amd64/126543: [amd64] __builtin_frame_address does not return 0 when reaching the top of the stack

Douglas William Thrift douglas at
Fri Aug 15 01:50:04 UTC 2008

>Number:         126543
>Category:       amd64
>Synopsis:       [amd64] __builtin_frame_address does not return 0 when reaching the top of the stack
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-amd64
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 15 01:50:03 UTC 2008
>Originator:     Douglas William Thrift
>Release:        FreeBSD 7.0-STABLE-jc2 amd64
System: FreeBSD 7.0-STABLE-jc2 FreeBSD 7.0-STABLE-jc2 #0: Thu Jun 26 21:33:03 PDT 2008 user at amd64
On the amd64 architecture the gcc builtin function __builtin_frame_address does not return 0 when it is called for the level that should be the top of the stack. Instead it seems to continue returning addresses and then causes a bus error.

GCC documentation:

I've seen this occur on this system and also on two systems running FreeBSD 7.0-RELEASE-p3.

This causes devel/libexecinfo to be completely useless and crashy.
Compile the following C program:

#include <stdio.h>

int main(int argc, char *argv[])
    void *address;
    int index;

    for (index = 0; address != NULL && index != 5; ++index)
        switch (index)
        case 0: address = __builtin_frame_address(0); break;
        case 1: address = __builtin_frame_address(1); break;
        case 2: address = __builtin_frame_address(2); break;
        case 3: address = __builtin_frame_address(3); break;
        case 4: address = __builtin_frame_address(4); break;

        printf("0x%x\n", address);

    return 0;

Run on an i386 machine its output is fine:
[douglas at backhome:~]$ ./test

Run on an amd64 machine is not so fine:
[douglas at justonenight:~]$ ./test
Bus error: 10 (core dumped)

The last hex value printed seems to consistently be a string from the environment variables. Judging by the two stack frame addresses printed on i386, perhaps the third address printed on amd64 is the one that should be a zero.

More information about the freebsd-amd64 mailing list