[面试经]VPTR和VTBL

假设是32位机器。

在这里，解释一下虚函数表（Virtual table 或称为vtbl），虚函数指针（ Virtual pointer 或者称为 vptr）的内部工作原理。

首先，我们必须了解一下内存布局。

例一：类的内存布局

#include <iostream>
using namespace std;

class Test{
public:
    int data1;
    int data2;
    int fun1();
};

int main(){
    Test obj;
    cout << "obj's Size = " << sizeof(obj) << endl;
    cout << "obj 's Address = " << &obj << endl;
    return 0;
}

输出结果：

Sobj's Size = 8
obj 's Address = 0012FF7C

注意：任何的成员函数都不会占用任何的内存。

例二 ：派生类的内存布局

// 父类
class Test{
public:
    int a;
    int b;
};
// 派生类
class dTest : public Test{
public:
    int c;
};



int main(){

    Test obj1;
    cout << "obj1's Size = " << sizeof(obj1) << endl;
    cout << "obj1's Address = " << &obj1 << endl;

    dTest obj2;
    cout << "obj2's Size = "<< sizeof(obj2) << endl;
    cout << "obj2's Address = "<< &obj2 << endl;
    return 0;
}

输出结果：

obj1's Size = 8
obj1's Address = 0012FF78
obj2's Size = 12
obj2's Address = 0012FF6C

例三 ： 带有虚函数类的内存布局

// 带有虚函数的类
class Test{
public:
    int data;
    // 虚函数
    virtual void fun1(){
        cout << "Test::fun1" << endl;
    }
};

int main(){

    Test obj;
    cout << "obj's Size = " << sizeof(obj) << endl;
    cout << "obj's Address = " << &obj << endl;
    return 0;
}

输出结果：

obj's Size = 8
obj's Address = 0012FF7C

注意：在类中添加虚函数会产生额外的负担（4Byte）

例四：不止一个虚函数

class Test{
public:
    int data;
    virtual void fun1() { cout << "Test::fun1" << endl; }
    virtual void fun2() { cout << "Test::fun2" << endl; }
    virtual void fun3() { cout << "Test::fun3" << endl; }
    virtual void fun4() { cout << "Test::fun4" << endl; }
};

int main(){

    Test obj;
    cout << "obj's Size = " << sizeof(obj) << endl;
    cout << "obj's Address = " << &obj << endl;
    return 0;
}

输出结果：

obj's Size = 8
obj's Address = 0012FF7C

注意：如果一个类中有虚函数的前提下，再增加虚函数就不会产生额外的内存负担。仍然产生额外的4Byte负担。

例五：

class Test{
public:
    int a;
    int b;
    Test(int temp1 = 0, int temp2 = 0){
        a=temp1;
        b=temp2;
    }
    int getA(){
        return a;
    }
    int getB(){
        return b;
    }
    virtual ~Test();
};

int main(){

    Test obj(5, 10);

    // Changing a and b
    int* pInt = (int*)&obj;
    *(pInt+0) = 100;
    *(pInt+1) = 200;

    cout << "a = " << obj.getA() << endl;
    cout << "b = " << obj.getB() << endl;
    return 0;
}

输出结果：

a = 200
b = 10

如果作如下修改：

// Changing a and b
int* pInt = (int*)&obj;
*(pInt+1) = 100; // In place of 0
*(pInt+2) = 200; // In place of 1

输出结果：

a = 100
b = 200

注意：位于class第一位置是vptr，其他都位于其后面。
（Who sits 1st place of Class : Answer is VPTR，VPTR - 1st placed in class and rest sits after it. ）

例六：

class Test {
    virtual void fun1(){
        cout << "Test::fun1" << endl;
    }
};

int main(){

    Test obj;
    cout << "VPTR's Address " << (int*)(&obj+0) << endl;
    cout << "VPTR's Value " << (int*)*(int*)(&obj+0) << endl;
    return 0;
}

输出结果：

VPTR's Address 0012FF7C
VPTR's Value 0046C060

注意：VPTR’s Value是Virtual table的地址，让我们下面的例子。

例七：

class Test{
    virtual void fun1(){
        cout << "Test::fun1" << endl;
    }
};

typedef void (*Fun)(void);

int main(){

    Test obj;
    cout << "VPTR's Address " << (int*)(&obj+0) << endl;
    cout << " VIRTUAL TABLE 's Address " << (int*)*(int*)(&obj+0) << endl; // Value of VPTR
    cout << "Value at first entry of VIRTUAL TABLE " << (int*)*(int*)*(int*)(&obj+0) << endl;

    Fun pFun = (Fun)*(int*)*(int*)(&obj+0);   // calling Virtual function
    pFun();
    return 0;
}

