警告:这只是为那些热衷于破坏事物以了解其机制的人提供的练习。
我正在探索我在 C# 中可以完成的事情的限制，并且我编写了一个 ForceCast() 函数来执行没有任何类型检查的强力转换。 切勿考虑在生产代码中使用此函数。
我写了一个名为 Original 的类和一个名为 LikeOriginal 的结构，它们都有两个整数变量。在 Main() 中，我创建了一个名为 orig 的新变量，并将其设置为 Original 的新实例，其中 a=7 和 b=20。当orig被转换为LikeOriginal并存储在casted中时，cG和dG的值code> 变为未定义，这是预期的，因为 LikeOriginal 是一个结构，类实例包含比结构实例更多的元数据，从而导致内存布局不匹配。
示例输出:
Casted Original to LikeOriginal
1300246376, 542
1300246376, 542
added 3
Casted LikeOriginal back to Original
1300246379, 545
但是请注意，当我调用 casted.Add(3) 并转换回 Original 并打印 a 和b，令人惊讶的是它们成功地增加了 3，并且这是可重复的。
让我感到困惑的是，将类转换为结构将导致 cG 和 dG 映射到类元数据，但是当它们被修改并转换回到一个类，它们正确地映射到 a 和 b。
为什么会这样？
使用的代码:
using System;
using System.Runtime.InteropServices;
namespace BreakingStuff {
public class Original {
public int a, b;
public Original(int a, int b)
{
this.a = a;
this.b = b;
}
public void Add(int val)
{
}
}
public struct LikeOriginal {
public int cG, dG;
public override string ToString() {
return cG + ", " + dG;
}
public void Add(int val) {
cG += val;
dG += val;
}
}
public static class Program {
public unsafe static void Main() {
Original orig = new Original(7, 20);
LikeOriginal casted = ForceCast<Original, LikeOriginal>(orig);
Console.WriteLine("Casted Original to LikeOriginal");
Console.WriteLine(casted.cG + ", " + casted.dG);
Console.WriteLine(casted.ToString());
casted.Add(3);
Console.WriteLine("added 3");
orig = ForceCast<LikeOriginal, Original>(casted);
Console.WriteLine("Casted LikeOriginal back to Original");
Console.WriteLine(orig.a + ", " + orig.b);
Console.ReadLine();
}
//performs a pointer cast but with the same memory layout.
private static unsafe TOut ForceCast<TIn, TOut>(this TIn input) {
GCHandle handle = GCHandle.Alloc(input);
TOut result = Read<TOut>(GCHandle.ToIntPtr(handle));
handle.Free();
return result;
}
private static unsafe T Read<T>(this IntPtr address) {
T obj = default(T);
if (address == IntPtr.Zero)
return obj;
TypedReference tr = __makeref(obj);
*(IntPtr*) (&tr) = address;
return __refvalue(tr, T);
}
}
}
最佳答案
€dit:长话短说:首先创建一个 ForceCast 函数来正确处理两种身份转换 ForceCast<LikeOriginal, LikeOriginal>和 ForceCast<Original, Original> ，那么您可能有机会进行实际的转化
工作样本
通过为 class->class (CC)、class->struct (CS)、struct->class (SC) 和 struct->struct (SS) 提供不同的代码，使用 Nullable<T>作为结构的中间体，我得到了一个工作示例:
// class -> class
private static unsafe TOut ForceCastCC<TIn, TOut>(TIn input)
where TIn : class
where TOut : class
{
var handle = __makeref(input);
return Read<TOut>(*(IntPtr*)(&handle));
}
// struct -> struct, require nullable types for in-out
private static unsafe TOut? ForceCastSS<TIn, TOut>(TIn? input)
where TIn : struct
where TOut : struct
{
var handle = __makeref(input);
return Read<TOut?>(*(IntPtr*)(&handle));
}
// class -> struct
private static unsafe TOut? ForceCastCS<TIn, TOut>(TIn input)
where TIn : class
where TOut : struct
{
var handle = __makeref(input);
// one extra de-reference of the input pointer
return Read<TOut?>(*(IntPtr*)*(IntPtr*)(&handle));
}
// struct -> class
private static unsafe TOut ForceCastSC<TIn, TOut>(TIn? input)
where TIn : struct
where TOut : class
{
// get a real pointer to the struct, so it can be turned into a reference type
var handle = GCHandle.Alloc(input);
var result = Read<TOut>(GCHandle.ToIntPtr(handle));
handle.Free();
return result;
}
现在在您的示例中使用适当的函数并按照编译器的要求处理可空类型:
Original orig = new Original(7, 20);
LikeOriginal casted = ForceCastCS<Original, LikeOriginal>(orig) ?? default(LikeOriginal);
Console.WriteLine("Casted Original to LikeOriginal");
Console.WriteLine(casted.cG + ", " + casted.dG);
Console.WriteLine(casted.ToString());
casted.Add(3);
Console.WriteLine("added 3");
orig = ForceCastSC<LikeOriginal, Original>(casted);
Console.WriteLine("Casted LikeOriginal back to Original");
Console.WriteLine(orig.a + ", " + orig.b);
Console.ReadLine();
对我来说，这会在每个点返回正确的数字。
详情
一些细节:
基本上，您的问题是您将值类型视为引用类型...
