title: c++ code compiled with -fsanitize=address crashes
body: <p>I used <code>gcc 6.3.0</code> with address sanitizer to compile the following code:</p>
  
  <pre><code>#include &lt;iostream&gt;
  
  int increment(int &amp;x)
  {
      x++;
      return x;
  }
  
  int main()
  {
      int x = 0;
      increment(x);
  
      return 0;
  }
  </code></pre>
  
  <p>The code gets compiled and instrumented. Objdump (-S) of the compiled code:</p>
  
  <pre><code>000008d0 &lt;_Z9incrementRi&gt;:
  
  int increment(int &amp;x) {
       8d0:   55                      push   %ebp
       8d1:   89 e5                   mov    %esp,%ebp
       8d3:   56                      push   %esi
       8d4:   53                      push   %ebx
       8d5:   83 ec 08                sub    $0x8,%esp
       8d8:   e8 9f 01 00 00          call   a7c &lt;__x86.get_pc_thunk.cx&gt;
       8dd:   81 c1 b3 89 00 00       add    $0x89b3,%ecx
      ++x;
       8e3:   8b 45 08                mov    0x8(%ebp),%eax
       8e6:   89 c2                   mov    %eax,%edx
       8e8:   c1 ea 03                shr    $0x3,%edx
       8eb:   81 c2 00 00 00 20       add    $0x20000000,%edx
       8f1:   0f b6 12                movzbl (%edx),%edx
       8f4:   84 d2                   test   %dl,%dl
       8f6:   0f 95 45 f7             setne  -0x9(%ebp)
       8fa:   89 c6                   mov    %eax,%esi
       8fc:   83 e6 07                and    $0x7,%esi
       8ff:   8d 5e 03                lea    0x3(%esi),%ebx
       902:   38 d3                   cmp    %dl,%bl
       904:   0f 9d c2                setge  %dl
       907:   22 55 f7                and    -0x9(%ebp),%dl
       90a:   84 d2                   test   %dl,%dl
       90c:   74 0b                   je     919 &lt;_Z9incrementRi+0x49&gt;
       90e:   83 ec 04                sub    $0x4,%esp
       911:   50                      push   %eax
       912:   89 cb                   mov    %ecx,%ebx
       914:   e8 a0 07 00 00          call   10b9 &lt;__asan_report_load4&gt;
       919:   8b 45 08                mov    0x8(%ebp),%eax
       91c:   8b 00                   mov    (%eax),%eax
       91e:   8d 50 01                lea    0x1(%eax),%edx
       921:   8b 45 08                mov    0x8(%ebp),%eax
       924:   89 10                   mov    %edx,(%eax)
  }
       926:   90                      nop
       927:   8d 65 f8                lea    -0x8(%ebp),%esp
       92a:   5b                      pop    %ebx
       92b:   5e                      pop    %esi
       92c:   5d                      pop    %ebp
       92d:   c3                      ret    
  
  0000092e &lt;main&gt;:
  
