C++ 智能指针（shared_ptr/weak_ptr）源码分析

C++11目前已经引入了unique_ptr, shared_ptr, weak_ptr等智能指针以及相关的模板类enable_shared_from_this等。shared_ptr实现了C++中的RAII机制，它不仅仅具有一般指针(build-in/raw)的特性，更重要的是它可以自动管理用户在堆上创建的对象的生命周期，让用户不用负责内存回收，避免内存泄漏。一般的智能指针都定义为一个模板类，它的类型由被管理的对象类型初始化，内部包含了指向该对象的指针以及指向辅助生命周期管理的管理对象的指针。

C++11中unique_ptr, shared_ptr, weak_ptr的特点如下：

unique_ptr独享被管理对象，同一时刻只能有一个unique_ptr拥有对象的所有权，当其被赋值时对象的所有权也发生转移，当其被销毁时被管理对象也自动被销毁
shared_ptr共享被管理对象，同一时刻可以有多个shared_ptr拥有对象的所有权，当最后一个shared_ptr对象销毁时，被管理对象自动销毁
weak_ptr不拥有对象的所有权，但是它可以判断对象是否存在和返回指向对象的shared_ptr类型指针；它的用途之一是解决了多个对象内部含有shared_ptr循环指向，导致对象无法释放的问题

那么C++中是怎么实现这些特性的呢，我们可以在gcc的源码目录（gcc-6.1.0\gcc-6.1.0\libstdc++-v3\include\tr1）中找到智能指针的一种实现，通过分析其源码找到答案（其它boost::shared_ptr等的实现也是类似的）。gcc中相关智能指针的实现源码如下：

// <tr1/shared_ptr.h> -*- C++ -*-

// Copyright (C) 2007-2016 Free Software Foundation, Inc.
//
// This file is part of the GNU ISO C++ Library.  This library is free
// software; you can redistribute it and/or modify it under the
// terms of the GNU General Public License as published by the
// Free Software Foundation; either version 3, or (at your option)
// any later version.

// This library is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.

// Under Section 7 of GPL version 3, you are granted additional
// permissions described in the GCC Runtime Library Exception, version
// 3.1, as published by the Free Software Foundation.

// You should have received a copy of the GNU General Public License and
// a copy of the GCC Runtime Library Exception along with this program;
// see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
// <http://www.gnu.org/licenses/>.

//  shared_count.hpp
//  Copyright (c) 2001, 2002, 2003 Peter Dimov and Multi Media Ltd.

//  shared_ptr.hpp
//  Copyright (C) 1998, 1999 Greg Colvin and Beman Dawes.
//  Copyright (C) 2001, 2002, 2003 Peter Dimov

//  weak_ptr.hpp
//  Copyright (C) 2001, 2002, 2003 Peter Dimov

//  enable_shared_from_this.hpp
//  Copyright (C) 2002 Peter Dimov

// Distributed under the Boost Software License, Version 1.0. (See
// accompanying file LICENSE_1_0.txt or copy at
// http://www.boost.org/LICENSE_1_0.txt) 
// GCC Note:  based on version 1.32.0 of the Boost library.

/** @file tr1/shared_ptr.h
*  This is an internal header file, included by other library headers.
*  Do not attempt to use it directly. @headername{tr1/memory}
*/

#ifndef _TR1_SHARED_PTR_H
#define _TR1_SHARED_PTR_H 1

namespace std _GLIBCXX_VISIBILITY(default)
{
namespace tr1
{
_GLIBCXX_BEGIN_NAMESPACE_VERSION

/**
*  @brief  Exception possibly thrown by @c shared_ptr.
*  @ingroup exceptions
*/
class bad_weak_ptr : public std::exception
{
public:
virtual char const*
what() const throw()
{ return "tr1::bad_weak_ptr"; }
};

// Substitute for bad_weak_ptr object in the case of -fno-exceptions.
inline void
__throw_bad_weak_ptr()
{ _GLIBCXX_THROW_OR_ABORT(bad_weak_ptr()); }

using __gnu_cxx::_Lock_policy;
using __gnu_cxx::__default_lock_policy;
using __gnu_cxx::_S_single;
using __gnu_cxx::_S_mutex;
using __gnu_cxx::_S_atomic;

// Empty helper class except when the template argument is _S_mutex.
template<_Lock_policy _Lp>
class _Mutex_base
{
protected:
// The atomic policy uses fully-fenced builtins, single doesn't care.
enum { _S_need_barriers = 0 };
};

template<>
class _Mutex_base<_S_mutex>
: public __gnu_cxx::__mutex
{
protected:
// This policy is used when atomic builtins are not available.
// The replacement atomic operations might not have the necessary
// memory barriers.
enum { _S_need_barriers = 1 };
};

template<_Lock_policy _Lp = __default_lock_policy>
class _Sp_counted_base
: public _Mutex_base<_Lp>
{
public:
_Sp_counted_base()
: _M_use_count(1), _M_weak_count(1) { }

virtual
~_Sp_counted_base() // nothrow
{ }

// Called when _M_use_count drops to zero, to release the resources
// managed by *this.
virtual void
_M_dispose() = 0; // nothrow

// Called when _M_weak_count drops to zero.
virtual void
_M_destroy() // nothrow
{ delete this; }

virtual void*
_M_get_deleter(const std::type_info&) = 0;

void
_M_add_ref_copy()
{ __gnu_cxx::__atomic_add_dispatch(&_M_use_count, 1); }

void
_M_add_ref_lock();

void
_M_release() // nothrow
{
// Be race-detector-friendly.  For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_use_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_use_count, -1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_use_count);
_M_dispose();
// There must be a memory barrier between dispose() and destroy()
// to ensure that the effects of dispose() are observed in the
// thread that runs destroy().
// See http://gcc.gnu.org/ml/libstdc++/2005-11/msg00136.html if (_Mutex_base<_Lp>::_S_need_barriers)
{
__atomic_thread_fence (__ATOMIC_ACQ_REL);
}

// Be race-detector-friendly.  For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_weak_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_weak_count,
-1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_weak_count);
_M_destroy();
}
}
}

void
_M_weak_add_ref() // nothrow
{ __gnu_cxx::__atomic_add_dispatch(&_M_weak_count, 1); }

void
_M_weak_release() // nothrow
{
// Be race-detector-friendly. For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_weak_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_weak_count, -1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_weak_count);
if (_Mutex_base<_Lp>::_S_need_barriers)
{
// See _M_release(),
// destroy() must observe results of dispose()
__atomic_thread_fence (__ATOMIC_ACQ_REL);
}
_M_destroy();
}
}

long
_M_get_use_count() const // nothrow
{
// No memory barrier is used here so there is no synchronization
// with other threads.
return const_cast<const volatile _Atomic_word&>(_M_use_count);
}

private:
_Sp_counted_base(_Sp_counted_base const&);
_Sp_counted_base& operator=(_Sp_counted_base const&);