让我们先看看工作案例:LikeOriginal -> Original :
var h1 = GCHandle.Alloc(likeOriginal);
var ptr1 = GCHandle.ToIntPtr(h1);
这会创建一个指向LikeOriginal 内存区域的指针(€dit:实际上，不完全是那个内存区域，见下文)
var obj1 = default(Original);
TypedReference t1 = __makeref(obj1);
*(IntPtr*)(&t1) = ptr1;
这会创建对 Original 的引用(指针)带有指针的值，指向LikeOriginal
var original = __refvalue( t1,Original);
这会将类型化引用变成托管引用，指向LikeOriginal 的内存。 .所有起始值 likeOriginal对象被保留。
现在让我们分析一些应该工作的中间情况，如果您的代码可以双向工作:LikeOriginal -> LikeOriginal :
var h2 = GCHandle.Alloc(likeOriginal);
var ptr2 = GCHandle.ToIntPtr(h2);
同样，我们有一个指针指向LikeOriginal 的内存区域。
var obj2 = default(LikeOriginal);
TypedReference t2 = __makeref(obj2);
现在这是出了什么问题的第一个提示:__makeref(obj2)将创建对 LikeOriginal 的引用对象，而不是指向存储指针的某个单独区域。
*(IntPtr*)(&t2) = ptr2;
ptr2然而，是指向一些引用值的指针
var likeOriginal2 = __refvalue( t2,LikeOriginal);
我们在这里，因为t2而变得垃圾应该是对对象内存的直接引用，而不是对某些指针内存的引用。
以下是我执行的一些测试代码，以便更好地了解您的方法和出了什么问题(其中一些结构非常结构化，然后是我尝试了一些其他操作的部分):
Original o1 = new Original(111, 222);
LikeOriginal o2 = new LikeOriginal { cG = 333, dG = 444 };
// get handles to the objects themselfes and to their individual properties
GCHandle h1 = GCHandle.Alloc(o1);
GCHandle h2 = GCHandle.Alloc(o1.a);
GCHandle h3 = GCHandle.Alloc(o1.b);
GCHandle h4 = GCHandle.Alloc(o2);
GCHandle h5 = GCHandle.Alloc(o2.cG);
GCHandle h6 = GCHandle.Alloc(o2.dG);
// get pointers from the handles, each pointer has an individual value
IntPtr i1 = GCHandle.ToIntPtr(h1);
IntPtr i2 = GCHandle.ToIntPtr(h2);
IntPtr i3 = GCHandle.ToIntPtr(h3);
IntPtr i4 = GCHandle.ToIntPtr(h4);
IntPtr i5 = GCHandle.ToIntPtr(h5);
IntPtr i6 = GCHandle.ToIntPtr(h6);
// get typed references for the objects and properties
TypedReference t1 = __makeref(o1);
TypedReference t2 = __makeref(o1.a);
TypedReference t3 = __makeref(o1.b);
TypedReference t4 = __makeref(o2);
TypedReference t5 = __makeref(o2.cG);
TypedReference t6 = __makeref(o2.dG);
// get the associated pointers
IntPtr j1 = *(IntPtr*)(&t1);
IntPtr j2 = *(IntPtr*)(&t2); // j1 != j2, because a class handle points to the pointer/reference memory
IntPtr j3 = *(IntPtr*)(&t3);
IntPtr j4 = *(IntPtr*)(&t4);
IntPtr j5 = *(IntPtr*)(&t5); // j4 == j5, because a struct handle points directly to the instance memory
IntPtr j6 = *(IntPtr*)(&t6);
// direct translate-back is working for all objects and properties
var r1 = __refvalue( t1,Original);
var r2 = __refvalue( t2,int);
var r3 = __refvalue( t3,int);
var r4 = __refvalue( t4,LikeOriginal);
var r5 = __refvalue( t5,int);
var r6 = __refvalue( t6,int);
// assigning the pointers that where inferred from the GCHandles
*(IntPtr*)(&t1) = i1;
*(IntPtr*)(&t2) = i2;
*(IntPtr*)(&t3) = i3;
*(IntPtr*)(&t4) = i4;
*(IntPtr*)(&t5) = i5;
*(IntPtr*)(&t6) = i6;
// translate back the changed references
var s1 = __refvalue( t1,Original); // Ok
// rest is garbage values!
var s2 = __refvalue( t2,int);
var s3 = __refvalue( t3,int);
var s4 = __refvalue( t4,LikeOriginal);
var s5 = __refvalue( t5,int);
var s6 = __refvalue( t6,int);
// a variation, primitively dereferencing the pointer to get to the actual memory
*(IntPtr*)(&t4) = *(IntPtr*)i4;
var s4_1 = __refvalue( t4,LikeOriginal); // partial result, getting { garbage, 333 } instead of { 333, 444 }
// prepare TypedReference for translation between Original and LikeOriginal
var obj1 = default(Original);
var obj2 = default(LikeOriginal);
TypedReference t7 = __makeref(obj1);
TypedReference t8 = __makeref(obj2);
// translate between Original and LikeOriginal
*(IntPtr*)(&t7) = i4; // From struct to class, the pointer aquired through GCHandle is apropriate
var s7 = __refvalue( t7,Original); // Ok
*(IntPtr*)(&t8) = *(IntPtr*)j1;
var s8 = __refvalue( t8,LikeOriginal); // Not Ok - Original has some value comming before its first member - getting { garbage, 111 } instead of { 111, 222 }
*(IntPtr*)(&t8) = j2;
var s9 = __refvalue( t8,LikeOriginal); // Ok by starting at the address of the first member
结论:通过GCHandle -> IntPtr正在创建一个指向第一个成员前面的一个内存位置的指针，无论起点是结构还是类。这会导致结构 -> 类或类 -> 类正常工作但类 -> 结构或结构 -> 结构不工作。
我发现针对结构的唯一方法是获取指向其第一个成员的指针(在输入结构的情况下等于 __makeref 到结构而不通过 GCHandle )。
关于c# - 为什么将结构转换为类似类的工作？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/45566324/