  int main(void)
  {
       92e:   8d 4c 24 04             lea    0x4(%esp),%ecx
       932:   83 e4 f8                and    $0xfffffff8,%esp
       935:   ff 71 fc                pushl  -0x4(%ecx)
       938:   55                      push   %ebp
       939:   89 e5                   mov    %esp,%ebp
       93b:   57                      push   %edi
       93c:   56                      push   %esi
       93d:   53                      push   %ebx
       93e:   51                      push   %ecx
       93f:   83 ec 60                sub    $0x60,%esp
       942:   e8 39 01 00 00          call   a80 &lt;__x86.get_pc_thunk.bx&gt;
       947:   81 c3 49 89 00 00       add    $0x8949,%ebx
       94d:   8d 75 90                lea    -0x70(%ebp),%esi
       950:   89 f7                   mov    %esi,%edi
       952:   8d 83 d0 05 00 00       lea    0x5d0(%ebx),%eax
       958:   83 38 00                cmpl   $0x0,(%eax)
       95b:   74 13                   je     970 &lt;main+0x42&gt;
       95d:   83 ec 04                sub    $0x4,%esp
       960:   6a 60                   push   $0x60
       962:   e8 b4 02 00 00          call   c1b &lt;__asan_stack_malloc_1&gt;
       967:   83 c4 08                add    $0x8,%esp
       96a:   85 c0                   test   %eax,%eax
       96c:   74 02                   je     970 &lt;main+0x42&gt;
       96e:   89 c6                   mov    %eax,%esi
       970:   8d 46 60                lea    0x60(%esi),%eax
       973:   c7 06 b3 8a b5 41       movl   $0x41b58ab3,(%esi)
       979:   8d 93 d0 e8 ff ff       lea    -0x1730(%ebx),%edx
       97f:   89 56 04                mov    %edx,0x4(%esi)
       982:   8d 93 9e 76 ff ff       lea    -0x8962(%ebx),%edx
       988:   89 56 08                mov    %edx,0x8(%esi)
       98b:   89 f3                   mov    %esi,%ebx
       98d:   c1 eb 03                shr    $0x3,%ebx
       990:   c7 83 00 00 00 20 f1    movl   $0xf1f1f1f1,0x20000000(%ebx)
       997:   f1 f1 f1 
       99a:   c7 83 04 00 00 20 04    movl   $0xf4f4f404,0x20000004(%ebx)
       9a1:   f4 f4 f4 
       9a4:   c7 83 08 00 00 20 f3    movl   $0xf3f3f3f3,0x20000008(%ebx)
       9ab:   f3 f3 f3 
      int x = 0;
       9ae:   c7 40 c0 00 00 00 00    movl   $0x0,-0x40(%eax)
      increment(x);
       9b5:   83 ec 04                sub    $0x4,%esp
       9b8:   83 e8 40                sub    $0x40,%eax
       9bb:   50                      push   %eax
       9bc:   e8 0f ff ff ff          call   8d0 &lt;_Z9incrementRi&gt;
       9c1:   83 c4 08                add    $0x8,%esp
      return 0;
       9c4:   b8 00 00 00 00          mov    $0x0,%eax
  {
       9c9:   39 f7                   cmp    %esi,%edi
       9cb:   74 26                   je     9f3 &lt;main+0xc5&gt;
       9cd:   c7 06 0e 36 e0 45       movl   $0x45e0360e,(%esi)
       9d3:   c7 83 00 00 00 20 f5    movl   $0xf5f5f5f5,0x20000000(%ebx)
       9da:   f5 f5 f5 
       9dd:   c7 83 04 00 00 20 f5    movl   $0xf5f5f5f5,0x20000004(%ebx)
       9e4:   f5 f5 f5 
       9e7:   c7 83 08 00 00 20 f5    movl   $0xf5f5f5f5,0x20000008(%ebx)
       9ee:   f5 f5 f5 
       9f1:   eb 1e                   jmp    a11 &lt;main+0xe3&gt;
       9f3:   c7 83 00 00 00 20 00    movl   $0x0,0x20000000(%ebx)
       9fa:   00 00 00 
       9fd:   c7 83 04 00 00 20 00    movl   $0x0,0x20000004(%ebx)
       a04:   00 00 00 
       a07:   c7 83 08 00 00 20 00    movl   $0x0,0x20000008(%ebx)
       a0e:   00 00 00 
  }
       a11:   8d 65 f0                lea    -0x10(%ebp),%esp
       a14:   59                      pop    %ecx
       a15:   5b                      pop    %ebx
       a16:   5e                      pop    %esi
       a17:   5f                      pop    %edi
       a18:   5d                      pop    %ebp
       a19:   8d 61 fc                lea    -0x4(%ecx),%esp
       a1c:   c3                      ret  
  </code></pre>
  
  <p>Execution crashes on instrumented code at line:</p>
  
  <pre><code>990:    c7 83 00 00 00 20 f1    movl   $0xf1f1f1f1,0x20000000(%ebx)
  </code></pre>
  
  <p>before increment(int &amp;x) function is called.
  ASAN option "stack-use-after-return" was enabled.
  The code was compiled with:  </p>
  
  <pre><code>gcc -O0 -g -fsanitize=address main.cpp
  </code></pre>
  
  <p>If the integer variable x is defined as a global variable the, code doesn't get instrumented and crash does not happen.<br>
  Before I posted my question, I found this <a href="https://stackoverflow.com/questions/29656109/address-sanitizer-failure">question</a>, that is very similar to my problem with address sanitizer.</p>
  
  <p>So my question would be:<br>
  <strong>Why the execution of the code crashed at the mentioned line?<br>
  Is it possible that the instrumentation went wrong at some point?</strong></p>
  
  <p><strong>Edit</strong><br>
  GCC version and configure flags</p>
  
  <pre><code>Configured with:   
  ../gcc-6.3.0/configure --prefix=/opt/V6.3.0 --target=i686-elf --with-pic 
  --with-newlib --enable-fully-dynamic-string --enable-languages=c,c++ 
  --disable-initfini-array --disable-nls --disable-shared --disable-multilib 
  --disable-threads --disable-tls --disable-win32-registry --enable-sjlj-
  exceptions --enable-frame-pointer --disable-__cxa_atexit --disable-libgomp 
  --disable-libquadmath --disable-libssp --disable-libada --disable-libitm 
  --disable-libstdcxx-verbose --disable-libstdcxx-visibility --with-default-
  libstdcxx-abi=gcc4-compatible --without-headers 
      Thread model: single
      gcc version 6.3.0 (GCC)
  </code></pre>