https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61577
--- Comment #109 from C. Heide <cameron.heide at betasystems dot com> --- _ZN15variable_hasher6removeEP8variable is just this same function, located at 0x6d777a0; I didn't realize at first that the objdump disassembly wasn't showing me the actual relocation unless I specify '-r', in which case it's: > 20: 18 00 80 46 90 11 [MMB] st4 [r35]=r32 > 22: PCREL21B .text+0xa780 > 26: 50 02 8c 20 20 00 ld4 r37=[r35] > 2c: 08 00 00 50 br.call.sptk.many b0=20 > <_ZN15variable_hasher6removeEP8variable+0x20> or the relocation section as seen by readelf: > Relocation section > '.rela.gnu.linkonce.t._ZN15variable_hasher6removeEP8variable' at offset > 0x1594b8 contains 1 entry: > Offset Info Type Sym. Value Symbol's Name + Addend > 00000022 00000149 R_IA64_PCREL21B 00000000 .text + a780 and the function at the offset 0xa780 is: > 0000a780 <_ZL18variable_htab_freePv>: > a780: 00 10 21 0a 80 05 [MII] alloc r34=ar.pfs,8,5,0 > a786: 30 02 30 00 42 80 mov r35=r12 > a78c: 01 64 fc 8c adds r12=-64,r12 > a790: 01 00 00 00 01 00 [MII] nop.m 0x0 > a796: 10 02 00 62 00 80 mov r33=b0 > a79c: 04 08 00 84 mov r36=r1;; which is the static function expected, as seen in the source at var-tracking.c:507. So it seems fine within the object file itself, but if I disassemble the final cc1 executable, it's become the invalid address: > 06d777a0 <_ZN15variable_hasher6removeEP8variable>: > 6d777a0: 00 10 19 0a 80 05 [MII] alloc r34=ar.pfs,6,5,0 > 6d777a6: 30 02 30 00 42 80 mov r35=r12 > 6d777ac: 01 67 fc 8c adds r12=-16,r12 > 6d777b0: 01 00 00 00 01 00 [MII] nop.m 0x0 > 6d777b6: 10 02 00 62 00 80 mov r33=b0 > 6d777bc: 04 08 00 84 mov r36=r1;; > 6d777c0: 18 00 80 46 90 11 [MMB] st4 [r35]=r32 > 6d777c6: 50 02 8c 20 20 00 ld4 r37=[r35] > 6d777cc: d8 96 cf 50 br.call.sptk.many > b0=7a70e90 <_etext_f+0xc87090> According to the cc1 symbol table, variable_htab_free should be at 0x5a70e90. Which I just realized is exactly 0x2000000 off the invalid address...