_Atomic_word  _M_use_count;     // #shared
_Atomic_word  _M_weak_count;    // #weak + (#shared != 0)
};

template<>
inline void
_Sp_counted_base<_S_single>::
_M_add_ref_lock()
{
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_use_count, 1) == 0)
{
_M_use_count = 0;
__throw_bad_weak_ptr();
}
}

template<>
inline void
_Sp_counted_base<_S_mutex>::
_M_add_ref_lock()
{
__gnu_cxx::__scoped_lock sentry(*this);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_use_count, 1) == 0)
{
_M_use_count = 0;
__throw_bad_weak_ptr();
}
}

template<>
inline void
_Sp_counted_base<_S_atomic>::
_M_add_ref_lock()
{
// Perform lock-free add-if-not-zero operation.
_Atomic_word __count = _M_use_count;
do
{
if (__count == 0)
__throw_bad_weak_ptr();
// Replace the current counter value with the old value + 1, as
// long as it's not changed meanwhile.
}
while (!__atomic_compare_exchange_n(&_M_use_count, &__count, __count + 1,
true, __ATOMIC_ACQ_REL,
__ATOMIC_RELAXED));
}

template<typename _Ptr, typename _Deleter, _Lock_policy _Lp>
class _Sp_counted_base_impl
: public _Sp_counted_base<_Lp>
{
public:
// Precondition: __d(__p) must not throw.
_Sp_counted_base_impl(_Ptr __p, _Deleter __d)
: _M_ptr(__p), _M_del(__d) { }

virtual void
_M_dispose() // nothrow
{ _M_del(_M_ptr); }

virtual void*
_M_get_deleter(const std::type_info& __ti)
{
#if __cpp_rtti
return __ti == typeid(_Deleter) ? &_M_del : 0;
#else
return 0;
#endif
}

private:
_Sp_counted_base_impl(const _Sp_counted_base_impl&);
_Sp_counted_base_impl& operator=(const _Sp_counted_base_impl&);

_Ptr      _M_ptr;  // copy constructor must not throw
_Deleter  _M_del;  // copy constructor must not throw
};

template<_Lock_policy _Lp = __default_lock_policy>
class __weak_count;

template<typename _Tp>
struct _Sp_deleter
{
typedef void result_type;
typedef _Tp* argument_type;
void operator()(_Tp* __p) const { delete __p; }
};

template<_Lock_policy _Lp = __default_lock_policy>
class __shared_count
{
public:
__shared_count()
: _M_pi(0) // nothrow
{ }

template<typename _Ptr>
__shared_count(_Ptr __p) : _M_pi(0)
{
__try
{
typedef typename std::tr1::remove_pointer<_Ptr>::type _Tp;
_M_pi = new _Sp_counted_base_impl<_Ptr, _Sp_deleter<_Tp>, _Lp>(
__p, _Sp_deleter<_Tp>());
}
__catch(...)
{
delete __p;
__throw_exception_again;
}
}

template<typename _Ptr, typename _Deleter>
__shared_count(_Ptr __p, _Deleter __d) : _M_pi(0)
{
__try
{
_M_pi = new _Sp_counted_base_impl<_Ptr, _Deleter, _Lp>(__p, __d);
}
__catch(...)
{
__d(__p); // Call _Deleter on __p.
__throw_exception_again;
}
}

// Special case for auto_ptr<_Tp> to provide the strong guarantee.
template<typename _Tp>
explicit
__shared_count(std::auto_ptr<_Tp>& __r)
: _M_pi(new _Sp_counted_base_impl<_Tp*,
_Sp_deleter<_Tp>, _Lp >(__r.get(), _Sp_deleter<_Tp>()))
{ __r.release(); }

// Throw bad_weak_ptr when __r._M_get_use_count() == 0.
explicit
__shared_count(const __weak_count<_Lp>& __r);

~__shared_count() // nothrow
{
if (_M_pi != 0)
_M_pi->_M_release();
}

__shared_count(const __shared_count& __r)
: _M_pi(__r._M_pi) // nothrow
{
if (_M_pi != 0)
_M_pi->_M_add_ref_copy();
}

__shared_count&
operator=(const __shared_count& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != _M_pi)
{
if (__tmp != 0)
__tmp->_M_add_ref_copy();
if (_M_pi != 0)
_M_pi->_M_release();
_M_pi = __tmp;
}
return *this;
}

void
_M_swap(__shared_count& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
__r._M_pi = _M_pi;
_M_pi = __tmp;
}

long
_M_get_use_count() const // nothrow
{ return _M_pi != 0 ? _M_pi->_M_get_use_count() : 0; }

bool
_M_unique() const // nothrow
{ return this->_M_get_use_count() == 1; }

friend inline bool
operator==(const __shared_count& __a, const __shared_count& __b)
{ return __a._M_pi == __b._M_pi; }

friend inline bool
operator<(const __shared_count& __a, const __shared_count& __b)
{ return std::less<_Sp_counted_base<_Lp>*>()(__a._M_pi, __b._M_pi); }

void*
_M_get_deleter(const std::type_info& __ti) const
{ return _M_pi ? _M_pi->_M_get_deleter(__ti) : 0; }

private:
friend class __weak_count<_Lp>;

_Sp_counted_base<_Lp>*  _M_pi;
};

template<_Lock_policy _Lp>
class __weak_count
{
public:
__weak_count()
: _M_pi(0) // nothrow
{ }

__weak_count(const __shared_count<_Lp>& __r)
: _M_pi(__r._M_pi) // nothrow
{
if (_M_pi != 0)
_M_pi->_M_weak_add_ref();
}

__weak_count(const __weak_count<_Lp>& __r)
: _M_pi(__r._M_pi) // nothrow
{
if (_M_pi != 0)
_M_pi->_M_weak_add_ref();
}

~__weak_count() // nothrow
{
if (_M_pi != 0)
_M_pi->_M_weak_release();
}

__weak_count<_Lp>&
operator=(const __shared_count<_Lp>& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != 0)
__tmp->_M_weak_add_ref();
if (_M_pi != 0)
_M_pi->_M_weak_release();
_M_pi = __tmp;
return *this;
}

