title: Why does Microsoft's implementation of std::string require 40 bytes on the stack?
body: <p>Having recently watched <a href="https://www.youtube.com/watch?v=kPR8h4-qZdk" rel="noreferrer">this video</a> about facebook's implementation of string, I was curious to see the internals of Microsoft's implementation. Unfortunately, the string file (in <code>%VisualStudioDirectory%/VC/include</code>) doesn't seem to contain the actual definition, but rather just conversion functions (e.g. atoi) and some operator overloads.</p>
  
  <p>I decided to do some poking and prodding at it from user-level programs. The first thing I did, of course, was to test <code>sizeof(std::string)</code>. To my surprise, std::string takes 40 bytes! (On 64-bit machines anyways.) The previously mentioned video goes into detail about how facebook's implementation only requires 24 bytes and gcc's takes 32 bytes, so this was shocking to say the least.</p>
  
  <p>We can dig a little deeper by writing a simple program that prints off the contents of the data byte-by-byte (including the c_str address), as such:</p>
  
  <pre><code>#include &lt;iostream&gt;
  #include &lt;string&gt;
  int main()
  {
      std::string test = "this is a very, very, very long string";
  
      // Print contents of std::string test.
      char* data = reinterpret_cast&lt;char*&gt;(&amp;test);
      for (size_t wordNum = 0; wordNum &lt; sizeof(std::string); wordNum = wordNum + sizeof(uint64_t))
      {
          for (size_t i = 0; i &lt; sizeof(uint64_t); i++)
              std::cout &lt;&lt; (int)(data[wordNum + i]) &lt;&lt; " ";
  
          std::cout &lt;&lt; std::endl;
      }
  
      // Print the value of the address returned by test.c_str().
      // (Doing this byte-by-byte to match the above values).
      const char* testAddr = test.c_str();
      char* dataAddr = reinterpret_cast&lt;char*&gt;(&amp;testAddr);
  
      std::cout &lt;&lt; "c_str address: ";
      for (size_t i = 0; i &lt; sizeof(const char*); i++)
          std::cout &lt;&lt; (int)(dataAddr[i]) &lt;&lt; " ";
  
      std::cout &lt;&lt; std::endl;
  }
  </code></pre>
  
  <p>This prints out:</p>
  
  <pre><code>48 33 -99 -47 -55 1 0 0
  16 78 -100 -47 -55 1 0 0
  -52 -52 -52 -52 -52 -52 -52 -52
  38 0 0 0 0 0 0 0
  47 0 0 0 0 0 0 0
  c_str address: 16 78 -100 -47 -55 1 0 0
  </code></pre>
  
  <p>Examining this, we can see that the second word contains the address that points to the allocated data for the string, the third word is garbage (a buffer for Short String Optimization), the fourth word is the size, and the fifth word is the capacity. <strong>But what about the first word? It appears to be an address, but what for? Shouldn't everything already be accounted for?</strong></p>
  
  <p>For the sake of completeness, the following output shows SSO (the string is set to "Short String"). Note that the first word still seems to represent a pointer:</p>
  
  <pre><code>0 36 -28 19 123 1 0 0
  83 104 111 114 116 32 83 116
  114 105 110 103 0 -52 -52 -52
  12 0 0 0 0 0 0 0
  15 0 0 0 0 0 0 0
  c_str address: 112 -9 79 -108 23 0 0 0
  </code></pre>
  
  <p>EDIT: Ok, so having done more testing, it appears that the size of std::string actually decreases down to 32 bytes when compiled for release, and the first word is no longer there. But I'm still really interested in knowing why that is the case, and what that extra pointer is used for in debug mode.</p>
  
  <p><strong>Update:</strong> As per the tip by the user Yuushi, the extra word appears to related to Debug Iterator Support. This was verified when I turned off Debug Iterator Support (an example for doing this is shown <a href="https://msdn.microsoft.com/en-us/library/aa985982.aspx" rel="noreferrer">here</a>) and the size of std::string was reduced to 32 bytes, with the first word now missing.</p>
  
  <p>However, it would still be really interesting to see how Debug Iterator Support uses that additional pointer to check for incorrect iterator use.</p>