http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55693
--- Comment #12 from Aldy Hernandez <aldyh at gcc dot gnu.org> 2013-01-17 18:43:45 UTC --- BTW, the reason this works when forcing the instrumented path as Torvald suggested (comment #7) is because when f1() is instrumented, the call to __cxa_allocate_exception is also instrumented and we actually call: dyld_stub__ITM_cxa_allocate_exception() -> _ITM_cxa_allocate_exception, which is defined in libitm/eh_cpp.cc: void * _ITM_cxa_allocate_exception (size_t size) { void *r = __cxa_allocate_exception (size); gtm_thr()->cxa_unthrown = r; return r; } Assembly single stepping through the above shows that the call to __cxa_allocate_exception (through dyld_stub___cxa_allocate_exception) has a correct stub, not this "return 0" nonsense I describe in comment #10.