__weak_count<_Lp>&
operator=(const __weak_count<_Lp>& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != 0)
__tmp->_M_weak_add_ref();
if (_M_pi != 0)
_M_pi->_M_weak_release();
_M_pi = __tmp;
return *this;
}

void
_M_swap(__weak_count<_Lp>& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
__r._M_pi = _M_pi;
_M_pi = __tmp;
}

long
_M_get_use_count() const // nothrow
{ return _M_pi != 0 ? _M_pi->_M_get_use_count() : 0; }

friend inline bool
operator==(const __weak_count<_Lp>& __a, const __weak_count<_Lp>& __b)
{ return __a._M_pi == __b._M_pi; }

friend inline bool
operator<(const __weak_count<_Lp>& __a, const __weak_count<_Lp>& __b)
{ return std::less<_Sp_counted_base<_Lp>*>()(__a._M_pi, __b._M_pi); }

private:
friend class __shared_count<_Lp>;

_Sp_counted_base<_Lp>*  _M_pi;
};

// now that __weak_count is defined we can define this constructor:
template<_Lock_policy _Lp>
inline
__shared_count<_Lp>::
__shared_count(const __weak_count<_Lp>& __r)
: _M_pi(__r._M_pi)
{
if (_M_pi != 0)
_M_pi->_M_add_ref_lock();
else
__throw_bad_weak_ptr();
}

// Forward declarations.
template<typename _Tp, _Lock_policy _Lp = __default_lock_policy>
class __shared_ptr;

template<typename _Tp, _Lock_policy _Lp = __default_lock_policy>
class __weak_ptr;

template<typename _Tp, _Lock_policy _Lp = __default_lock_policy>
class __enable_shared_from_this;

template<typename _Tp>
class shared_ptr;

template<typename _Tp>
class weak_ptr;

template<typename _Tp>
class enable_shared_from_this;

// Support for enable_shared_from_this.

// Friend of __enable_shared_from_this.
template<_Lock_policy _Lp, typename _Tp1, typename _Tp2>
void
__enable_shared_from_this_helper(const __shared_count<_Lp>&,
const __enable_shared_from_this<_Tp1,
_Lp>*, const _Tp2*);

// Friend of enable_shared_from_this.
template<typename _Tp1, typename _Tp2>
void
__enable_shared_from_this_helper(const __shared_count<>&,
const enable_shared_from_this<_Tp1>*,
const _Tp2*);

template<_Lock_policy _Lp>
inline void
__enable_shared_from_this_helper(const __shared_count<_Lp>&, ...)
{ }

struct __static_cast_tag { };
struct __const_cast_tag { };
struct __dynamic_cast_tag { };

// A smart pointer with reference-counted copy semantics.  The
// object pointed to is deleted when the last shared_ptr pointing to
// it is destroyed or reset.
template<typename _Tp, _Lock_policy _Lp>
class __shared_ptr
{
public:
typedef _Tp   element_type;

__shared_ptr()
: _M_ptr(0), _M_refcount() // never throws
{ }

template<typename _Tp1>
explicit
__shared_ptr(_Tp1* __p)
: _M_ptr(__p), _M_refcount(__p)
{
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
typedef int _IsComplete[sizeof(_Tp1)];
__enable_shared_from_this_helper(_M_refcount, __p, __p);
}

template<typename _Tp1, typename _Deleter>
__shared_ptr(_Tp1* __p, _Deleter __d)
: _M_ptr(__p), _M_refcount(__p, __d)
{
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
// TODO requires _Deleter CopyConstructible and __d(__p) well-formed
__enable_shared_from_this_helper(_M_refcount, __p, __p);
}

//  generated copy constructor, assignment, destructor are fine.

template<typename _Tp1>
__shared_ptr(const __shared_ptr<_Tp1, _Lp>& __r)
: _M_ptr(__r._M_ptr), _M_refcount(__r._M_refcount) // never throws
{ __glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>) }

template<typename _Tp1>
explicit
__shared_ptr(const __weak_ptr<_Tp1, _Lp>& __r)
: _M_refcount(__r._M_refcount) // may throw
{
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
// It is now safe to copy __r._M_ptr, as _M_refcount(__r._M_refcount)
// did not throw.
_M_ptr = __r._M_ptr;
}

#if (__cplusplus < 201103L) || _GLIBCXX_USE_DEPRECATED
// Postcondition: use_count() == 1 and __r.get() == 0
template<typename _Tp1>
explicit
__shared_ptr(std::auto_ptr<_Tp1>& __r)
: _M_ptr(__r.get()), _M_refcount()
{ // TODO requries delete __r.release() well-formed
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
typedef int _IsComplete[sizeof(_Tp1)];
_Tp1* __tmp = __r.get();
_M_refcount = __shared_count<_Lp>(__r);
__enable_shared_from_this_helper(_M_refcount, __tmp, __tmp);
}

#endif

template<typename _Tp1>
__shared_ptr(const __shared_ptr<_Tp1, _Lp>& __r, __static_cast_tag)
: _M_ptr(static_cast<element_type*>(__r._M_ptr)),
_M_refcount(__r._M_refcount)
{ }

template<typename _Tp1>
__shared_ptr(const __shared_ptr<_Tp1, _Lp>& __r, __const_cast_tag)
: _M_ptr(const_cast<element_type*>(__r._M_ptr)),
_M_refcount(__r._M_refcount)
{ }

template<typename _Tp1>
__shared_ptr(const __shared_ptr<_Tp1, _Lp>& __r, __dynamic_cast_tag)
: _M_ptr(dynamic_cast<element_type*>(__r._M_ptr)),
_M_refcount(__r._M_refcount)
{
if (_M_ptr == 0) // need to allocate new counter -- the cast failed
_M_refcount = __shared_count<_Lp>();
}

template<typename _Tp1>
__shared_ptr&
operator=(const __shared_ptr<_Tp1, _Lp>& __r) // never throws
{
_M_ptr = __r._M_ptr;
_M_refcount = __r._M_refcount; // __shared_count::op= doesn't throw
return *this;
}

#if (__cplusplus < 201103L) || _GLIBCXX_USE_DEPRECATED
template<typename _Tp1>
__shared_ptr&
operator=(std::auto_ptr<_Tp1>& __r)
{
__shared_ptr(__r).swap(*this);
return *this;
}
#endif

void
reset() // never throws
{ __shared_ptr().swap(*this); }

template<typename _Tp1>
void
reset(_Tp1* __p) // _Tp1 must be complete.
{
// Catch self-reset errors.
_GLIBCXX_DEBUG_ASSERT(__p == 0 || __p != _M_ptr);
__shared_ptr(__p).swap(*this);
}

template<typename _Tp1, typename _Deleter>
void
reset(_Tp1* __p, _Deleter __d)
{ __shared_ptr(__p, __d).swap(*this); }

// Allow class instantiation when _Tp is [cv-qual] void.
typename std::tr1::add_reference<_Tp>::type
operator*() const // never throws
{
_GLIBCXX_DEBUG_ASSERT(_M_ptr != 0);
return *_M_ptr;
}

