Foreword
C ++ role virtual function is mainly to achieve a mechanism of the polymorphism. About polymorphism, in short, with a pointer to the parent instance other types of its subclasses, and then call subclass member functions by the actual pointer to the parent class. This technique allows the parent pointer of the "many forms", which is a generic technology. The so-called generics, it means trying to use the same code to implement variable algorithm. For example: template technology, RTTI technology, virtual function technique, or is trying to do at compile time resolution, resolution or try to do run-time.
On how to use virtual functions, I am here not elaborate too much. You can look at the relevant C ++ books. In this article, I just want to achieve from the above mechanism of virtual functions for everyone a clear analysis.
Of course, the same articles on the Internet there were a few, but I always feel these articles are not very easy to read, large chunks of code large segment, no pictures, no detailed explanation, there is no comparison, there is no analogy. Not conducive to learning and reading, so this is the reason I wanted to write this article. I hope you give me advice.
Closer to home, let us enter the world of virtual functions.
Vtable
For C ++ know people should know virtual function ( Virtual Function ) is through a virtual function table ( Virtual the Table to achieve). Referred to as V-the Table . In this table, the main table is the address to a class of virtual functions, this table to solve the succession problem covered, to ensure a true reflection of the actual function of their capacity. Thus, in the instance of a class with a virtual function table in the memory it is allocated in this instance, therefore, when we use the pointer to the parent class when a subclass operation, this becomes a virtual function table important , and it's like, like a map, pointed out the actual function should be called.
Here we focus on look at this virtual function tables. C ++ compiler should ensure vtable pointer is present in the object instance the foremost position (which is taken to ensure that the vtable has the highest performance - if the inherited or multilayer case of multiple inheritance ). This means that we get through the object instance address this virtual table, which then can traverse function pointer, and call the appropriate function.
I listen to so much pull, I can feel it now you may be more confusing than ever. Never mind, here is a practical example, I believe that smart you understand at a glance.
Suppose we have such a class:
class Base {
public:
virtual void f() { cout << "Base::f" << endl; }
virtual void g() { cout << "Base::g" << endl; }
virtual void h() { cout << "Base::h" << endl; }
};
According to the above argument, we can Base to give an example of the virtual function table. Here is the actual routines:
typedef void(*Fun)(void);
Base b;
Fun pFun = NULL;
<< COUT " virtual function table address: " << ( int *) (& B) << endl;
<< COUT " virtual function table - the first address of a function: " << ( int *) * ( int *) (& B) << endl;
// Invoke the first virtual function
pFun = (Fun)*((int*)*(int*)(&b));
pFun();
Actual operating results by the following: (Windows XP VS2003 +, Linux + GCC 4.1.3 2.6.22)
Virtual function table address: 0012FED4
Vtable - first address of a function: 0044F148
Base::f
Through this example, we can see that we can force the & b turn into int * , to obtain the address of the virtual function tables, and then check the site again you can get the address of the first virtual function, that is, Base :: f () , which has been verified in the above procedure (the int * forcibly turned into function pointers). Through this example, we can know if you are calling Base :: g () and Base :: H () , its code is as follows:
(Fun)*((int*)*(int*)(&b)+0); // Base::f()
(Fun)*((int*)*(int*)(&b)+1); // Base::g()
(Fun)*((int*)*(int*)(&b)+2); // Base::h()
This time you should understand it. what? Still a little dizzy. Also, such code looked too messy. No problem, let me draw a diagram to explain. As follows:
<?xml:namespace prefix = v />
Note: In the above diagram, I added an extra node in the final virtual function tables, this is the end node virtual function tables, like the terminator string " / 0 the same," which marks the virtual function table the end. This marks the end of the value in the different compilers are different. In WinXP + VS2003 , the value is NULL . In 7.10 + Linux 2.6.22 + GCC 4.1.3 Ubuntu next, if this value is 1 , also represents the next virtual function table, if the value is 0 , the last representation is a virtual function table.
