* stdlib/cxa_atexit.c: Use PTR_MANGLE on function pointer. Fill in

	flavor field last and protect with memory barrier.
	* stdlib/on_exit.c: Likewise.
	* stdlib/cxa_finalize.c: Use PTR_DEMANGLE on function pointer before
	using it.
	* stdlib/exit.c: Likewise.

4 files changed, 44 insertions, 8 deletions

diff --git a/stdlib/cxa_atexit.c b/stdlib/cxa_atexit.c
index 490776105f..9b7a932b85 100644
--- a/stdlib/cxa_atexit.c
+++ b/stdlib/cxa_atexit.c
@@ -21,6 +21,8 @@
 
 #include <bits/libc-lock.h>
 #include "exit.h"
+#include <atomic.h>
+#include <sysdep.h>
 
 #undef __cxa_atexit
 
@@ -35,10 +37,14 @@ __cxa_atexit (void (*func) (void *), void *arg, void *d)
   if (new == NULL)
     return -1;
 
-  new->flavor = ef_cxa;
+#ifdef PTR_MANGLE
+  PTR_MANGLE (func);
+#endif
   new->func.cxa.fn = (void (*) (void *, int)) func;
   new->func.cxa.arg = arg;
   new->func.cxa.dso_handle = d;
+  atomic_write_barrier ();
+  new->flavor = ef_cxa;
   return 0;
 }
 INTDEF(__cxa_atexit)
diff --git a/stdlib/cxa_finalize.c b/stdlib/cxa_finalize.c
index 2339c7b5bd..43fcbc484f 100644
--- a/stdlib/cxa_finalize.c
+++ b/stdlib/cxa_finalize.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1999, 2001, 2002, 2003 Free Software Foundation, Inc.
+/* Copyright (C) 1999, 2001, 2002, 2003, 2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 #include <atomic.h>
 #include "exit.h"
 #include <fork.h>
+#include <sysdep.h>
 
 /* If D is non-NULL, call all functions registered with `__cxa_atexit'
    with the same dso handle.  Otherwise, if D is NULL, call all of the
@@ -39,7 +40,13 @@ __cxa_finalize (void *d)
 	    /* We don't want to run this cleanup more than once.  */
 	    && ! atomic_compare_and_exchange_bool_acq (&f->flavor, ef_free,
 						       ef_cxa))
-	  (*f->func.cxa.fn) (f->func.cxa.arg, 0);
+	  {
+	    void (*cxafn) (void *arg, int status) = f->func.cxa.fn;
+#ifdef PTR_DEMANGLE
+	    PTR_DEMANGLE (cxafn);
+#endif
+	    cxafn (f->func.cxa.arg, 0);
+	  }
     }
 
   /* Remove the registered fork handlers.  We do not have to
diff --git a/stdlib/exit.c b/stdlib/exit.c
index e5e25960b1..bc4cb0fd08 100644
--- a/stdlib/exit.c
+++ b/stdlib/exit.c
@@ -19,6 +19,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <sysdep.h>
 #include "exit.h"
 
 #include "set-hooks.h"
@@ -45,17 +46,33 @@ exit (int status)
 	    &__exit_funcs->fns[--__exit_funcs->idx];
 	  switch (f->flavor)
 	    {
+	      void (*atfct) (void);
+	      void (*onfct) (int status, void *arg);
+	      void (*cxafct) (void *arg, int status);
+
 	    case ef_free:
 	    case ef_us:
 	      break;
 	    case ef_on:
-	      (*f->func.on.fn) (status, f->func.on.arg);
+	      onfct = f->func.on.fn;
+#ifdef PTR_DEMANGLE
+	      PTR_DEMANGLE (onfct);
+#endif
+	      onfct (status, f->func.on.arg);
 	      break;
 	    case ef_at:
-	      (*f->func.at) ();
+	      atfct = f->func.at;
+#ifdef PTR_DEMANGLE
+	      PTR_DEMANGLE (atfct);
+#endif
+	      atfct ();
 	      break;
 	    case ef_cxa:
-	      (*f->func.cxa.fn) (f->func.cxa.arg, status);
+	      cxafct = f->func.cxa.fn;
+#ifdef PTR_DEMANGLE
+	      PTR_DEMANGLE (cxafct);
+#endif
+	      cxafct (f->func.cxa.arg, status);
 	      break;
 	    }
 	}
diff --git a/stdlib/on_exit.c b/stdlib/on_exit.c
index d98fbb3a86..e777604084 100644
--- a/stdlib/on_exit.c
+++ b/stdlib/on_exit.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991, 1996 Free Software Foundation, Inc.
+/* Copyright (C) 1991, 1996, 2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -18,6 +18,8 @@
 
 #include <stdlib.h>
 #include "exit.h"
+#include <atomic.h>
+#include <sysdep.h>
 
 /* Register a function to be called by exit.  */
 int
@@ -28,9 +30,13 @@ __on_exit (void (*func) (int status, void *arg), void *arg)
   if (new == NULL)
     return -1;
 
-  new->flavor = ef_on;
+#ifdef PTR_MANGLE
+  PTR_MANGLE (func);
+#endif
   new->func.on.fn = func;
   new->func.on.arg = arg;
+  atomic_write_barrier ();
+  new->flavor = ef_on;
   return 0;
 }
 weak_alias (__on_exit, on_exit)