_Tp*
operator->() const // never throws
{
_GLIBCXX_DEBUG_ASSERT(_M_ptr != 0);
return _M_ptr;
}

_Tp*
get() const // never throws
{ return _M_ptr; }

// Implicit conversion to "bool"
private:
typedef _Tp* __shared_ptr::*__unspecified_bool_type;

public:
operator __unspecified_bool_type() const // never throws
{ return _M_ptr == 0 ? 0 : &__shared_ptr::_M_ptr; }

bool
unique() const // never throws
{ return _M_refcount._M_unique(); }

long
use_count() const // never throws
{ return _M_refcount._M_get_use_count(); }

void
swap(__shared_ptr<_Tp, _Lp>& __other) // never throws
{
std::swap(_M_ptr, __other._M_ptr);
_M_refcount._M_swap(__other._M_refcount);
}

private:
void*
_M_get_deleter(const std::type_info& __ti) const
{ return _M_refcount._M_get_deleter(__ti); }

template<typename _Tp1, _Lock_policy _Lp1>
bool
_M_less(const __shared_ptr<_Tp1, _Lp1>& __rhs) const
{ return _M_refcount < __rhs._M_refcount; }

template<typename _Tp1, _Lock_policy _Lp1> friend class __shared_ptr;
template<typename _Tp1, _Lock_policy _Lp1> friend class __weak_ptr;

template<typename _Del, typename _Tp1, _Lock_policy _Lp1>
friend _Del* get_deleter(const __shared_ptr<_Tp1, _Lp1>&);

// Friends injected into enclosing namespace and found by ADL:
template<typename _Tp1>
friend inline bool
operator==(const __shared_ptr& __a, const __shared_ptr<_Tp1, _Lp>& __b)
{ return __a.get() == __b.get(); }

template<typename _Tp1>
friend inline bool
operator!=(const __shared_ptr& __a, const __shared_ptr<_Tp1, _Lp>& __b)
{ return __a.get() != __b.get(); }

template<typename _Tp1>
friend inline bool
operator<(const __shared_ptr& __a, const __shared_ptr<_Tp1, _Lp>& __b)
{ return __a._M_less(__b); }

_Tp*         	   _M_ptr;         // Contained pointer.
__shared_count<_Lp>  _M_refcount;    // Reference counter.
};

// 2.2.3.8 shared_ptr specialized algorithms.
template<typename _Tp, _Lock_policy _Lp>
inline void
swap(__shared_ptr<_Tp, _Lp>& __a, __shared_ptr<_Tp, _Lp>& __b)
{ __a.swap(__b); }

// 2.2.3.9 shared_ptr casts
/*  The seemingly equivalent
*           shared_ptr<_Tp, _Lp>(static_cast<_Tp*>(__r.get()))
*  will eventually result in undefined behaviour,
*  attempting to delete the same object twice.
*/
template<typename _Tp, typename _Tp1, _Lock_policy _Lp>
inline __shared_ptr<_Tp, _Lp>
static_pointer_cast(const __shared_ptr<_Tp1, _Lp>& __r)
{ return __shared_ptr<_Tp, _Lp>(__r, __static_cast_tag()); }

/*  The seemingly equivalent
*           shared_ptr<_Tp, _Lp>(const_cast<_Tp*>(__r.get()))
*  will eventually result in undefined behaviour,
*  attempting to delete the same object twice.
*/
template<typename _Tp, typename _Tp1, _Lock_policy _Lp>
inline __shared_ptr<_Tp, _Lp>
const_pointer_cast(const __shared_ptr<_Tp1, _Lp>& __r)
{ return __shared_ptr<_Tp, _Lp>(__r, __const_cast_tag()); }

/*  The seemingly equivalent
*           shared_ptr<_Tp, _Lp>(dynamic_cast<_Tp*>(__r.get()))
*  will eventually result in undefined behaviour,
*  attempting to delete the same object twice.
*/
template<typename _Tp, typename _Tp1, _Lock_policy _Lp>
inline __shared_ptr<_Tp, _Lp>
dynamic_pointer_cast(const __shared_ptr<_Tp1, _Lp>& __r)
{ return __shared_ptr<_Tp, _Lp>(__r, __dynamic_cast_tag()); }

// 2.2.3.7 shared_ptr I/O
template<typename _Ch, typename _Tr, typename _Tp, _Lock_policy _Lp>
std::basic_ostream<_Ch, _Tr>&
operator<<(std::basic_ostream<_Ch, _Tr>& __os,
const __shared_ptr<_Tp, _Lp>& __p)
{
__os << __p.get();
return __os;
}

// 2.2.3.10 shared_ptr get_deleter (experimental)
template<typename _Del, typename _Tp, _Lock_policy _Lp>
inline _Del*
get_deleter(const __shared_ptr<_Tp, _Lp>& __p)
{
#if __cpp_rtti
return static_cast<_Del*>(__p._M_get_deleter(typeid(_Del)));
#else
return 0;
#endif
}

template<typename _Tp, _Lock_policy _Lp>
class __weak_ptr
{
public:
typedef _Tp element_type;

__weak_ptr()
: _M_ptr(0), _M_refcount() // never throws
{ }

// Generated copy constructor, assignment, destructor are fine.

// The "obvious" converting constructor implementation:
//
//  template<typename _Tp1>
//    __weak_ptr(const __weak_ptr<_Tp1, _Lp>& __r)
//    : _M_ptr(__r._M_ptr), _M_refcount(__r._M_refcount) // never throws
//    { }
//
// has a serious problem.
//
//  __r._M_ptr may already have been invalidated. The _M_ptr(__r._M_ptr)
//  conversion may require access to *__r._M_ptr (virtual inheritance).
//
// It is not possible to avoid spurious access violations since
// in multithreaded programs __r._M_ptr may be invalidated at any point.
template<typename _Tp1>
__weak_ptr(const __weak_ptr<_Tp1, _Lp>& __r)
: _M_refcount(__r._M_refcount) // never throws
{
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
_M_ptr = __r.lock().get();
}

template<typename _Tp1>
__weak_ptr(const __shared_ptr<_Tp1, _Lp>& __r)
: _M_ptr(__r._M_ptr), _M_refcount(__r._M_refcount) // never throws
{ __glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>) }

template<typename _Tp1>
__weak_ptr&
operator=(const __weak_ptr<_Tp1, _Lp>& __r) // never throws
{
_M_ptr = __r.lock().get();
_M_refcount = __r._M_refcount;
return *this;
}

template<typename _Tp1>
__weak_ptr&
operator=(const __shared_ptr<_Tp1, _Lp>& __r) // never throws
{
_M_ptr = __r._M_ptr;
_M_refcount = __r._M_refcount;
return *this;
}

