Search

Admin

12.5 — The virtual table

By Alex, on February 8th, 2008

To implement virtual functions, C++ uses a special form of late binding known as the virtual table. The virtual table is a lookup table of functions used to resolve function calls in a dynamic/late binding manner. The virtual table sometimes goes by other names, such as “vtable”, “virtual function table”, “virtual method table”, or “dispatch table”.

Because knowing how the virtual table works is not necessary to use virtual functions, this section can be considered optional reading.

The virtual table is actually quite simple, though it’s a little complex to describe in words. First, every class that uses virtual functions (or is derived from a class that uses virtual functions) is given it’s own virtual table. This table is simply a static array that the compiler sets up at compile time. A virtual table contains one entry for each virtual function that can be called by objects of the class. Each entry in this table is simply a function pointer that points to the most-derived function accessible by that class.

Second, the compiler also adds a hidden pointer to the base class, which we will call *__vptr. *__vptr is set (automatically) when a class instance is created so that it points to the virtual table for that class. Unlike the *this pointer, which is actually a function parameter used by the compiler to resolve self-references, *__vptr is a real pointer. Consequently, it makes each class object allocated bigger by the size of one pointer. It also means that *__vptr is inherited by derived classes, which is important.

By now, you’re probably confused as to how these things all fit together, so let’s take a look at a simple example:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

classBase

{

public:

virtualvoidfunction1(){};

virtualvoidfunction2(){};

};

classD1:publicBase

{

public:

virtualvoidfunction1(){};

};

classD2:publicBase

{

public:

virtualvoidfunction2(){};

};

Because there are 3 classes here, the compiler will set up 3 virtual tables: one for Base, one for D1, and one for D2.

The compiler also adds a hidden pointer to the most base class that uses virtual functions. Although the compiler does this automatically, we’ll put it in the next example just to show where it’s added:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

classBase

{

public:

FunctionPointer*__vptr;

virtualvoidfunction1(){};

virtualvoidfunction2(){};

};

classD1:publicBase

{

public:

virtualvoidfunction1(){};

};

classD2:publicBase

{

public:

virtualvoidfunction2(){};

};

When a class object is created, *__vptr is set to point to the virtual table for that class. For example, when a object of type Base is created, *__vptr is set to point to the virtual table for Base. When objects of type D1 or D2 are constructed, *__vptr is set to point to the virtual table for D1 or D2 respectively.

Now, let’s talk about how these virtual tables are filled out. Because there are only two virtual functions here, each virtual table will have two entries (one for function1(), and one for function2()). Remember that when these virtual tables are filled out, each entry is filled out with the most-derived function an object of that class type can call.

Base’s virtual table is simple. An object of type Base can only access the members of Base. Base has no access to D1 or D2 functions. Consequently, the entry for function1 points to Base::function1(), and the entry for function2 points to Base::function2().

D1’s virtual table is slightly more complex. An object of type D1 can access members of both D1 and Base. However, D1 has overridden function1(), making D1::function1() more derived than Base::function1(). Consequently, the entry for function1 points to D1::function1(). D1 hasn’t overridden function2(), so the entry for function2 will point to Base::function2().

D2’s virtual table is similar to D1, except the entry for function1 points to Base::function1(), and the entry for function2 points to D2::function2().

Here’s a picture of this graphically:

Although this diagram is kind of crazy looking, it’s really quite simple: the *__vptr in each class points to the virtual table for that class. The entries in the virtual table point to the most-derived version of the function objects of that class are allowed to call.

So consider what happens when we create an object of type D1:

1

2

3

4

intmain()

{

D1 cClass;

}

Because cClass is a D1 object, cClass has it’s *__vptr set to the D1 virtual table.

