https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84824
--- Comment #7 from linzj <manjian2006 at gmail dot com> --- The core of this problem is escaped result is function wise, not block wise, or instruction wise. Any place in the function the local variable escapes, will count that variable as escaped. Actually the printf does not make the artifact local variable escapes. The later call to destructor of function ~_Function_base() { ... _M_manager(_M_functor, _M_functor, __destroy_functor); ... make that variable escape. If we patch the destructor like the following: diff --git a/libstdc++-v3/include/bits/std_function.h b/libstdc++-v3/include/bits/std_function.h index 657b1c02d2e..28ee02e6d48 100644 --- a/libstdc++-v3/include/bits/std_function.h +++ b/libstdc++-v3/include/bits/std_function.h @@ -272,8 +272,9 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION ~_Function_base() { + std::_Any_data d = _M_functor; if (_M_manager) - _M_manager(_M_functor, _M_functor, __destroy_functor); + _M_manager(d, d, __destroy_functor); } will ease the problem, which generate the code: main: .LFB1365: .cfi_startproc .cfi_personality 0x3,__gxx_personality_v0 .cfi_lsda 0x3,.LLSDA1365 subq $24, %rsp .cfi_def_cfa_offset 32 movl $3, %esi movl $.LC0, %edi xorl %eax, %eax .LEHB0: call printf .LEHE0: movq %rsp, %rsi movq %rsp, %rdi movl $3, %edx movl $1, (%rsp) call _ZNSt14_Function_base13_Base_managerIZL7getFunciEUliiE_E10_M_managerERSt9_Any_dataRKS3_St18_Manager_operation xorl %eax, %eax addq $24, %rsp .cfi_remember_state .cfi_def_cfa_offset 8 ret The last call cannot get inlined simply because it has passed the inline phase, so it's not related to the problem. So what is needed to fix this problem, is a better grained esacped result.