CODEWITHSUNDEEP
c++memorylambda
BWG
BWG

Reputation: 2288

Where are lambda captured variables stored?

How is it possible that this example works? It prints 6:

#include <iostream>
#include <functional>

using namespace std;

void scopeIt(std::function<int()> &fun) {
    int val = 6;
    fun = [=](){return val;}; //<-- this
}

int main() {
    std::function<int()> fun;

    scopeIt(fun);

    cout << fun();

    return 0;
}

Where is the value 6 stored after scopeIt is done being called? If I replace the [=] with a [&], it prints 0 instead of 6.

Upvotes: 29

Views: 5488

Answers (4)

Drew Dormann
Drew Dormann

Reputation: 63911

It is stored within the closure, which - in your code - is then stored within std::function<int()> &fun.

A lambda generates what's equivalent to an instance of a compiler generated class.

This code:

[=](){return val;}

Generates what's effectively equivalent to this... this would be the "closure":

struct UNNAMED_TYPE
{
  UNNAMED_TYPE(int val) : val(val) {}
  const int val;
  // Above, your [=] "equals/copy" syntax means "find what variables
  //           are needed by the lambda and copy them into this object"

  int operator() () const { return val; }
  // Above, here is the code you provided

} (val);
// ^^^ note that this DECLARED type is being INSTANTIATED (constructed) too!!

Upvotes: 22

Columbo
Columbo

Reputation: 60999

The so-called closure type (which is the class type of the lambda expression) has members for each captured entity. Those members are objects for capture by value, and references for capture by reference. They are initialized with the captured entities and live independently within the closure object (the particular object of closure type that this lambda designates).

The unnamed member that corresponds to the value capture of val is initialized with val and accessed from the inside of the closure types operator(), which is fine. The closure object may easily have been copied or moved multiple times until that happens, and that's fine too - closure types have implicitly defined move and copy constructors just as normal classes do.
However, when capturing by reference, the lvalue-to-rvalue conversion that is implicitly performed when calling fun in main induces undefined behavior as the object which the reference member referred to has already been destroyed - i.e. we are using a dangling reference.

Upvotes: 8

Cornstalks
Cornstalks

Reputation: 38228

Lambdas in C++ are really just "anonymous" struct functors. So when you write this:

int val = 6;
fun = [=](){return val;};

What the compiler is translating that into is this:

int val = 6;
struct __anonymous_struct_line_8 {
    int val;
    __anonymous_struct_line_8(int v) : val(v) {}

    int operator() () const {
        return val; // returns this->val
    }
};

fun = __anonymous_struct_line_8(val);

Then, std::function stores that functor via type erasure.

When you use [&] instead of [=], it changes the struct to:

struct __anonymous_struct_line_8 {
    int& val; // Notice this is a reference now!
    ...

So now the object stores a reference to the function's val object, which becomes a dangling (invalid) reference after the function exits (and you get undefined behavior).

Upvotes: 20

Brian Bi
Brian Bi

Reputation: 119427

The value of a lambda expression is an object of class type, and

For each entity captured by copy, an unnamed non-static data member is declared in the closure type.

([expr.prim.lambda]/14 in C++11)

That is, the object created by the lambda

[=](){return val;}

actually contains a non-static member of int type, whose value is 6, and this object is copied into the std::function object.

Upvotes: 3

Related Questions