一件被误导很久的事：关于new和delete

当你写下new和delete的时候，到底发生了什么事呢，让我们来做个试验看看。

写一段小代码：

class a
{
public:
	a()
	{
		foo();
	}
	int foo()
	{
		return 0;
	}

	~a()
	{
		bar();
	}

	int bar()
	{
		return 1;
	}
};

int _tmain(int argc, _TCHAR* argv[])
{
	a* tmp = new a();
	delete tmp;
	return 0;
}

 

在main函数的第一句下断点，调试，然后开汇编窗口输出结果：

int _tmain(int argc, _TCHAR* argv[])
{
004113F0  push        ebp  
004113F1  mov         ebp,esp 
004113F3  push        0FFFFFFFFh 
004113F5  push        offset __ehhandler$_wmain (41478Eh) 
004113FA  mov         eax,dword ptr fs:[00000000h] 
00411400  push        eax  
00411401  sub         esp,100h 
00411407  push        ebx  
00411408  push        esi  
00411409  push        edi  
0041140A  lea         edi,[ebp-10Ch] 
00411410  mov         ecx,40h 
00411415  mov         eax,0CCCCCCCCh 
0041141A  rep stos    dword ptr es:[edi] 
0041141C  mov         eax,dword ptr [___security_cookie (418000h)] 
00411421  xor         eax,ebp 
00411423  push        eax  
00411424  lea         eax,[ebp-0Ch] 
00411427  mov         dword ptr fs:[00000000h],eax 
	/*a* tmp = new a();*/
0041142D  push        1    
0041142F  call        operator new (4111A4h) 
00411434  add         esp,4 
00411437  mov         dword ptr [ebp-0F8h],eax 
0041143D  mov         dword ptr [ebp-4],0 
00411444  cmp         dword ptr [ebp-0F8h],0 
0041144B  je          wmain+70h (411460h) 
0041144D  mov         ecx,dword ptr [ebp-0F8h] 
00411453  call        a::a (41101Eh) 
00411458  mov         dword ptr [ebp-10Ch],eax 
0041145E  jmp         wmain+7Ah (41146Ah) 
00411460  mov         dword ptr [ebp-10Ch],0 
0041146A  mov         eax,dword ptr [ebp-10Ch] 
00411470  mov         dword ptr [ebp-104h],eax 
00411476  mov         dword ptr [ebp-4],0FFFFFFFFh 
0041147D  mov         ecx,dword ptr [ebp-104h] 
00411483  mov         dword ptr [ebp-14h],ecx 
	/*delete tmp;*/
00411486  mov         eax,dword ptr [ebp-14h] 
00411489  mov         dword ptr [ebp-0E0h],eax 
0041148F  mov         ecx,dword ptr [ebp-0E0h] 
00411495  mov         dword ptr [ebp-0ECh],ecx 
0041149B  cmp         dword ptr [ebp-0ECh],0 
004114A2  je          wmain+0C9h (4114B9h) 
004114A4  push        1    
004114A6  mov         ecx,dword ptr [ebp-0ECh] 
004114AC  call        a::`scalar deleting destructor' (41117Ch) 
004114B1  mov         dword ptr [ebp-10Ch],eax 
004114B7  jmp         wmain+0D3h (4114C3h) 
004114B9  mov         dword ptr [ebp-10Ch],0 
	/*return 0;*/
004114C3  xor         eax,eax 
}
004114C5  mov         ecx,dword ptr [ebp-0Ch] 
004114C8  mov         dword ptr fs:[0],ecx 
004114CF  pop         ecx  
004114D0  pop         edi  
004114D1  pop         esi  
004114D2  pop         ebx  
004114D3  add         esp,10Ch 
004114D9  cmp         ebp,esp 
004114DB  call        @ILT+345(__RTC_CheckEsp) (41115Eh) 
004114E0  mov         esp,ebp 
004114E2  pop         ebp  
004114E3  ret    

 

前面一片调整stack,插入安全代码，设置异常处理等的操作不是今天我们要说的重点,直接跳到a* tmp = new a();这一句产生的反汇编:

0041142F call operator new (4111A4h)

我们很明确的看到调用了一个函数operator new。继续跟进operator new看到底做了什么事情：

void *__CRTDECL operator new(size_t size) _THROW1(_STD bad_alloc)
        {       // try to allocate size bytes
        void *p;
        while ((p = malloc(size)) == 0)
                if (_callnewh(size) == 0)
                {       // report no memory
                static const std::bad_alloc nomem;
                _RAISE(nomem);
                }

        return (p);
        }

 

很意外吧，其实operator new函数就做了那么一件事情：调用malloc函数分配内存。有没有负责调用构造函数？这个真没有。。。

那构造函数到底是谁调用的？看operator new下面的那片汇编代码：

00411434  add         esp,4 
00411437  mov         dword ptr [ebp-0F8h],eax 
0041143D  mov         dword ptr [ebp-4],0 
00411444  cmp         dword ptr [ebp-0F8h],0 
0041144B  je          wmain+70h (411460h) 
0041144D  mov         ecx,dword ptr [ebp-0F8h] 
00411453  call        a::a (41101Eh) 

出去将返回值赋给tmp的操作，我们看到了一处函数调用：

00411453 call a::a (41101Eh) 

没错，对类a的构造函数的调用，是编译器偷偷在你的函数里插入的，当时的情况就是如此。delete的情况也是一摸一样。

再来看针对对象数组的new和delete:

class a
{
public:
	a()
	{
		int i1;
		int j1 = 0;
		static int k1;
		static int l1 = 0;
		foo();
	}
	int foo()
	{
		return 0;
	}