Below, I will illustrate the "no coverage" and "covering" virtual function tables of the way. It does not cover virtual functions of the parent class is meaningless. The reason I want to talk about the absence of coverage, the main purpose is to give a comparison. In comparison, we can more clearly aware of its internal implementation.
Inheritance general (non-virtual function override)
Now, let us look at virtual function tables inherit what. Suppose there is a succession relationship shown below:
Note that in this inheritance, the subclass does not override any of the parent class. Then, in the instance of a derived class, virtual function table which follows
For example: Derive D; virtual function table is as follows:
We can see the following points:
1) virtual function declarations in accordance with their place in the order table.
2) in front of a virtual function in the subclass virtual functions of the parent class.
I believe that smart you will be able to refer back to that program, to write a program to verify.
General succession (cover has virtual functions)
Virtual function override the parent class is very obvious thing, otherwise, the virtual function becomes meaningless. Below, we look at, if there is a virtual function overloading the virtual function in the parent class subclass, it would be a what? Suppose that we have such a relationship inherit below.
In order to let everyone see the effect after being inherited, in the design of this class, I only covered a parent class: f () . So, for instance of a derived class virtual function table which would look like the following one:
We can see from the table below points,
1) covering the f () function is placed in the position of the virtual tables of the original parent class virtual function.
2) not covered still function.
In this way, we can see that for such a program below,
Base *b = new Derive();
b->f();
The b memory referred to in the virtual function table f () a location has been Derive :: f () is a function of replacement addresses, so in the actual call occurs, is Derive :: f () is invoked. This enables polymorphism.
Multiple inheritance (no virtual function override)
Now, let us look at the case of multiple inheritance, assuming there is such a class inheritance below. Note: subclasses of the parent class does not cover
For example, a subclass of the virtual function table, looks like this:
We can see that:
1) Each class has its own virtual parent table.
2) a member of the subclass Table was placed in a parent class. (Called the parent class is the first order determined according to the declaration)
To do so is to solve different types of parent class pointer to the same sub-class instance, and be able to call to the actual function.
Multiple inheritance (have virtual functions cover)
Here we look at the situation if the virtual function override occurs.
Below, we cover the parent class in subclasses f () function.
The following example for the sub-class virtual function table of FIG:
我们可以看见，三个父类虚函数表中的f()的位置被替换成了子类的函数指针。这样，我们就可以任一静态类型的父类来指向子类，并调用子类的f()了。如：
Derive d;
Base1 *b1 = &d;
Base2 *b2 = &d;
