https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85044
--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
[hjl@gnu-cfl-1 tmp]$ cat y.c
extern void foo (void);
extern void bar (void);
extern void callme (void *);
void
tryme (void)
{
int ok = 0;
void callback (void) { ok = 1; }
callme (&callback);
if (ok)
foo ();
else
bar ();
}
[hjl@gnu-cfl-1 tmp]$ /usr/gcc-8.0.1-x32/bin/gcc -O2 -fPIC -S -fcf-protection
-mcet y.c
[hjl@gnu-cfl-1 tmp]$ cat y.s
.file "y.c"
.text
.p2align 4,,15
.type callback.1980, @function
callback.1980:
.LFB1:
.cfi_startproc
endbr64
movl $1, (%r10)
ret
.cfi_endproc
.LFE1:
.size callback.1980, .-callback.1980
.p2align 4,,15
.globl tryme
.type tryme, @function
tryme:
.LFB0:
.cfi_startproc
endbr64
subq $56, %rsp
.cfi_def_cfa_offset 64
movl $-17591, %edx
movl $-17847, %ecx
leaq 64(%rsp), %rax
movw %dx, 4(%rsp)
leaq callback.1980(%rip), %rdx
movq %rax, 32(%rsp)
movq %rsp, %rax
leaq 4(%rax), %rdi
movq %rdx, 2(%rdi)
movw %cx, 10(%rdi)
movq %rax, 12(%rdi)
movl $-1864106167, 20(%rdi)
movl $0, (%rsp)
call callme@PLT
movl (%rsp), %esi
testl %esi, %esi
je .L4
call foo@PLT
addq $56, %rsp
.cfi_remember_state
.cfi_def_cfa_offset 8
ret
.p2align 4,,10
.p2align 3
.L4:
.cfi_restore_state
call bar@PLT
addq $56, %rsp
.cfi_def_cfa_offset 8
ret
.cfi_endproc
.LFE0:
.size tryme, .-tryme
.ident "GCC: (GNU) 8.0.1 20180322 (experimental)"
.section .note.GNU-stack,"x",@progbits
.section .note.gnu.property,"a"
.align 8
.long 1f - 0f
.long 4f - 1f
.long 5
0:
.string "GNU"
1:
.align 8
.long 0xc0000002
.long 3f - 2f
2:
.long 0x3
3:
.align 8
4:
[hjl@gnu-cfl-1 tmp]$
It generates trampoline on stack like
Dump of assembler code from 0x7fffffffddc1 to 0x7fffffffdddf:
=> 0x00007fffffffddc1: 49 bb 80 81 ce f7 fe 7f 00 00 movabs
$0x7ffef7ce8180,%r11
0x00007fffffffddcb: 49 ba c0 dd ff ff ff 7f 00 00 movabs
$0x7fffffffddc0,%r10
0x00007fffffffddd5: 49 ff e3 rex.WB jmpq *%r11