	~a()
	{
		int i2;
		int j2 = 0;
		static int k2;
		static int l2 = 0;
		bar();
	}

	int bar()
	{
		return 1;
	}
};

int _tmain(int argc, _TCHAR* argv[])
{
	a* tmp = new a[10];
	delete[] tmp;
	return 0;
}

 

反汇编之后的结果如下:

int _tmain(int argc, _TCHAR* argv[])
{
004113F0  push        ebp  
004113F1  mov         ebp,esp 
004113F3  push        0FFFFFFFFh 
004113F5  push        offset __ehhandler$_wmain (41478Eh) 
004113FA  mov         eax,dword ptr fs:[00000000h] 
00411400  push        eax  
00411401  sub         esp,100h 
00411407  push        ebx  
00411408  push        esi  
00411409  push        edi  
0041140A  lea         edi,[ebp-10Ch] 
00411410  mov         ecx,40h 
00411415  mov         eax,0CCCCCCCCh 
0041141A  rep stos    dword ptr es:[edi] 
0041141C  mov         eax,dword ptr [___security_cookie (418000h)] 
00411421  xor         eax,ebp 
00411423  push        eax  
00411424  lea         eax,[ebp-0Ch] 
00411427  mov         dword ptr fs:[00000000h],eax 
	a* tmp = new a[10];
0041142D  push        0Eh  
0041142F  call        operator new (4111A4h) 
00411434  add         esp,4 
00411437  mov         dword ptr [ebp-0F8h],eax 
0041143D  mov         dword ptr [ebp-4],0 
00411444  cmp         dword ptr [ebp-0F8h],0 
0041144B  je          wmain+97h (411487h) 
0041144D  mov         eax,dword ptr [ebp-0F8h] 
00411453  mov         dword ptr [eax],0Ah 
00411459  push        offset a::`scalar deleting destructor' (41100Ah) 
0041145E  push        offset a::a (41101Eh) 
00411463  push        0Ah  
00411465  push        1    
00411467  mov         ecx,dword ptr [ebp-0F8h] 
0041146D  add         ecx,4 
00411470  push        ecx  
00411471  call        `eh vector constructor iterator' (4111F9h) 
00411476  mov         edx,dword ptr [ebp-0F8h] 
0041147C  add         edx,4 
0041147F  mov         dword ptr [ebp-10Ch],edx 
00411485  jmp         wmain+0A1h (411491h) 
00411487  mov         dword ptr [ebp-10Ch],0 
00411491  mov         eax,dword ptr [ebp-10Ch] 
00411497  mov         dword ptr [ebp-104h],eax 
0041149D  mov         dword ptr [ebp-4],0FFFFFFFFh 
004114A4  mov         ecx,dword ptr [ebp-104h] 
004114AA  mov         dword ptr [ebp-14h],ecx 
	delete[] tmp;
004114AD  mov         eax,dword ptr [ebp-14h] 
004114B0  mov         dword ptr [ebp-0E0h],eax 
004114B6  mov         ecx,dword ptr [ebp-0E0h] 
004114BC  mov         dword ptr [ebp-0ECh],ecx 
004114C2  cmp         dword ptr [ebp-0ECh],0 
004114C9  je          wmain+0F0h (4114E0h) 
004114CB  push        3    
004114CD  mov         ecx,dword ptr [ebp-0ECh] 
004114D3  call        a::`vector deleting destructor' (4111F4h) 
004114D8  mov         dword ptr [ebp-10Ch],eax 
004114DE  jmp         wmain+0FAh (4114EAh) 
004114E0  mov         dword ptr [ebp-10Ch],0 
	return 0;
004114EA  xor         eax,eax 
}
004114EC  mov         ecx,dword ptr [ebp-0Ch] 
004114EF  mov         dword ptr fs:[0],ecx 
004114F6  pop         ecx  
004114F7  pop         edi  
004114F8  pop         esi  
004114F9  pop         ebx  
004114FA  add         esp,10Ch 
00411500  cmp         ebp,esp 
00411502  call        @ILT+345(__RTC_CheckEsp) (41115Eh) 
00411507  mov         esp,ebp 
00411509  pop         ebp  
0041150A  ret         

 

其他部分都大同小异,关键的不同在编译器插入的,用于初始化的代码:

00411459  push        offset a::`scalar deleting destructor' (41100Ah) 
0041145E  push        offset a::a (41101Eh) 
00411463  push        0Ah  
00411465  push        1    
00411467  mov         ecx,dword ptr [ebp-0F8h] 
0041146D  add         ecx,4 
00411470  push        ecx  
00411471  call        `eh vector constructor iterator' (4111F9h)

我们看到数组大小0Ah,构造函数的地址41101Eh都被压入栈中，作为某函数的参数。到底是什么函数呢？就是：

00411471  call        `eh vector constructor iterator' (4111F9h)

一个名为`eh vector constructor iterator' 的函数。我们还注意到a类的析构函数的地址也被当成参数传入，这是干什么用的呢？构造函数里为什么要析构函数的地址？比如在遍历调用构造函数的过程中，前8个都是没问题的，到第9个突然资源不足调用失败了，那么在返回前无论如何也要先把前8个的析构函数调用一遍，防止资源泄露。

delete[]的过程也大同小异，不过一个很有趣的地方是，“vector deleting destructor'”是a类的成员函数，而与‘eh vector constructor iterator’对应的`eh vector destructor iterator'函数在“vector deleting destructor'”函数内部：

004134AD  call        `eh vector destructor iterator' (411203h) 
。。。

004134C1  call        operator delete (4110A0h)

回收内存的操作，也在a::`vector deleting destructor'里。