https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114175
palmer at gcc dot gnu.org changed: What |Removed |Added ---------------------------------------------------------------------------- Last reconfirmed| |2024-02-29 Ever confirmed|0 |1 Status|UNCONFIRMED |NEW --- Comment #14 from palmer at gcc dot gnu.org --- Looks like it's a problem with the struct return argument mixing with va_start / va_arg. This much smaller test case still fails, and on gcc-13 $ cat gcc/testsuite/gcc.dg/c23-stdarg-6.c /* Test C23 variadic functions with no named parameters, or last named parameter with a declaration not allowed in C17. Execution tests. */ /* { dg-do run } */ /* { dg-options "-std=c23 -pedantic-errors" } */ #include <stdarg.h> #include <stdio.h> extern void abort (void); extern void exit (int); struct s { char c[1000]; }; struct s f (...) { va_list ap; va_start (ap); double r = va_arg (ap, int); va_end (ap); struct s ret = {}; ret.c[0] = r; ret.c[999] = 42; return ret; } int main () { struct s x = f (1); fprintf(stderr, "%d\n", x.c[0]); if (x.c[0] != 1) abort (); exit (0); } $ riscv64-unknown-linux-gnu-gcc gcc/testsuite/gcc.dg/c23-stdarg-6.c -o test -std=c2x -static -O3 $ qemu-riscv64 ./test 16 Aborted The output value seems to change from time to time, which smells like some uninitialized access. I'd bet we're just not properly skipping over the output stack space in riscv_va_start(). Not quite sure where to start, though, as ours is so much simpler than arm64 that it's going to take a bit to figure out what's going on.