__shared_ptr<_Tp, _Lp>
lock() const // never throws
{
#ifdef __GTHREADS
// Optimization: avoid throw overhead.
if (expired())
return __shared_ptr<element_type, _Lp>();

__try
{
return __shared_ptr<element_type, _Lp>(*this);
}
__catch(const bad_weak_ptr&)
{
// Q: How can we get here?
// A: Another thread may have invalidated r after the
//    use_count test above.
return __shared_ptr<element_type, _Lp>();
}

#else
// Optimization: avoid try/catch overhead when single threaded.
return expired() ? __shared_ptr<element_type, _Lp>()
: __shared_ptr<element_type, _Lp>(*this);

#endif
} // XXX MT

long
use_count() const // never throws
{ return _M_refcount._M_get_use_count(); }

bool
expired() const // never throws
{ return _M_refcount._M_get_use_count() == 0; }

void
reset() // never throws
{ __weak_ptr().swap(*this); }

void
swap(__weak_ptr& __s) // never throws
{
std::swap(_M_ptr, __s._M_ptr);
_M_refcount._M_swap(__s._M_refcount);
}

private:
// Used by __enable_shared_from_this.
void
_M_assign(_Tp* __ptr, const __shared_count<_Lp>& __refcount)
{
_M_ptr = __ptr;
_M_refcount = __refcount;
}

template<typename _Tp1>
bool
_M_less(const __weak_ptr<_Tp1, _Lp>& __rhs) const
{ return _M_refcount < __rhs._M_refcount; }

template<typename _Tp1, _Lock_policy _Lp1> friend class __shared_ptr;
template<typename _Tp1, _Lock_policy _Lp1> friend class __weak_ptr;
friend class __enable_shared_from_this<_Tp, _Lp>;
friend class enable_shared_from_this<_Tp>;

// Friend injected into namespace and found by ADL.
template<typename _Tp1>
friend inline bool
operator<(const __weak_ptr& __lhs, const __weak_ptr<_Tp1, _Lp>& __rhs)
{ return __lhs._M_less(__rhs); }

_Tp*       	 _M_ptr;         // Contained pointer.
__weak_count<_Lp>  _M_refcount;    // Reference counter.
};

// 2.2.4.7 weak_ptr specialized algorithms.
template<typename _Tp, _Lock_policy _Lp>
inline void
swap(__weak_ptr<_Tp, _Lp>& __a, __weak_ptr<_Tp, _Lp>& __b)
{ __a.swap(__b); }

template<typename _Tp, _Lock_policy _Lp>
class __enable_shared_from_this
{
protected:
__enable_shared_from_this() { }

__enable_shared_from_this(const __enable_shared_from_this&) { }

__enable_shared_from_this&
operator=(const __enable_shared_from_this&)
{ return *this; }

~__enable_shared_from_this() { }

public:
__shared_ptr<_Tp, _Lp>
shared_from_this()
{ return __shared_ptr<_Tp, _Lp>(this->_M_weak_this); }

__shared_ptr<const _Tp, _Lp>
shared_from_this() const
{ return __shared_ptr<const _Tp, _Lp>(this->_M_weak_this); }

private:
template<typename _Tp1>
void
_M_weak_assign(_Tp1* __p, const __shared_count<_Lp>& __n) const
{ _M_weak_this._M_assign(__p, __n); }

template<typename _Tp1>
friend void
__enable_shared_from_this_helper(const __shared_count<_Lp>& __pn,
const __enable_shared_from_this* __pe,
const _Tp1* __px)
{
if (__pe != 0)
__pe->_M_weak_assign(const_cast<_Tp1*>(__px), __pn);
}

mutable __weak_ptr<_Tp, _Lp>  _M_weak_this;
};

// The actual shared_ptr, with forwarding constructors and
// assignment operators.
template<typename _Tp>
class shared_ptr
: public __shared_ptr<_Tp>
{
public:
shared_ptr()
: __shared_ptr<_Tp>() { }

template<typename _Tp1>
explicit
shared_ptr(_Tp1* __p)
: __shared_ptr<_Tp>(__p) { }

template<typename _Tp1, typename _Deleter>
shared_ptr(_Tp1* __p, _Deleter __d)
: __shared_ptr<_Tp>(__p, __d) { }

template<typename _Tp1>
shared_ptr(const shared_ptr<_Tp1>& __r)
: __shared_ptr<_Tp>(__r) { }

template<typename _Tp1>
explicit
shared_ptr(const weak_ptr<_Tp1>& __r)
: __shared_ptr<_Tp>(__r) { }

#if (__cplusplus < 201103L) || _GLIBCXX_USE_DEPRECATED
template<typename _Tp1>
explicit
shared_ptr(std::auto_ptr<_Tp1>& __r)
: __shared_ptr<_Tp>(__r) { }
#endif

template<typename _Tp1>
shared_ptr(const shared_ptr<_Tp1>& __r, __static_cast_tag)
: __shared_ptr<_Tp>(__r, __static_cast_tag()) { }

template<typename _Tp1>
shared_ptr(const shared_ptr<_Tp1>& __r, __const_cast_tag)
: __shared_ptr<_Tp>(__r, __const_cast_tag()) { }

template<typename _Tp1>
shared_ptr(const shared_ptr<_Tp1>& __r, __dynamic_cast_tag)
: __shared_ptr<_Tp>(__r, __dynamic_cast_tag()) { }

template<typename _Tp1>
shared_ptr&
operator=(const shared_ptr<_Tp1>& __r) // never throws
{
this->__shared_ptr<_Tp>::operator=(__r);
return *this;
}

#if (__cplusplus < 201103L) || _GLIBCXX_USE_DEPRECATED
template<typename _Tp1>
shared_ptr&
operator=(std::auto_ptr<_Tp1>& __r)
{
this->__shared_ptr<_Tp>::operator=(__r);
return *this;
}
#endif
};

// 2.2.3.8 shared_ptr specialized algorithms.
template<typename _Tp>
inline void
swap(__shared_ptr<_Tp>& __a, __shared_ptr<_Tp>& __b)
{ __a.swap(__b); }

template<typename _Tp, typename _Tp1>
inline shared_ptr<_Tp>
static_pointer_cast(const shared_ptr<_Tp1>& __r)
{ return shared_ptr<_Tp>(__r, __static_cast_tag()); }

template<typename _Tp, typename _Tp1>
inline shared_ptr<_Tp>
const_pointer_cast(const shared_ptr<_Tp1>& __r)
{ return shared_ptr<_Tp>(__r, __const_cast_tag()); }

template<typename _Tp, typename _Tp1>
inline shared_ptr<_Tp>
dynamic_pointer_cast(const shared_ptr<_Tp1>& __r)
{ return shared_ptr<_Tp>(__r, __dynamic_cast_tag()); }

