1

In my opinion, a class should provide a well defined abstraction and no private members should be modified without the knowledge of class. But when I checked the "auto_ptr" (or any other smart pointer), this rule is violated. Please see the following code

class Foo{
public:
   Foo(){}
};

int main(int argc, char* argv[])
{
   std::auto_ptr<Foo> fooPtr(new Foo);
   delete fooPtr.operator ->();
   return 0;
}

The operator overload (->) gives the underlying pointer and it can be modified without the knowledge of "auto_ptr". I can't think it as a bad design as the smart pointers are designed by C++ geeks, but I am wondering why they allowed this. Is there any way to write a smart pointer without this problem.

Appreciate your thoughts.

1
  • 1
    I can't think of many useful classes that don't have things like this. It's handy, but don't be stupid with it. delete[] &vector[0]; Mar 21, 2012 at 22:15

6 Answers 6

5

There are two desirable properties a smart pointer should have:

  1. The raw pointer can be retrieved (e.g. for passing to legacy library functions)
  2. The raw pointer cannot be retrieved (to prevent double-delete)

Obviously, these properties are contradictory and cannot be realised at the same time! Even Boost's shared_ptr<Foo> et al. have get(), so they have this "problem." In practice, the first is more important, so the second has to go.

By the way, I'm not sure why you reached for the slightly obscure operator->() when the ordinary old get() method causes the same problem:

std::auto_ptr<Foo> fooPtr(new Foo);
delete fooPtr.get();
4
  • 1
    Re "for passing to legacy library functions": there no need to invoke legacy. Any function that does not care about ownership should not take a smart pointer as argument, but a raw one (or a reference). Apart from the fact that ownership might get in the way (many smart pointers do not tolerate multiple owners), a function should not impose a particular brand of ownership-management on its clients, unless it has to. Jun 27, 2014 at 12:25
  • @MarcvanLeeuwen: Good point, though I would replace "does not care about ownership" with "does not take ownership" -- every interface should care about (i.e. be explicit about) its ownership semantics. Jun 27, 2014 at 12:55
  • @MarcvanLeeuwen: Actually... Can you think of a situation in which it would be better for a non-ownership-taking function to take an argument by T* instead of by T&? I can't, and I think the latter is safer. Jun 27, 2014 at 12:57
  • I meant "doesn't care about" in the sense that whatever the function does has no relation to ownership, not that it wants to create memory leaks. But instead of grabbing ownership, it could also be giving away ownership, by storing something to be owned by a pointer passed by modifiable reference. And fr the other comment, the most obvious situation where a T* is necessary is when the pointer may be null. A more opportunistic argument might also be that you know the function needs to initialise a local pointer variable anyway; you might as well pass that pointer. Jun 27, 2014 at 15:58
4

In order to provide fast, convenient, "pointer-like" access to the underlying object, operator-> unfortunately has to "leak" its abstraction a bit. Otherwise, smart pointers would have to manually wrap all of the members that are allowed to be exposed. These either requires a lot of "configuration" work on the part of those instantiating the smart pointer, or a level of meta-programming that just isn't present in C++. Besides, as pyrsta points out, even if this hole was plugged, there are still many other (perhaps non-standard) ways to subvert C++'s access control mechanisms.

1
  • That makes perfect sense. Thanks Jan 15, 2009 at 3:18
2

Is there any way to write a smart pointer without this problem.

It isn't easy, and generally no (i.e., you can't do it for every, general Foo class).

The only way I can think of, to do this, would be by changing the declaration of the Foo class: make the Foo destructor private (or define a private delete operator as a member of the Foo class), and also specify in the declaration of the Foo class that std::auto_ptr<Foo> is a friend.

3
  • Yeah that is the only way I think. But the Foo has to be modified and all classes which will be used with auto_ptr. That is going to be overkill. Jan 15, 2009 at 3:15
  • People who use std::auto_ptr must know what it is, and how to use it. Sometimes, C++ makes bad things impossible; but sometimes it can't, and instead it only makes good things easy (where here the "good thing" is "remembering to delete the object", and the bad thing is "deleting it more than once").
    – ChrisW
    Jan 15, 2009 at 3:22
  • In C++, the developer is left all the tools to break the program. The best thing to do is to document the behaviour as well as the proper usage of one's code. And to follow the best practices as documented elsewhere. ;) Jan 15, 2009 at 3:29
2

No, there's no way to completely prohibit such bad usage in C++.

As a general rule, the user of any library code should never call delete on any wrapped pointers unless specifically documented. And in my opinion, all modern C++ code should be designed so that the user of the classes never was left the full responsibility to manually release her acquired resources (ie. use RAII instead).

Aside note: std::auto_ptr<T> isn't the best option anymore. Its bad behaviour on copying can lead to serious coding errors. Often a better idea is to use std::tr1::scoped_ptr<T> or std::tr1::shared_ptr<T> or their Boost variants instead.

Moreover, in C++0x, std::unique_ptr<T> will functionally supercede std::auto_ptr<T> as a safer-to-use class. Some discussion on the topic and a recent C++03 implementation for unique_ptr emulation can be found here.

1
  • Thanks. I was using auto_ptr just for explanation. I am using boost::shared_ptr. RAII looks interesting Jan 15, 2009 at 3:17
0

I don't think this shows that auto_ptr has an encapsulation problem. Whenever dealing with owned pointers, it is critical for people to understand who owns what. In the case of auto_ptr, it owns the pointer that it holds[1]; this is part of auto_ptr's abstraction. Therefore, deleting that pointer in any other way violates the contract that auto_ptr provides.

I'd agree that it's relatively easy to mis-use auto_ptr[2], which is very not ideal, but in C++, you can never avoid the fundamental issue of "who owns this pointer?", because for better or worse, C++ does not manage memory for you.

[1] Quote from cplusplus.com: "auto_ptr objects have the peculiarity of taking ownership of the pointers assigned to them": http://www.cplusplus.com/reference/std/memory/auto_ptr/

[2] For example, you might mistakenly believe that it has value semantics, and use it as a vector template parameter: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CEEQFjAD&url=http%3A%2F%2Fwww.gamedev.net%2Ftopic%2F502150-c-why-is-stdvectorstdauto_ptrmytype--bad%2F&ei=XU1qT5i9GcnRiAKCiu20BQ&usg=AFQjCNHigbgumbMG3MTmMPla2zo4LhaE1Q&sig2=WSyJF2eWrq2aB2qw8dF3Dw

0

I think this question addresses a non-issue. Smart pointers are there to manage ownership of pointers, and if doing so they make the pointer inaccessible, they fail their purpose.

Also consider this. Any container type gives you iterators over them; if it is such an iterator then &*it is a pointer to an item in the container; if you say delete &*it then you are dead. But exposing the adresses of its items is not a defect of container types.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.