Fading Coder

One Final Commit for the Last Sprint

Home > Tech > Content

C++ Virtual Function Dispatch: Static and Dynamic Binding Mechanics

Tech Apr 17 9

Consider the behavior of default arguments combined with virtual function overrides:

class BaseClass {
public:
    virtual void DisplayValue(int val = 10);
};

void BaseClass::DisplayValue(int val) {
    std::cout << "BaseClass::DisplayValue, val = " << val << std::endl;
}

class DerivedClass : public BaseClass {
public:
    void DisplayValue(int val = 20) override;
};

void DerivedClass::DisplayValue(int val) {
    std::cout << "DerivedClass::DisplayValue, val = " << val << std::endl;
}

Execution scenarios:

DerivedClass derivedObj;
BaseClass* basePtr = (BaseClass*)&derivedObj;

basePtr->DisplayValue();
(*basePtr).DisplayValue();
derivedObj.DisplayValue();
((BaseClass)derivedObj).DisplayValue();

Compiler implementation details reveal distinct binding mechanisms for these calls:

  1. Direct Object Invocation (derivedObj.DisplayValue()): The compiler resolves the target function address at compile time, resulting in static binding. The call is directly hardcoded to DerivedClass::DisplayValue() with out traversing the vtable.

  2. Pointer and Dereferenced Pointer Invocation (basePtr->DisplayValue() and (*basePtr).DisplayValue()): Both invoke dynamic binding. The generated assembly retrieves the vtable pointer from the object's memory, locates the appropriate function slot, and performs an indirect call. The runtime type of the object dictates which implementation executes.

  3. Object Slicing via Cast (((BaseClass)derivedObj).DisplayValue()): This cast triggers object slicing. A completely new, temporary BaseClass instance is constructed using the base class copy constructor. During the execution of this copy constructor, the vptr of the new object is explicitly set to BaseClass::vftable, overwriting the original DerivedClass vptr. Consequently, the dynamic dispatch resolves to BaseClass::DisplayValue. Modifying members within this temporary sliced object affects only the temporary copy and leaves the original derivedObj unaltered.

Related Articles

Comprehensive Guide to SSTI Explained with Payload Bypass Techniques

Introduction Server-Side Template Injection (SSTI) is a vulnerability in web applications where user input is improper handled within the template engine and executed on the server. This exploit can r...

Implement Image Upload Functionality for Django Integrated TinyMCE Editor

Django’s Admin panel is highly user-friendly, and pairing it with TinyMCE, an effective rich text editor, simplifies content management significantly. Combining the two is particular useful for bloggi...

SBUS Signal Analysis and Communication Implementation Using STM32 with Fus Remote Controller

Overview In a recent project, I utilized the SBUS protocol with the Fus remote controller to control a vehicle's basic operations, including movement, lights, and mode switching. This article is aimed...

Leave a Comment

Anonymous

◎Feel free to join the discussion and share your thoughts.