Let us take a look at what the C++ compiler generates for us when we use the keywords new, new[], delete, and delete[](I will skip over std::nothrow versions in this post).
new
When you write this:
|
1 |
T* t1 = new T; |
The compiler really generates this:
|
1 2 3 4 5 6 7 8 9 10 |
T* t2 = (T*)operator new(sizeof(T)); try { new (t2) T; } catch(...) { operator delete(t2); throw; } |
First, using operator new the memory for T is allocated. If the allocation fails it will throw std::bad_alloc exception. Next (line 4) the object of type T is being constructed in the memory address t2 (this is called placement new). This however may fail due to T’s constructor throwing an exception. The language guarantees that if that happens, the allocated memory will be freed. The code in line 6 will catch any exception emitted by T’s constructor. Line 8 will then free the memory, and finally line 9 will re-throw the exception.
delete
This one-liner:
|
1 |
delete t1; |
Becomes this:
|
1 2 |
t2->~T(); operator delete(t2); |
In line 1 T’s destructor is called, and in line 2 the memory is freed using operator delete. All is good until T’s destructor throws an exception. Noticed the lack of try-catch block? If T’s destructor throws, line 2 will never be executed. This is a memory leak and reason why you should never throw exceptions from destructors; see Effective C++ by Scott Meyers, Item #8.
new[]
Things are about to get interesting. This innocent looking snippet of code:
|
1 2 |
#define HOW_MANY 3 T* t3 = new T[HOW_MANY]; |
Becomes (gasp), more or less 😉 , this:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
T* t4 = (T*)operator new(sizeof(size_t) + HOW_MANY * sizeof(T)); *((size_t*)t4) = HOW_MANY; t4 = (T*)(((std::byte*)t4) + sizeof(size_t)); for(size_t i = 0; i < HOW_MANY; ++i) { try { new (t4 + i) T; } catch(...) { for(size_t i2 = 0; i2 < i; ++i2) t4[i2].~T(); t4 = (T*)(((std::byte*)t4) - sizeof(size_t)); operator delete(t4); throw; } } |
So what happens when we allocate an array of objects on the heap? Where do we store the number of objects allocated which needs to be referenced later when deleting the array?
The compiler will generate code that allocates enough space for
HOW_MANY instances of
T, plus
sizeof(size_t) bytes to store the number of objects created and will place the object count at offset 0 of the allocated memory block. Moreover the language guarantees that it will either allocate and construct ALL instances of
T, or none. So what happens if halfway through constructing the objects in the array one of the constructors throws an exception? The compiler will generate proper cleanup code to deal with this scenario. This is what the above code illustrates. Let’s go through it line by line.
Line 1 allocates enough space for
HOW_MANY objects plus
sizeof(size_t) bytes for the number of objects in the array.
Line 2 stores the number of objects at offset 0 of the memory block.
Line 3 advances the pointer
t4 by
sizeof(size_t) bytes to where the first
T will be created.
Line 4 is the loop inside which we’ll be creating the instances of
T one by one.
Line 8 creates an instance of
T at the right memory location inside the array using placement new (same as when constructing a single instance of
T).
Line 10 catches any possible exception from
T’s constructor and begins the cleanup block of partially constructed array.
Line 12 defines the loop that will destroy all instances of
T created up to the point of exception being thrown.
Line 13 calls the destructor of
T.
Line 14 moves the pointer
t4 back by
sizeof(size_t) bytes to the beginning of the memory block allocated for the array.
Line 15 frees the previously allocated memory block.
Line 16, after having done all the cleanup, re-throws the exception.
delete[]
The following array delete statement:
|
1 |
delete [] t3; |
Is turned into something like this:
|
1 2 3 4 5 |
size_t how_many = *(size_t*)(((std::byte*)t4) - sizeof(size_t)); for(size_t i = 0; i < how_many; ++i) t4[i].~T(); t4 = (T*)(((std::byte*)t4) - sizeof(size_t)); operator delete(t4); |
The compiler now has to generate code to first destroy all the instances of
T stored in the array before deallocating the memory. After allocating the array of
T’s the
t4 pointed at the first object in the array, not at the beginning of the memory block. That’s why…
Line 1 subtracts
sizeof(size_t) bytes from
t4 and retrieves the number of objects in the array.
Line 2 starts the loop that will call every
T’s destructor.
Line 3 destroys each instance of
T.
Line 4 moves the
t4 pointer back by
sizeof(size_t) bytes to point at the beginning of the memory block.
Line 5, after all
T’s have been destroyed, frees the memory block.
Due to a lack of try-catch block the same principle of not throwing exceptions from destructors applies here as well.
Complete listing:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
#include <iostream> #include <iomanip> #include <new> struct T { T() { std::cout << "T() @ " << std::hex << std::showbase << this << std::endl; } ~T() { std::cout << "~T() @ " << std::hex << std::showbase << this << std::endl; } }; int main(int argc, char** argv) { // new // this: T* t1 = new T; // becomes this: T* t2 = (T*)operator new(sizeof(T)); try { new (t2) T; } catch(...) { operator delete(t2); throw; } // delete // this: delete t1; // becomes this: t2->~T(); operator delete(t2); // new [] // this: #define HOW_MANY 3 T* t3 = new T[HOW_MANY]; // becomes this: T* t4 = (T*)operator new(sizeof(size_t) + HOW_MANY * sizeof(T)); *((size_t*)t4) = HOW_MANY; t4 = (T*)(((std::byte*)t4) + sizeof(size_t)); for(size_t i = 0; i < HOW_MANY; ++i) { try { new (t4 + i) T; } catch(...) { for(size_t i2 = 0; i2 < i; ++i2) t4[i2].~T(); t4 = (T*)(((std::byte*)t4) - sizeof(size_t)); operator delete(t4); throw; } } // delete [] // this: delete [] t3; // becomes: size_t how_many = *(size_t*)(((std::byte*)t4) - sizeof(size_t)); for(size_t i = 0; i < how_many; ++i) t4[i].~T(); t4 = (T*)(((std::byte*)t4) - sizeof(size_t)); operator delete(t4); return 1; } |
In the equivalence code at the start, the allocation and deallocation function calls are qualified with the global namespace, while the placement
new
expression is not so qualified.
That’s exactly opposite of how things work.
In particular, if a class defines an allocation function with extra arguments, if the constructor throws those arguments are forwarded to the class’ corresponding deallocation function. It’s the only case where such “placement
delete
” is called automatically. And as mentioned in my response in comp.lang.c++, this mechanism was once a key factor in an infamous bug in Microsoft’s MFC framework, where memory was leaked only in debug builds…
Thanks for your comment Alf. I corrected the listing to not qualify the operators with global namespace.