// The actual weak_ptr, with forwarding constructors and
// assignment operators.
template<typename _Tp>
class weak_ptr
: public __weak_ptr<_Tp>
{
public:
weak_ptr()
: __weak_ptr<_Tp>() { }

template<typename _Tp1>
weak_ptr(const weak_ptr<_Tp1>& __r)
: __weak_ptr<_Tp>(__r) { }

template<typename _Tp1>
weak_ptr(const shared_ptr<_Tp1>& __r)
: __weak_ptr<_Tp>(__r) { }

template<typename _Tp1>
weak_ptr&
operator=(const weak_ptr<_Tp1>& __r) // never throws
{
this->__weak_ptr<_Tp>::operator=(__r);
return *this;
}

template<typename _Tp1>
weak_ptr&
operator=(const shared_ptr<_Tp1>& __r) // never throws
{
this->__weak_ptr<_Tp>::operator=(__r);
return *this;
}

shared_ptr<_Tp>
lock() const // never throws
{
#ifdef __GTHREADS
if (this->expired())
return shared_ptr<_Tp>();

__try
{
return shared_ptr<_Tp>(*this);
}
__catch(const bad_weak_ptr&)
{
return shared_ptr<_Tp>();
}
#else
return this->expired() ? shared_ptr<_Tp>()
: shared_ptr<_Tp>(*this);
#endif
}
};

template<typename _Tp>
class enable_shared_from_this
{
protected:
enable_shared_from_this() { }

enable_shared_from_this(const enable_shared_from_this&) { }

enable_shared_from_this&
operator=(const enable_shared_from_this&)
{ return *this; }

~enable_shared_from_this() { }

public:
shared_ptr<_Tp>
shared_from_this()
{ return shared_ptr<_Tp>(this->_M_weak_this); }

shared_ptr<const _Tp>
shared_from_this() const
{ return shared_ptr<const _Tp>(this->_M_weak_this); }

private:
template<typename _Tp1>
void
_M_weak_assign(_Tp1* __p, const __shared_count<>& __n) const
{ _M_weak_this._M_assign(__p, __n); }

template<typename _Tp1>
friend void
__enable_shared_from_this_helper(const __shared_count<>& __pn,
const enable_shared_from_this* __pe,
const _Tp1* __px)
{
if (__pe != 0)
__pe->_M_weak_assign(const_cast<_Tp1*>(__px), __pn);
}

mutable weak_ptr<_Tp>  _M_weak_this;
};

_GLIBCXX_END_NAMESPACE_VERSION
}
}

#endif // _TR1_SHARED_PTR_H

其主要的类关系如下所示(省略相关的类模板参数）：



图1

从上面的类图可以清楚的看出shared_ptr内部含有一个指向被管理对象(managed object)T的指针以及一个__shared_count对象，__shared_count对象包含一个指向管理对象(manager object)的基类指针，管理对象(manager object)由具有原子属性的use_count和weak_count、指向被管理对象(managed object)T的指针、以及用来销毁被管理对象的deleter组成，以下均将用new创建后托管给shared_ptr等智能指针的对象叫做被管理对象（managed
object)；shared_ptr等智能指针内部创建的用来维护被管理对象生命周期的实例叫做管理对象(manager object)：



图2

weak_ptr内部组成与shared_ptr类似，内部同样含有一个指向被管理对象T的指针以及一个__weak_count对象：



图3

从图2和图3对比可以看出，shared_ptr与weak_ptr的差异主要是由__shared_ptr与__weak_ptr体现出来的，而__shared_ptr与__weak_ptr的差异则主要是由__shared_count与__weak_count体现出来。

通过shared_ptr的构造函数，可以发现，在创建一个shared_ptr的时候需要一个new 操作符返回被管理对象的地址来初始化shared_ptr, shared_ptr在内部会构建一个_shared_count对象，由_shared_count对象的构造函数可知，创建shared_ptr的时候也动态的创建了一个管理对象_Sp_counted_base_impl:

template<typename _Tp1> explicit __shared_ptr(_Tp1* __p)
: _M_ptr(__p), _M_refcount(__p) {
    __glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)
    typedef int _IsComplete[sizeof(_Tp1)];
    __enable_shared_from_this_helper(_M_refcount, __p, __p);
}

template<typename _Ptr>
__shared_count(_Ptr __p) : _M_pi(0)
{
__try
{
typedef typename std::tr1::remove_pointer<_Ptr>::type _Tp;
_M_pi = new _Sp_counted_base_impl<_Ptr, _Sp_deleter<_Tp>, _Lp>(__p, _Sp_deleter<_Tp>());
}
__catch(...)
{
delete __p;
__throw_exception_again;
}
}

shared_ptr内部包含一个指向被管理对象的指针_M_ptr, _Sp_counted_base_impl内部也含有一个指向被管理对象的指针_M_ptr， 它们是不是重复多余了呢？实际上不多余，它们有各自的功能。这首先要从shared_ptr的拷贝构造或者赋值构造说起，当一个shared_ptr对象sp2是由sp1拷贝构造或者赋值构造得来的时候，实际上构造完成后sp1内部的__shared_count对象包含的指向管理对象的指针与sp2内部的__shared_count对象包含的指向管理对象的指针是相等的，也就是说当多个shared_ptr对象来管理同一个对象时，它们共同使用同一个动态分配的管理对象。这可以从下面的__share_ptr的构造函数和__shared_count的构造函数清楚的看出。

template<typename _Tp1>
__shared_ptr(const __shared_ptr<_Tp1, _Lp>& __r)
: _M_ptr(__r._M_ptr), _M_refcount(__r._M_refcount) // never throws
{__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>)}

__shared_count&
operator=(const __shared_count& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != _M_pi)
{
if (__tmp != 0)
__tmp->_M_add_ref_copy();
if (_M_pi != 0)
_M_pi->_M_release();

_M_pi = __tmp;
}
}

上面说说当多个shared_ptr对象来管理同一个对象时，它们共同使用同一个动态分配的管理对象，为什么上面给出的_shared_count的构造函数中出现了__tmp != _M_pi的情形呢？这在sp2未初始化时（_M_pi为0，_r._M_pi非0）便是这样的情形。

更一般的，也可以考虑这样的情形：shared_ptr实例sp1开始指向类A的实例对象a1, 另外一个shared_ptr实例sp2指向类A的实例对象a2（a1 != a2)，当把sp2赋值给sp1时便会出现上面的情形。假设初始时有且仅有一个sp1指向a1, 有且仅有一个sp2指向a2; 则赋值结束时sp1与sp2均指向a2, 没有指针指向a1, sp1指向的a1以及其对应的管理对象均应该被析构。这在上面的代码中我们可以很清楚的看到：因为__tmp
!= _M_pi,  __tmp->_M_add_ref_copy()将会增加a2的use_count的引用计数；由于a1内部的_M_pi != 0, 将会调用其_M_release()函数：