Now, let’s set a base pointer to D1:

1

2

3

4

5

intmain()

{

D1 cClass;

Base*pClass=&cClass;

}

Note that because pClass is a base pointer, it only points to the Base portion of cClass. However, also note that *__vptr is in the Base portion of the class, so pClass has access to this pointer. Finally, note that pClass->__vptr points to the D1 virtual table! Consequently, even though pClass is of type Base, it still has access to D1’s virtual table.

So what happens when we try to call pClass->function1()?

1

2

3

4

5

6

intmain()

{

D1 cClass;

Base*pClass=&cClass;

pClass->function1();

}

First, the program recognizes that function1() is a virtual function. Second, uses pClass->__vptr to get to D1’s virtual table. Third, it looks up which version of function1() to call in D1’s virtual table. This has been set to D1::function1(). Therefore, pClass->function1() resolves to D1::function1()!

Now, you might be saying, “But what if Base really pointed to a Base object instead of a D1 object. Would it still call D1::function1()?”. The answer is no.

1

2

3

4

5

6

intmain()

{

Base cClass;

Base*pClass=&cClass;

pClass->function1();

}

In this case, when cClass is created, __vptr points to Base’s virtual table, not D1’s virtual table. Consequently, pClass->__vptr will also be pointing to Base’s virtual table. Base’s virtual table entry for function1() points to Base::function1(). Thus, pClass->function1() resolves to Base::function1(), which is the most-derived version of function1() that a Base object should be able to call.

By using these tables, the compiler and program are able to ensure function calls resolve to the appropriate virtual function, even if you’re only using a pointer or reference to a base class!

Calling a virtual function is slower than calling a non-virtual function for a couple of reasons: First, we have to use the *__vptr to get to the appropriate virtual table. Second, we have to index the virtual table to find the correct function to call. Only then can we call the function. As a result, we have to do 3 operations to find the function to call, as opposed to 2 operations for a normal indirect function call, or one operation for a direct function call. However, with modern computers, this added time is usually fairly insignificant.

Congratulations for the clear explanation!
But I still have a doubt… I took your code and made some changes on it to show you something. Look:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

#include <iostream>

usingnamespacestd;

classBase

{

public:

//FunctionPointer *__vptr;

virtualvoidfunction1(){cout<<"Base::function1()"<<endl;};

virtualvoidfunction2(){cout<<"Base::function1()"<<endl;};

};

classD1:publicBase

{

public:

virtualvoidfunction1(){cout<<"D1::function1()"<<endl;};

voidfunction2(){cout<<"D1::function2()"<<endl;};

};

classD2:publicBase

{

public:

virtualvoidfunction2(){};

};

intmain()

{

D1 obj;

Base*pb;

pb=&obj;

pb->function2();

return0;

}

I thought this way: once D1::function2() isn’t at the VTable of D1, cause it’s not virtual, and it’s also not in the scope of Base class, the only function2() *pb can see is the Base::function2(), inherited from the own base.

Really very good explanation.But still I have a doubt.The vtable is constructed at the compile time. Then how can it know the base pointer is pointed to some derived object and how can it calls the functions of that class.
I think the virtual table contains 2 more entries reserved for RTTI(Run time type identifier) and destructor.
I think RTTI do this operation to specify the base class pointer is pointing to some other derived class or not.

This is by far the most clear and non-confusing explanation on V-Tables I have come through. I was searching for something like this for such a long time. Thanks to all who contributed in this. Good Job friends. Keep it up.

This is really the perfect way of explaining V-Table mechanisam. Every C++ programmer should visit this topic.

But, i have one doubt. As it was specified, vptr is initialized when the instance of the class is created. But, if
the base calss is an Abstarct Class, then there is no way that an instance will be created for that class.
So, how the vptr of an Abstract Base class is initialized?

Thanks so much!!! really the best explaination I came across.
Can anyone explain to me, why a derived class pointer cannot point to a base class object. Why does it result in compiler error. The derived class object has everything the base is supposed to have?
Thanks again!