Base3 *b3 = &d;
b1->f(); //Derive::f()
b2->f(); //Derive::f()
b3->f(); //Derive::f()
b1->g(); //Base1::g()
b2->g(); //Base2::g()
b3->g(); //Base3::g()
安全性
每次写C++的文章，总免不了要批判一下C++。这篇文章也不例外。通过上面的讲述，相信我们对虚函数表有一个比较细致的了解了。水可载舟，亦可覆舟。下面，让我们来看看我们可以用虚函数表来干点什么坏事吧。
一、通过父类型的指针访问子类自己的虚函数
我们知道，子类没有重载父类的虚函数是一件毫无意义的事情。因为多态也是要基于函数重载的。虽然在上面的图中我们可以看到Base1的虚表中有Derive的虚函数，但我们根本不可能使用下面的语句来调用子类的自有虚函数：
Base1 *b1 = new Derive();
b1->f1(); //编译出错
任何妄图使用父类指针想调用子类中的未覆盖父类的成员函数的行为都会被编译器视为非法，所以，这样的程序根本无法编译通过。但在运行时，我们可以通过指针的方式访问虚函数表来达到违反C++语义的行为。（关于这方面的尝试，通过阅读后面附录的代码，相信你可以做到这一点）
二、访问non-public的虚函数
另外，如果父类的虚函数是private或是protected的，但这些非public的虚函数同样会存在于虚函数表中，所以，我们同样可以使用访问虚函数表的方式来访问这些no
n-public的虚函数，这是很容易做到的。
如：
class Base {
private:
virtual void f() { cout << "Base::f" << endl;
};
class Derive : public Base{
};
typedef void(*Fun)(void);
void main() {
Derive d;
Fun pFun = (Fun)*((int*)*(int*)(&d)+0);
pFun();
}
结束语
C++这门语言是一门Magic的语言，对于程序员来说，我们似乎永远摸不清楚这门语言背着我们在干了什么。需要熟悉这门语言，我们就必需要了解C++里面的那些东西，需要去了解C++中那些危险的东西。不然，这是一种搬起石头砸自己脚的编程语言。
在文章束之前还是介绍一下自己吧。我从事软件研发有十个年头了，目前是软件开发技术主管，技术方面，主攻Unix/C/C++，比较喜欢网络上的技术，比如分布式计算，网格计算，P2P，Ajax等一切和互联网相关的东西。管理方面比较擅长于团队建设，技术趋势分析，项目管理。欢迎大家和我交流，我的MSN和Email是：[email protected]
附录一：VC中查看虚函数表
我们可以在VC的IDE环境中的Debug状态下展开类的实例就可以看到虚函数表了（并不是很完整的）
附录 二：例程
下面是一个关于多重继承的虚函数表访问的例程：
#include <iostream>
using namespace std;
class Base1 {
public:
virtual void f() { cout << "Base1::f" << endl; }
virtual void g() { cout << "Base1::g" << endl; }
virtual void h() { cout << "Base1::h" << endl; }
};
class Base2 {
public:
virtual void f() { cout << "Base2::f" << endl; }
virtual void g() { cout << "Base2::g" << endl; }
virtual void h() { cout << "Base2::h" << endl; }
};
class Base3 {
public:
virtual void f() { cout << "Base3::f" << endl; }
virtual void g() { cout << "Base3::g" << endl; }
virtual void h() { cout << "Base3::h" << endl; }
};
class Derive : public Base1, public Base2, public Base3 {
public:
virtual void f() { cout << "Derive::f" << endl; }
virtual void g1() { cout << "Derive::g1" << endl; }
};
typedef void(*Fun)(void);
int main()
{
Fun pFun = NULL;
Derive d;
int** pVtab = (int**)&d;
//Base1's vtable
//pFun = (Fun)*((int*)*(int*)((int*)&d+0)+0);
pFun = (Fun)pVtab[0][0];
pFun();
//pFun = (Fun)*((int*)*(int*)((int*)&d+0)+1);
pFun = (Fun)pVtab[0][1];
pFun();
//pFun = (Fun)*((int*)*(int*)((int*)&d+0)+2);
pFun = (Fun)pVtab[0][2];
pFun();
//Derive's vtable
//pFun = (Fun)*((int*)*(int*)((int*)&d+0)+3);
pFun = (Fun)pVtab[0][3];
pFun();
//The tail of the vtable
pFun = (Fun)pVtab[0][4];
cout<<pFun<<endl;
//Base2's vtable
//pFun = (Fun)*((int*)*(int*)((int*)&d+1)+0);
pFun = (Fun)pVtab[1][0];
pFun();
//pFun = (Fun)*((int*)*(int*)((int*)&d+1)+1);
pFun = (Fun)pVtab[1][1];
pFun();
pFun = (Fun)pVtab[1][2];
pFun();
//The tail of the vtable
pFun = (Fun)pVtab[1][3];
cout<<pFun<<endl;
//Base3's vtable
//pFun = (Fun)*((int*)*(int*)((int*)&d+1)+0);
pFun = (Fun)pVtab[2][0];
pFun();
//pFun = (Fun)*((int*)*(int*)((int*)&d+1)+1);
pFun = (Fun)pVtab[2][1];
pFun();
pFun = (Fun)pVtab[2][2];
pFun();
//The tail of the vtable
pFun = (Fun)pVtab[2][3];
cout<<pFun<<endl;
return 0;
}
转自：https://blog.csdn.net/lyztyycode/article/details/81326699