//************_Sp_counted_base*****************//
void
_M_add_ref_copy()
{ __gnu_cxx::__atomic_add_dispatch(&_M_use_count, 1); }

//************_Sp_counted_base*****************//
void
_M_release() // nothrow
{
// Be race-detector-friendly.  For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_use_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_use_count, -1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_use_count);
_M_dispose();
// There must be a memory barrier between dispose() and destroy()
// to ensure that the effects of dispose() are observed in the
// thread that runs destroy().
// See http://gcc.gnu.org/ml/libstdc++/2005-11/msg00136.html if (_Mutex_base<_Lp>::_S_need_barriers)
{
__atomic_thread_fence (__ATOMIC_ACQ_REL);
}

// Be race-detector-friendly.  For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_weak_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_weak_count, -1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_weak_count);
_M_destroy();
}
}
}

//************_Sp_counted_base*****************//
// Called when _M_use_count drops to zero, to release the resources
// managed by *this.
virtual void
_M_dispose() = 0; // nothrow

// Called when _M_weak_count drops to zero.
virtual void
_M_destroy() // nothrow
{ delete this; }

//************_Sp_counted_base_impl*************//
virtual void
_M_dispose() // nothrow
{ _M_del(_M_ptr); }

_M_release()函数首先对a1的use_count减去1，并对比减操作之前的值，如果减之前是1，说明减后是0，a1没有任何shared_ptr指针指向它了，应该将a1对象销毁，于是调用_M_dispose()函数销毁a1; 同时对a1的weak_count减去1，也对比减操作之前的值，如果减之前是1，说明减后是0，a1没有weak_ptr指向它了，应该将管理对象销毁，于是调用_M_destroy()销毁了管理对象。这就可以解答为什么图2所示中shared_ptr内部含有两个指向被管理对象的指针了：__shared_ptr直接包含的裸指针是为了实现一般指针的->,*等操作，通过__shared_count间接包含的指针是为了管理对象的生命周期，回收相关资源。

换句话说，__shared_count内部的use_count主要用来标记被管理对象的生命周期，weak_count主要用来标记管理对象的生命周期。

当一个shared_ptr超出作用域被销毁时，它会调用其_share_count的_M_release()对use_count和weak_count进行自减并判断是否需要释放管理对象和被管理对象，这是RAII原理的核心体现：

~__shared_count() // nothrow
{
if (_M_pi != 0)
_M_pi->_M_release();
}

对于weak_ptr, 其对应的__weak_count的拷贝构造函数如下:

//************_Sp_counted_base*****************//
void
_M_weak_add_ref() // nothrow
{ __gnu_cxx::__atomic_add_dispatch(&_M_weak_count, 1); }

//************_Sp_counted_base*****************//
void
_M_weak_release() // nothrow
{
// Be race-detector-friendly. For more info see bits/c++config.
_GLIBCXX_SYNCHRONIZATION_HAPPENS_BEFORE(&_M_weak_count);
if (__gnu_cxx::__exchange_and_add_dispatch(&_M_weak_count, -1) == 1)
{
_GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_weak_count);
if (_Mutex_base<_Lp>::_S_need_barriers)
{
// See _M_release(),
// destroy() must observe results of dispose()
__atomic_thread_fence (__ATOMIC_ACQ_REL);
}
_M_destroy();
}
}

__weak_count<_Lp>&
operator=(const __shared_count<_Lp>& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != 0)
__tmp->_M_weak_add_ref();

if (_M_pi != 0)
_M_pi->_M_weak_release();

_M_pi = __tmp;

return *this;
}

__weak_count<_Lp>&
operator=(const __weak_count<_Lp>& __r) // nothrow
{
_Sp_counted_base<_Lp>* __tmp = __r._M_pi;
if (__tmp != 0)
 __tmp->_M_weak_add_ref();
if (_M_pi != 0)
_M_pi->_M_weak_release();
_M_pi = __tmp;

return *this;
}

__weak_count<_Lp>&
operator=(const __shared_count<_Lp>& __r) // nothrow
{
    _Sp_counted_base<_Lp>* __tmp = __r._M_pi;
    if (__tmp != 0)
      __tmp->_M_weak_add_ref();
    if (_M_pi != 0)
      _M_pi->_M_weak_release();
    _M_pi = __tmp;  
    return *this;
}

~__weak_count() // nothrow
{
if (_M_pi != 0)
_M_pi->_M_weak_release();
}

从上面可以看出:

__weak_count相关的赋值拷贝以及析构函数均只会影响到weak_count的值，对use_count没有影响；当weak_count为0时，释放管理对象。也就是说__weak_ptr不影响被管理对象的生命周期。同时由于__weak_ptr没有像__shared_ptr那样实现*，->等常见指针相关操作符，__weak_ptr不能直接操作被管理对象；
__weak_count自身间的赋值以及__shared_count对__weak_count的赋值时，它们都具有同样的指向管理对象的指针；也就是说当多个__weak_ptr和__shared_ptr指向同一个被管理对象时，它们共享同一个管理对象，这就保证了可以通过__weak_ptr可以判断__shared_ptr指向的被管理对象是否存在以及获取到被管理对象的指针。

__shared_ptr与__weak_ptr在管理同一对象时，它们间的关系如下图4所示：



图4

由于weak_ptr不能直接操作被管理对象但其仍然持有指向被管理对象的指针（用来初始化内部的__weak_count对象），weak_ptr与被管理对象用虚线联接。

_weak_ptr有几个重要的成员函数：通过expired()方法来判断对象是否过期（已经被释放）；通过use_count()方法返回目前有多少个__shared_ptr对象指向被管理对象；通过lock()方法返回一个指向被管理对象的__shared_ptr指针，调用者可以通过这个__shared_ptr指针来操纵被管理对象而不用担心资源泄漏；

/*************_weak_ptr*************************/
long
use_count() const // never throws
{ return _M_refcount._M_get_use_count(); }

bool
expired() const // never throws
{ return _M_refcount._M_get_use_count() == 0; }

__shared_ptr<_Tp, _Lp>
lock() const // never throws
{
#ifdef __GTHREADS
// Optimization: avoid throw overhead.
    if (expired())
return __shared_ptr<element_type, _Lp>();

    __try
    {
return __shared_ptr<element_type, _Lp>(*this);
    }
    __catch(const bad_weak_ptr&)
    {
        // Q: How can we get here?
       // A: Another thread may have invalidated r after the
       //    use_count test above.
       return __shared_ptr<element_type, _Lp>();
     }
    
