c++对象模型

最近看了本 《c++ 对象模型》的书，收益良多。讲了c++对象中成员的分布，虚函数表等。

先看图

类的层次结构



dev类等成员分布



下面是代码，获取成员数据都是通过内存偏移，所以即使是父类的私有方法获成员，都可以访问到，只能说指针太强大了

typedef void(*Fun)(void);   //void类型的函数指针 //适用于无实例对象，例如全局函数等

// ------------------------------------------------ test1 -------------------------
class Tmp
{
public:
short a;
int b;
double c;
};

class Base
{
public:
Base():base1Num(123) { cout << "Base::Base" << endl; }
virtual ~Base() { cout << "Base::~Base" << endl; }
virtual void f() { cout << "Base::f" << endl; }
virtual void g() { cout << "Base::g" << endl; }
virtual void h() { cout << "Base::h" << endl; }
void ooo(){ cout << "Base::ooo" << endl; }
void ppp(){ cout << "Base::ppp" << endl; }

private:
virtual void j() { cout << "Base::j" << endl; }
int base1Num;
};

class Base2
{
public:
Base2():base2Num(456) { cout << "Base2::Base2" << endl; }
virtual ~Base2() { cout << "Base2::~Base2" << endl; }
virtual void x() { cout << "Base2::x" << endl; }
virtual void y() { cout << "Base2::y" << endl; }
void rrr() { cout << "Base2::rrr" << endl; }
void sss() { cout << "Base2::sss" << endl; }

private:
virtual void z() { cout << "Base2::z" << endl; }
int base2Num;
};

class dev : public Base , public Base2
{
public:
virtual void f() { cout << "dev::f" << endl; }
virtual void k() { cout << "dev::k" << endl; }
virtual void z() { cout << "dev::z" << endl; }

public:
int num;
char* str;
dev* child;
Tmp tmp;
//double price; //加了个8个字节的double，字节对齐时会占用更多字节，对象大小增大
};

void testVirtualTable()
{
//Base b1;
//b1.j();            //compile error

dev d;
d.num = 100;
d.str = "hello world";
//d.child = new dev;
//d.child->num = 500;

d.tmp.a = 31;
d.tmp.b = 777;
d.tmp.c = 888;
//d.f();             //compile error

cout << "虚函数表地址：" << (int*)(&d) << endl;
cout << "虚函数表 — 第一个函数地址：" << (int*)*(int*)(&d) << endl;
printf("\n");

//通过函数指针访问到私有的j(), j()对于对象来讲本来是不可见的,指针太强大
Fun pFun2 = nullptr;
//第一个虚函数表指针指向
//pFun2 = (Fun)*((int*)*(int*)(&d) + 0); //Base::~Base //析构不能调
//pFun2();
pFun2 = (Fun)*((int*)*(int*)(&d) + 1); //dev::f //dev重写Base的f
pFun2();
pFun2 = (Fun)*((int*)*(int*)(&d) + 2); //Base::g
pFun2();
pFun2 = (Fun)*((int*)*(int*)(&d) + 3); //Base::h
pFun2();
pFun2 = (Fun)*((int*)*(int*)(&d) + 4); //Base::j
pFun2();
pFun2 = (Fun)*((int*)*(int*)(&d) + 5); //dev::k
pFun2();
//Base base1Num的存储偏移在虚函数表指针的下4个字节
int base1Num = (int)*((int*)(&d) + 1);
printf("--- base1Num:%d\n", base1Num); //123
printf("\n");

//第二个虚函数表指针指向
//pFun2 = (Fun)*((int*)*((int*)(&d) + 1) + 0);  //Base2::~Base2 //析构不能调
//pFun2();
pFun2 = (Fun)*((int*)*((int*)(&d) + 2) + 1);//Base2::y
pFun2();
pFun2 = (Fun)*((int*)*((int*)(&d) + 2) + 2); //Base2::y
pFun2();
pFun2 = (Fun)*((int*)*((int*)(&d) + 2) + 3); //dev::z //dev重写Base2的z
pFun2();
//Base2 base2Num的存储偏移在虚函数表指针的下4个字节
int base2Num = (int)*((int*)(&d) + 3);
printf("--- base2Num:%d\n", base2Num); //456
printf("\n");

//通过地址获取成员变量
int num = (int)*((int*)(&d) + 4);
char* str = (char*)*((int*)(&d) + 5);
printf("--- dev.num:%d\n", num);
printf("--- dev.str:%s\n", str);
printf("\n");

//(base vtp + base1num + base2 vtp + base2num + dev::num + dev::str + dev::dev*) * 4 = 28
//printf("--- dev size : %d\n", sizeof(dev)); //28
//如果 dev 加多个 double 型成员，因为字节对齐是更具最大元素来对界，会得到sizeof为40，参考ByteAlign.cpp;

printf("--- Tmp size : %d\n", sizeof(Tmp));
printf("--- dev size : %d\n", sizeof(dev));

printf("--- str:0x%x\n", str);
Tmp* tmp = (Tmp*)&(*((int*)(&d) + 7));
printf("--- tmp:0x%x\n", tmp);
printf("--- tmp.b:%d\n", tmp->b);

short tmpA = (short)*((int*)(&d) + 7);
printf("--- tmpA:%d\n", (int)tmpA);
int tmpB = (int)*((int*)(&d) + 8);
printf("--- tmpB:%d\n", tmpB);
int tmpC = (int)*((int*)(&d) + 9);
printf("--- tmpC:%d\n", tmp->c);

//dev* child = (dev*)*((int*)(&d) + 4);
//printf("--- child num:%d\n", child->num);

//Base* b2 = new dev();
////b2->k();           //compile error,父类指针无法call子类特有的虚函数

////通过函数指针访问到子类特有的虚函数k(), 指针太强大
//Fun pFun3 = (Fun)*((int*)*(int*)b2 + 4);
//pFun3();
}

运行结果