why vtable address is overwritten on delete the object?

Hi, all.

I don't know why vtable address is overwritten when an object is
deleted. Is this any Standard behavior or only g++ stuff?

I wanted my MemPool class had more feature. So I added a feature that
is able to detect double delete. This is done by below code snippet.

template <class T>
class MemPool
{
....
     static void operator delete (void* p, size_t s)
     {
         Chunk* c = ((Chunk*)((char*)(p)-(unsigned
long)(&(((Chunk*)0)->buf)))); // Chunk is actually allocated memory
block. User only has c->buf pointer.
         --(c->count); // this is incremented by one when object is
newed.
         if (c->count != 0) {
             // detect double delete!!
             // print some debugging message
             return; // just return, not delete
         }
         do_delete(p); // put p to free memory list
     }
};

With my simple test codes, it worked fine. But after applying to real
codes, core dump occurred. :-(

After some investigations, I found the p pointer is different between
two deletes.

The code is like this.
---------------------------
struct B
{
virtual ~B() {...}
};

struct D : B
{
virtual ~D() {...}
};

D* d = new D;

void** c = (void**) d;
printf("%x %x %x\n", *c, *(c+1), d);
delete d;

void** c = (void**) d;
printf("%x %x %x\n", *c, *(c+1), d);
delete d;
---------------------------

The result is something like below.
---------------------------
8059b68 0 9a5504c
~D
~B
8059c48 0 9a5504c
~B
?????????????????????????????????????? ???????????? ==> Segmentation Fault in Korean.
---------------------------

nm result is the following.

08059c40 V vtable for B
08059b60 V vtable for D
          U vtable for __cxxabiv1::__class_type_info
          U vtable for __cxxabiv1::__si_class_type_info
          U vtable for __cxxabiv1::__vmi_class_type_info
---------------------------

As you can see, the vtable address is overwritten, and the address
might be virtual destructor. So the second delete calls wrong
destructor and core dump before my operator delete is called.

Can it be avoidable? or any idea to detect double delete?

Thanks~
Wongoo.

      [ See http://www.gotw.ca/resources/clcm.htm for info about ]
      [ comp.lang.c++.moderated. First time posters: Do this! ]