https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109889
--- Comment #6 from Tulio Magno Quites Machado Filho <tuliom at ascii dot art.br> --- Let me elaborate my previous comment... When initializing the object at 0x100414c8, one of its members points to an address in the stack (0x7fffffffe8f8). All these functions return and when __run_exit_handlers() is called, the address 0x7fffffffe8f8 is used to save the TOC pointer (r2) before calling the destructors of the library. The destructors manipulate the object at 0x100414c8, zeroing all its members, including the address where the TOC pointer was saved.