输出结果：

VPTR's Address 0012FF7C
VIRTUAL TABLE 's Address 0046C0EC
Value at first entry of VIRTUAL TABLE 0040100A
Test: fun1

例八：

class Test{
    virtual void fun1() { cout << "Test::fun1" << endl; }
    virtual void func1() { cout << "Test::func1" << endl; }
};

int main(){

    Test obj;

    cout << "VPTR's Address " << (int*)(&obj+0) << endl;
    cout << "VIRTUAL TABLE 's Address"<< (int*)*(int*)(&obj+0) << endl;

    // Calling Virtual table functions
    cout << "Value at 1st entry of VTable " << (int*)*((int*)*(int*)(&obj+0)+0) << endl;
    cout << "Value at 2nd entry of VTable " << (int*)*((int*)*(int*)(&obj+0)+1) << endl;

    return 0;
}

输出结果：

VPTR's Address 0012FF7C
VIRTUAL TABLE 's Address 0046C0EC
Value at first entry of VIRTUAL TABLE 0040100A
Value at 2nd entry of VIRTUAL TABLE 004012

例九：

class Test{
    virtual void fun1() { cout << "Test::fun1" << endl; }
    virtual void func1() { cout << "Test::func1" << endl; }
};

typedef void(*Fun)(void);

int main(){

    Test obj;
    Fun pFun = NULL;

    // calling 1st virtual function
    pFun = (Fun)*((int*)*(int*)(&obj+0)+0);
    pFun();

    // calling 2nd virtual function
    pFun = (Fun)*((int*)*(int*)(&obj+0)+1);
    pFun();

    return 0;
}

输出结果：

Test::fun1
Test::func1

例十：

class Base1{
public:
    virtual void fun();
};

class Base2{
public:
    virtual void fun();
};

class Base3{
public:
    virtual void fun();
};

class Derive : public Base1, public Base2, public Base3{
};

int main(){

    Derive obj;
    cout << "Derive's Size = " << sizeof(obj) << endl;
    return 0;
}

输出结果：

Derive's Size = 12

例十一：

class Base1{
    virtual void fun1() { cout << "Base1::fun1()" << endl; }
    virtual void func1() { cout << "Base1::func1()" << endl; }
};

class Base2 {
    virtual void fun1() { cout << "Base2::fun1()" << endl; }
    virtual void func1() { cout << "Base2::func1()" << endl; }
};

class Base3 {
    virtual void fun1() { cout << "Base3::fun1()" << endl; }
    virtual void func1() { cout << "Base3::func1()" << endl; }
};

class Derive : public Base1, public Base2, public Base3{
public:
    virtual void Fn(){
        cout << "Derive::Fn" << endl;
    }
    virtual void Fnc(){
        cout << "Derive::Fnc" << endl;
    }
};

typedef void(*Fun)(void);

int main(){

    Derive obj;
    Fun pFun = NULL;

    // calling 1st virtual function of Base1
    pFun = (Fun)*((int*)*(int*)((int*)&obj+0)+0);
    pFun();

    // calling 2nd virtual function of Base1
    pFun = (Fun)*((int*)*(int*)((int*)&obj+0)+1);
    pFun();

    // calling 1st virtual function of Base2
    pFun = (Fun)*((int*)*(int*)((int*)&obj+1)+0);
    pFun();

    // calling 2nd virtual function of Base2
    pFun = (Fun)*((int*)*(int*)((int*)&obj+1)+1);
    pFun();

    // calling 1st virtual function of Base3
    pFun = (Fun)*((int*)*(int*)((int*)&obj+2)+0);
    pFun();

    // calling 2nd virtual function of Base3
    pFun = (Fun)*((int*)*(int*)((int*)&obj+2)+1);
    pFun();

    // calling 1st virtual function of Drive
    pFun = (Fun)*((int*)*(int*)((int*)&obj+0)+2);
    pFun();

    // calling 2nd virtual function of Drive
    pFun = (Fun)*((int*)*(int*)((int*)&obj+0)+3);
    pFun();

    return 0;
}

输出结果：

Base1::fun
Base1::func
Base2::fun
Base2::func
Base3::fun
Base3::func
Drive::Fn
Drive::Fnc

顺便提一下函数指针：

int i;
定义了一个int类型的变量i；
而这样
typedef INT int;
表示用户自己定义了一个整型数据类型INT，实际上就等同于int
所以：INT ii；
同上，表示定义了一个int类型的变量ii；

同理可得：
typedef void (*Fun)(void);
表示用户自己定义了一个函数指针数据类型 ，该函数指针指向 类似void Foo(void)函数的函数入口地址
Fun pf;
表示定义了一个函数指针pf，该函数指针指向类似于void *pf(void)的函数 //leo