A derived class always has all the functionality of a base class, whereas the converse is not true. So if you have a base pointer, whether you set it to a base class or a derived class, you’re guaranteed the functional in the base class is present and can be accessed through the base pointer.

However, if you have a derived pointer, what happens when you set it to point at a base class and then try and access something that only exists in the derived class? It wouldn’t know what to do.

Very Good Explanation, this helped me alot to understand virtual table. I came across one query. Suppose I have a base class with non virtual function func1(), and virtual function func2(). I derived a class from this base class and this derived class has one non virtual function func3() and overrided virtual function func2(), than what would be the order of functions in virtual table of derived class?

I have one doubt.
As per your explanation “when a object of type Base
is created, *__vptr is set to point to the virtual
table for Base.”.

But if I create 3 objects of type Base, as per your
statement *__vptr is set to point to the virtual
table for Base 3 times. But what is the need of
setting __*vptr 3 times? Virtual table address
should be same for all the 3 times.

“vptr” cannot be static because if it were, it would be shared by all( as you said)
but when a base class object is made to instantiate a derived class object, the “vptr” then points to the v-table of the derived.therefore we need the vptr to point to different v-tables as per the context.

therefore vptr is not shared by objects(static), else they would had already done that
PS: v-tables are static for a class

Reply for “Comment by Siva Prasad. S ”
Abstract class cannot create object. Creating a pointer of abstract base class can only point to derived classes. So, the _vptr can in any case will point to only derived class vtable.

This Explanation is very very much nice.And very clear.
but i have one doubt here…
In above explanation how it executes only one function execution explained(i.e., function1()).
And function2() is not declared in first derived class so base class version is executed .
My doubt is without creating object for it how can we call to the function2() of base version…?
even a variable is declared and initialized , thats value is also appeared … as follows
class CBase
{
int a;
public:
CBase(){a = 5;}
virtual void function1(){}
virtual void function2(){cout << "this is function2() in base class and value of a is …" <function2();

Yes, the vtable entry will be NULL. If you think about it, a pure virtual function in a class makes it abstract which means we can never instantiate the class - which means we can’t call that function directly or indirectly from any base\derived class objects (we can’t create base class objects anyway and in case of derived class, if you define the “pure virtual function” of base class then you have provided the implementation. And if you don’t - then the derived class in turn becomes an abstract class. And so it goes on and on.

To cut it short - yes, it will have NULL. Then you might ask who is going to invoke the NULL function? Not me. No one can call it and it also wastes memory. So Microsoft came with its own invention for that, when you declare a class with __declspec(novtable) for abstract base classes - you are effectively saying - “I know what I am doing. I don’t want to declare the vtable for this abstract base class, since no one can instantiate an object of this class anyway. So please save some memory and donot construct the vtable. Thank you”.

Also consider C# - to declare a class as abstract all you have to do is:
“abstact class IAmIntuitiveAbstractClassDeclaration”

Isn’t that intuitive instead of define virtual function, and then make that virtual function “pure” - = 0? I might have as well said “you can declare an abstract base class by making one of the virutal functions a zombie and declare it like this

Because cClass is a D1 object, cClass has it’s *__vptr set to the D1 virtual table.
And then you set a base pointer to D1.
Because pClass is a base pointer, it only points to the Base portion of cClass. However, also note that *__vptr is in the Base portion of the class. so pClass has access to this pointer. Finally, note that pClass->__vptr points to the D1 virtual table!

Very nice explanation on Vtable..ThankQ
but i have one basic doubt.
we created appropriate object and compiled.
Vtable and object creation(so *vptr is initialized) everything is done during compile time itself.and we clearly mentioned base pointer is pointed to derived obj.So what is the special thing that will happen during run time and why it called late binding.

Object allocation in the memory will be done at run time and assignment of that allocated memory address can be assigned only at Run time.
This will happen at the Run time and hence called ‘Late binding’.

