https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122645
--- Comment #4 from Andreas Schwab <[email protected]> --- It surely is undefined behaviour since it depends on the exact layout of the trampoline, which is entirely internal to the compiler. It changes with -fcf-protection=branch, for example.
