https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85434
--- Comment #6 from Thomas Preud'homme <thopre01 at gcc dot gnu.org> --- (In reply to Thomas Preud'homme from comment #3) > > My feeling is that the target patterns should also do the address > computation, ie stack_protect_set and stack_protect_test would take that MEM > of symbol_ref instead of expanding it first. The more I think about it the more I think it's the only way to guarantee the guard's address does not end up in a register that could be spilled. The spilling itself is more likely to happen when reading the GOT entry that holds the guard's address is not represented by an UNSPEC because then the address computed when setting the canari is reused when doing the comparison. UNSPEC seems to prevent that (even though it's not UNSPEC_VOLATILE).