Its really good and simple to understand about Virtual function and VTable. Can you please explain the second step in your explanation [Index the virtual table to find the correct function to call].
Thank you.

Here you are creating object of D2 and storing it in base class pointer ptr.
Since there is no relation between D1 and D2, typecasting of ptr to D1 will lead to heap corruption.
I came across this type of issue in my code.

consider array of derived class object {d[0],d[1],d[2],d[4],d[5]};
and base class pointer points the first element of the array.
what is the output when increment the base class pointer. where it is point?

This makes the question: In which compilation unit the vtable of a class is placed by the compiler. For instance, if we have the case:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

[classA.h]

structA{

virtualvoidf();

virtualvoidg();

};

[classAf.cpp]

#include "classA.h"

voidA::f(){}

[classAg.cpp]

#include "classA.h"

voidA::g(){}

<!--formatted-->

most compilers will do somewhat like this: The vtable is placed in the object file with the definition of the first non-pure, non-inline, virtual function of the class (classAf.o in this example) with external linkage.

But what if we have:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

[classA.h]

structA{

virtualvoidf(){}// virtual, but inlined

};

[classB.h]

#include "classA.h"

structB:publicA{

voidf(){}

};

[main.cpp]

#include "classB.h"

voiduseA1(A*);

voiduseA2(A*);

A*a=newB();

useA1(a);

useA2(a);

[useA1.cpp]

#include "classA.h"

voiduseA1(A*a){

a->f();// This should call B::f()

}

[useA2.cpp]

#include "classA.h"

voiduseA2(A*a){

a->f();// This should call B::f()

}

<!--formatted-->

useA1() and useA2() must have access to the vtable of class A, but where is it defined, since the compiler rule from previous example does not match here?

In can be defined in both useA1.cpp and useA2.cpp, but than it must have static linkage.

Hi Alex,
It is a very nice explanation.
I have one query: If *__vptr value is same for all instances of a class. why it can not be “static” (initialized only once per class) and why it needs to be replicated in all instances (which adds additional pointer size to all instances).

void value()
{
cout << "In wheel4 value" <value();
}
After the execution of ptr->value(), the function present in the class “vehicle” is
getting executed. As per my understanding the “value” present in wheel4 should
be executed.

Now in this case i think every time runtime reindexing will happen on the vitual table of C1 class before pointing base class _vptr to point to the C1 class vtable so that it only access the correct method list so first reindexing then pointing. am i right?

Then my next point is after reindexing base class will be able to access the destructor of the derived class if we declare the destructor as virtual in base class. As we know the signature of the destructor is varying form base to derived class then through which mechanism it is resolving the destructor signature issue.

Marvellous!! I think i have got a perfect answer for my long lasting question.
The way each and every step has been explained is crystal clear. Moreover,
I have been through almost all the comments and found them interersting which faded away
my ambiguity regarding this topic.

That was a really good article. However I have a question. What if objects of both base classes are created before you use a pointer of type BaseClass. Eg:
D1 c1Class;
D2 c2Class;
Base *pClass = &c1Class;

All you are doing is making a base pointer (pClass) that points to an already created derived class (D1). This is standard practice and the *__vpr points to the virtual function table for a D1 object type.

I have a question for this example.
class A
{
public:
virtual void Function1();
virtual void Function2()=0;
}
class B : public A
{
public:
void Function1();
void Function2();
}
class C : public B
{
public:
void Function1();
void Funtion2();
}
1.In this case,when i create an object of type C, where the __vptr will point to?
2.Is there any different with the pure function when a vtable is created in class A?

Suppose a base pointer is pointing to an object of D1, and now I want to override the virtualization via the base pointer (covered in 12.3). That is, I want to use Base::function1() instead of D1::function1(). The question is, how does the virtual table schematic work out this case?

According to the tutorial, the Base::function1() is replaced by D1::function1() in D1’s virtual table, so it has already lost track of the original Base::function1(), so how can it recall where the Base::function1() is?