给前端同学的 C++ 悬垂指针入门：为什么 Crash 会概率性发生

User user;
User* p = &user;

User* user = new User(); // 创建
user->SayHello();        // 使用
delete user;             // 销毁

delete user;
user->SayHello(); // 错误：对象已经销毁

User* user = new User();
delete user;

user->SayHello(); // use-after-free

#include <iostream>

class User {
public:
    void SayHello() {
        std::cout << "hello" << std::endl;
    }
};

int main() {
    User* user = new User();
    delete user;

    user->SayHello(); // 错误，但不一定每次都崩
    return 0;
}

User* user = new User();
delete user;

std::string* text = new std::string("abc");

user->SayHello(); // user 指向的地址可能已经不是 User 了

useEffect(() => {
  window.addEventListener('resize', onResize)
  return () => window.removeEventListener('resize', onResize)
}, [])

#include <vector>
#include <algorithm>
#include <iostream>

class ClickListener {
public:
    virtual void OnClick() = 0;
    virtual ~ClickListener() = default;
};

class Button {
public:
    void AddListener(ClickListener* listener) {
        listeners_.push_back(listener);
    }

    void RemoveListener(ClickListener* listener) {
        listeners_.erase(
            std::remove(listeners_.begin(), listeners_.end(), listener),
            listeners_.end()
        );
    }

    void Click() {
        for (auto* listener : listeners_) {
            listener->OnClick();
        }
    }

private:
    std::vector<ClickListener*> listeners_;
};

class Page : public ClickListener {
public:
    explicit Page(Button& button) : button_(button) {
        button_.AddListener(this);
    }

    ~Page() {
        button_.RemoveListener(this);
    }

    void OnClick() override {
        std::cout << "clicked" << std::endl;
    }

private:
    Button& button_;
};

class Page : public ClickListener {
public:
    explicit Page(Button& button) : button_(button) {
        button_.AddListener(this);
    }

    ~Page() {
        // 忘记 RemoveListener(this)
    }

    void OnClick() override {}

private:
    Button& button_;
};

Button button;

{
    Page page(button);
} // page 已经销毁，但 button 里还保存着 page 的地址

button.Click(); // 访问已销毁对象，可能 Crash

class Page : public ClickListener {
public:
    explicit Page(Button* button) : button_(button) {
        if (button_) {
            button_->AddListener(this);
        }
    }

    ~Page() {
        if (button_ == nullptr) {
            return; // 这里跳过了 RemoveListener
        }
        button_->RemoveListener(this);
    }

    void DetachButton() {
        button_ = nullptr;
    }

    void OnClick() override {}

private:
    Button* button_ = nullptr;
};

Button button;

{
    Page page(&button); // 注册 listener
    page.DetachButton(); // button_ 被置空
} // 析构时提前 return，没有反注册

button.Click(); // button 里残留 Page*，可能 Crash

class Page : public ClickListener {
public:
    explicit Page(Button* button) : registeredButton_(button) {
        if (registeredButton_) {
            registeredButton_->AddListener(this);
        }
    }

    ~Page() {
        Unregister();
    }

    void Unregister() {
        if (registeredButton_) {
            registeredButton_->RemoveListener(this);
            registeredButton_ = nullptr;
        }
    }

    void OnClick() override {}

private:
    Button* registeredButton_ = nullptr;
};

#include <unordered_map>
#include <vector>
#include <string>

struct Student {
    int id;
    std::string name;
};

struct ClassRoom {
    std::vector<int> studentIds;
};

std::unordered_map<int, Student*> studentsById;

void ChangeStudentIdWrong(ClassRoom& room, int oldId, int newId) {
    auto student = studentsById[oldId];
    studentsById.erase(oldId);
    studentsById[newId] = student;
    student->id = newId;

    // 漏了：room.studentIds 里还保存 oldId
}

for (int id : room.studentIds) {
    Student* student = studentsById[id];
    // id 还是旧的，可能查不到对象
}

void ChangeStudentId(ClassRoom& room, int oldId, int newId) {
    auto it = studentsById.find(oldId);
    if (it == studentsById.end()) {
        return;
    }

    Student* student = it->second;
    studentsById.erase(it);
    studentsById[newId] = student;
    student->id = newId;

    for (int& id : room.studentIds) {
        if (id == oldId) {
            id = newId;
        }
    }
}

1. Crash 是否发生在回调、事件、observer、listener、虚函数附近？
2. 是否有 `vector<Listener*>` 这类原始指针容器？
3. 谁把这个指针放进去的？
4. 对象销毁时，是否一定会把指针移除？
5. 清理逻辑里是否有提前 return？
6. 是否有多份 id / parent / child / map / list 需要同步？

void Cleanup() {
    if (!parent) {
        return;
    }
    parent->RemoveListener(this);
}

button.AddListener(this);
button.RemoveListener(this);

void Unregister() {
    if (!registeredButton_) {
        return;
    }
    registeredButton_->RemoveListener(this);
    registeredButton_ = nullptr;
}

class Subscription {
public:
    explicit Subscription(std::function<void()> cancel)
        : cancel_(std::move(cancel)) {}

    ~Subscription() {
        Cancel();
    }

    void Cancel() {
        if (cancel_) {
            cancel_();
            cancel_ = nullptr;
        }
    }

private:
    std::function<void()> cancel_;
};

谁拥有这个对象？
谁负责销毁它？
别人保存的是拥有关系，还是观察关系？
对象销毁前，所有观察关系是否会被清理？

对象已经销毁
仍有地方保存它的地址
未来可能继续访问这个地址