This is what I see by disassemble for the statement function(1,2,3);
:
movl $0x3,0x8(%esp)
movl $0x2,0x4(%esp)
movl $0x1,(%esp)
call 0x4012d0 <_Z8functioniii>
It seems the ret address is not pushed into stack at all,then how does ret
work?
On an x86 processor (as for your assembly language example), the call
instruction pushes the return address on the stack and transfers control to the function.
So on entry to a function, the stack pointer is pointing at a return address, ready for ret
to pop it into the program counter (EIP / RIP).
Not all processor architectures put the return address on the stack- often there's a set of one or more registers designed to hold return addresses. On ARM processors, the BL
instruction places the return address in a specific register (LR
, or the 'link register') and transfers control to the function.
The ia64 processor does something similar, except that there are several possible registers (b0
-b7
) that can receive the return address and one will be specified in the instruction (with b0
being the default).
Ideally, the call
statement should take care of that. The program counter's next location will be pushed into the stack. When the function (sub routine) that was called completes it work and when it encounters a return statement, the control now goes to the address that was pushed into the stack and it will get popped.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With