 41.
(gdb) r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
sizeof(Base) = 4
sizeof(Derived1) = 16
sizeof(Derived2) = 16
sizeof(C) = 40

Breakpoint 1, main (argc=1, argv=0x7fffffffdd48) at main.cpp:41
41          return 0;
(gdb) p &c
$1 = (C *) 0x7fffffffdc00
(gdb) set print pretty on
(gdb) p c
$3 = {
  <Derived1> = {
    <Base> = {
      m_b1 = 177
    }, 
    members of Derived1:
    _vptr.Derived1 = 0x555555557c98 <vtable for C+24>,
    m_d1 = 209
  }, 
  <Derived2> = {
    members of Derived2:
    _vptr.Derived2 = 0x555555557cb0 <VTT for C>,
    m_d2 = 210
  }, 
  members of C:
  m_c = 12
}
(gdb) x/10xw 0x7fffffffdc00
0x7fffffffdc00: 0x55557c98      0x00005555      0x000000d1        0x00007fff
0x7fffffffdc10: 0x55557cb0      0x00005555      0x000000d2        0x0000000c
0x7fffffffdc20: 0x000000b1      0x00007fff
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

其中：
sizeof© = 40, &c=0x7fffffffdc00
0x7fffffffdc00~0x7fffffffdc07内容为0x0000555555557c98即_vptr.Derived1 = 0x555555557c98,由于多继承派生类与第一个基类共用一个vptr,即c的vptr=0x555555557c98
0x7fffffffdc08~0x7fffffffdc0b内容为0x000000d1即c.m_d1 = 0x000000d1;
0x7fffffffdc10~0x7fffffffdc17内容为0x0000555555557cb0即_vptr.Derived2 = 0x555555557cb0;
0x7fffffffdc18~0x7fffffffdc1b内容为0x000000d2即c.m_d2 = 0xd2;
0x7fffffffdc1c~0x7fffffffdc1f内容为0x0000000c即c.m_c = 0xc;
0x7fffffffdc20~0x7fffffffdc23内容为0x000000b1即c.m_b1 = 0xb1;
由此可得c的内存布局为： vptr1 | m_d1 | padding4 | vptr2 | m_d2 | m_c | m_b1(虚基类对象大小) | padding4 |