They use a similar trick with std::string in libstdc++. The string object has a pointer to the null terminated character string, right before that string is a s

They use a similar trick with std::string in libstdc++. The string object has a pointer to the null terminated character string, right before that string is a structure that contains the reference count. (I think libcello could add reference counted objects that way)