对象模型（Object Model）

C++对象的内容分为数据成员（class data members）与成员函数（class member functions），其中数据成员又可分为静态数据成员、非静态数据成员两类，成员函数又可分为静态函数、非静态函数与虚函数三类。

存在虚函数的类对象里连续存放着虚函数表指针（Vptr）与静态数据成员，Vptr 指向虚函数表（Vtbl），Vtbl 存放于其他区域，而Vtbl里连续存放着此类对象的所有虚函数的地址。

  
class Base {

  private:
    int i;
    double d;

  public:
    virtual f( ) {    }
    virtual g( ) {    }

};

可以通过如下代码验证虚函数的相关机制：

定义一种函数指针类型 Fun：typedef void(*Fun)(void);

定义Base类的对象 b：Base b;

虚函数表指针（Vptr）的地址：(int*)(&b)；

虚函数表（Vtbl）的地址：*((int*)(&b)) ；

第一个虚函数 f( ) 的地址：(int*)*(int*)(&b) + 0，或：(int*)(*(int*)(&b)) + 0；

第二个虚函数 g( ) 的地址: (int*)*(int*)(&b) + 1，或：(int*)(*(int*)(&b)) + 1；

将第一个虚函数的地址转化为Fun类型的函数指针：(Fun)*((int*)*(int*)(&b) + 0)。

验证程序如下：

// ObjectModel.cpp
#include <iostream>
#include <stdlib.h>

using namespace std;

class Fruit{
    int no = 1;
    double weight = 0.1;
    char key = 'k';
public:
    Fruit(int _no, double _weight, char _key): no(_no), weight(_weight), key(_key) {
        cout << "Calling Fruit(int, double, char)..." << endl;
    }
    Fruit() {
        cout << "Calling Fruit()..." << endl;
    }
    void print() {   }
    virtual void process(){ cout << "Fruit::process()" << endl; }
    virtual ~Fruit() {
        cout << "Calling ~Fruit()..." << endl;
    }
};

class Apple: public Fruit{
    int size = 2;
    char type = 't';
public:
    Apple(int _no, double _weight, char _key, int _size, char _type)
        : Fruit(_no, _weight, _key), size(_size), type(_type) {
        cout << "Calling Apple(int, double, char, int, char)..." << endl;
    }
    Apple() {
        cout << "Calling Apple()..." << endl;
    }
    void save() {   }
    virtual void process(){ cout << "Apple::process()" << endl; }
    virtual ~Apple() {
        cout << "Calling ~Apple()..." << endl;
    }
};

void* myAlloc(size_t size) {
    return malloc(size);
}
void myFree(void* ptr) {
    return free(ptr);
}

inline void* operator new(size_t size) {
    cout << "global new()... \n"; return myAlloc(size);
}
inline void operator delete(void* ptr) {
    cout << "global delete()... \n"; myFree(ptr);
}

int main() {
    cout << "---------------------------------------------------" << endl;
    cout << "size of int: " << sizeof(int) << ", "
         << "size of double: " << sizeof(double) << ", "
         << "size of char: " << sizeof(char) << endl;
    cout << "size of Fruit: " << sizeof(Fruit) << endl;
    cout << "size of Apple: " << sizeof(Apple) << endl;

    Fruit fr;
    Apple ap;
    cout << "Address of Vptr in fr: " << (int*)(&fr) << endl;
    cout << "Address of Vptr in ap: " << (int*)(&ap) << endl;

    cout << "Address of Vtbl in fr: " << *((int*)(&fr)) << endl;
    cout << "Address of Vtbl in ap: " << *((int*)(&ap)) << endl;

    cout << "Address of Vfunc of fr: " << (int*)(*((int*)(&fr))) << endl;
    cout << "Address of Vfunc of ap: " << (int*)(*((int*)(&ap))) << endl;


    typedef void(*Fun)(void);
    Fun pFun = NULL;
    pFun = (Fun)*((int*)(*((int*)(&fr))));
    pFun();
    pFun = (Fun)*((int*)(*((int*)(&ap))));
    pFun();

    cout << endl << endl;
    cout << "------Display Data Member of Fruit Object fr: " << endl;

    cout << "Address of no: " << (int*)(&fr) + 1 << endl;
    cout << "no = " <<  *((int*)(&fr) + 1) << endl;

    cout << "Address of weight: " << (double*)((int*)(&fr) + 2) << endl;
    cout << "weight = " << *((double*)((int*)(&fr) + 2)) << endl;

    cout << "Address of key: " << (int*)(((double*)((int*)(&fr) + 2)) + 1) << endl;
    cout << "key = " << (char)*(int*)(((double*)((int*)(&fr) + 2)) + 1)<< endl;

    cout << "------Display Data Member of Apple Object ap: " << endl;

    cout << "Address of no: " << (int*)(&ap) + 1 << endl;
    cout << "no = " <<  *((int*)(&ap) + 1) << endl;

    cout << "Address of weight: " << (double*)((int*)(&ap) + 2) << endl;
    cout << "weight = " << *((double*)((int*)(&ap) + 2)) << endl;

    cout << "Address of key: " << (int*)(((double*)((int*)(&ap) + 2)) + 1) << endl;
    cout << "key = " << (char)*(int*)(((double*)((int*)(&ap) + 2)) + 1)<< endl;

    cout << "Address of size: " << (int*)(((double*)((int*)(&ap) + 2)) + 1) + 1 << endl;
    cout << "size = " << *((int*)(((double*)((int*)(&ap) + 2)) + 1) + 1) << endl;

    cout << "Address of type: " << (int*)(((double*)((int*)(&ap) + 2)) + 1) + 2  << endl;
    cout << "type = " << (char)*((int*)(((double*)((int*)(&ap) + 2)) + 1) + 2) << endl;
    cout << "----------------------------------------------------" << endl;

    Fruit fru = Fruit(4, 3.5, 'l');
    Apple app = Apple(6, 4.7, 'm', 2, 'u');
    cout << "----------------------------------------------------" << endl;
    Apple* pApp = new Apple();
    delete pApp;
    cout << "----------------------------------------------------" << endl;

    return 0;
}

以GNU GCC Complier进行测试，运行结果如下图：

程序运行结果.png

对象内存分布图如下：

对象内存分布图.png

图中未画出RTTI相关信息。

由于以8个字节为存储单位进行内存对齐，在对象 fr 的成员 key 之后存在4个字节的空间，使得内存对齐，同样地，在对象 ap 的成员 type 之后也有4个字节的空间以使内存对齐。