#else
    // Optimization: avoid try/catch overhead when single threaded.
    return expired() ? __shared_ptr<element_type, _Lp>()
                     : __shared_ptr<element_type, _Lp>(*this);

#endif
} // XXX MT

当然shared_ptr也不是万能的，使用的时候也要注意到它给程序员挖的一个大坑：shared_ptr能够管理对象的生命周期，负责对象资源释放，其前提条件是所有shared_ptr共用同一个管理对象。如果多个shared_ptr使用多个管理对象来管理同一个被管理对象，这些管理对象在use_count为0时均会释放被管理对象，将会造成多个管理对象多次释放被管理对象，造成twice delete的堆错误。下面的例子在单独使用裸指针的时候没有问题，采用shared_ptr将会出现twice
delete的问题：

class Thing {
public:
void foo();
void defrangulate();
};
void transmogrify(Thing *);
int main()
{
Thing * t1 = new Thing;
t1->foo();
...
delete t1; // done with the object
}
...
void Thing::foo()
{
// we need to transmogrify this object
transmogrify(this);
}
void transmogrify(Thing * ptr)
{
ptr->defrangulate();
/* etc. */
}
//***** Use shared_ptr***************************//
class Thing {
public:
void foo();
void defrangulate();
};
void transmogrify(shared_ptr<Thing>);
int main()
{
shared_ptr<Thing> t1(new Thing); // create manager object A for the Thing
t1->foo();
...
// Thing is supposed to get deleted when t1 goes out of scope
}
void Thing::foo()
{
// we need to transmogrify this object
shared_ptr<Thing> sp_for_this(this); //  create manager object B for the Thing
transmogrify(sp_for_this);

// Thing is supposed to get deleted when sp_for_this and other shared_ptr goes out of scope
}
void transmogrify(shared_ptr<Thing> ptr)
{
ptr->defrangulate();
/* etc. */
}

上面注释处分别创建了两个shared_ptr指针t1，sp_for_this, 它们各自有自己的管理对象，但被管理的堆内存却是一样的，这就导致在t1和sp_for_this析构时，它们各自的管理对象均会析构被管理对象，造成twice delete。

怎样解决上面这一广泛存在问题：当一个对象M创建后，如果一个函数f（另一个类的成员函数或是其它自由函数）的形参为M类型的智能指针，如何在对象M内部将对象M的指针作为实参传递给该函数f ? C++引入了enable_shared_from_this利用weak_ptr的特性解决了这一问题。其基本思想是通过M继承模板类enable_shared_from_this，这样对象M内部将会有一个__weak_ptr指针_M_weak_this，在第一次创建指向M的shared_ptr
Pt时，通过模板特化，将会初始化_M_weak_this;这样M内部也会产生一个指向自身的weak_ptr，并且该weak_ptr内部的管理对象与Pt的管理对象是相同的（这可以从weak_ptr内部的_M_assign函数看出）。

// Friend of enable_shared_from_this.
template<typename _Tp1, typename _Tp2>
void __enable_shared_from_this_helper(const __shared_count<>&, const enable_shared_from_this<_Tp1>*, const _Tp2*);

template<typename _Tp1>
explicit __shared_ptr(_Tp1* __p)
: _M_ptr(__p), _M_refcount(__p)
{
__glibcxx_function_requires(_ConvertibleConcept<_Tp1*, _Tp*>) typedef int _IsComplete[sizeof(_Tp1)];
__enable_shared_from_this_helper(_M_refcount, __p, __p);

}

template<typename _Tp>
class enable_shared_from_this
{
protected:
enable_shared_from_this() { }

enable_shared_from_this(const enable_shared_from_this&) { }

enable_shared_from_this&
operator=(const enable_shared_from_this&)
{ return *this; }

~enable_shared_from_this() { }

public:
shared_ptr<_Tp>
shared_from_this()
{ return shared_ptr<_Tp>(this->_M_weak_this); }

shared_ptr<const _Tp>
shared_from_this() const
{ return shared_ptr<const _Tp>(this->_M_weak_this); }

private:
template<typename _Tp1>
void
_M_weak_assign(_Tp1* __p, const __shared_count<>& __n) const
{ _M_weak_this._M_assign(__p, __n); }

template<typename _Tp1>
friend void
__enable_shared_from_this_helper(const __shared_count<>& __pn, const enable_shared_from_this* __pe, const _Tp1* __px)
{
if (__pe != 0)
__pe->_M_weak_assign(const_cast<_Tp1*>(__px), __pn);
}

mutable weak_ptr<_Tp>  _M_weak_this;
};

_M_assign(_Tp* __ptr, const __shared_count<_Lp>& __refcount)
{
_M_ptr = __ptr;
   _M_refcount = __refcount;
}

这样，在M内部，当需要传递指向M的智能指针时，可以通过继承而来的shared_from_this方法获取到指向M的智能指针而不会发生内存泄漏。上面示例中改写后的正确代码为：

class Thing : public enable_shared_from_this<Thing> {
public:
void foo();
void defrangulate();
};
int main()
{
// The following starts a manager object for the Thing and also
// initializes the weak_ptr member that is now part of the Thing and share same manager object.
shared_ptr<Thing> t1(new Thing);
t1->foo();
...
}
void Thing::foo()
{
// get a shared_ptr from the weak_ptr in this object
shared_ptr<Thing> sp_this = shared_from_this();
transmogrify(sp_this);
}
void transmogrify(shared_ptr<Thing> ptr)
{
ptr->defrangulate();
/* etc. */
}

解决了所有的坑，shared_ptr是不是就十全十美了呢？当然不是，shared_ptr也存在不足：在采用shared_ptr<M> p(new M);形式创建p来管理M时，我们实际发现这中间有两次的动态内存分配：一次为创建被管理对象M，一次为创建管理对象；而内存分配通常是比较昂贵的操作。

如果频繁的需要创建指向多个不同对象的智能指针，可以采用shared_ptr<M> p(make_shared<M>);的方式，采用这种方式系统将会分配一大块内存同时存放管理对象和被管理对象，这就避免了上面所说的二次内存分配的问题，同时程序中也不会出现new操作符，符合"no naked new!"的编程倡导。当然这也有缺点，如果所有指向该对象的智能指针都销毁了，尽管对象的析构函数会被调用，析构被管理对象，但是如果还有weak_ptr指向该块对象所在的内存，存放管理对象的部分内存仍将不会被释放，因而导致在所有其他weak_ptr销毁前整块内存（尽管被管理对象已经析构了）将不会进入系统的内存池循环使用。

参考：

gcc1.6源码
Using C++ 11's Smart Pointers by David Kieras, EECS Department, University of Michigan