arc block bug

run.sh

clang -fobjc-arc -O2 -c -arch x86_64 test.m
otool -toV test.o | mate

test.m

#import <Foundation/Foundation.h>

@interface A : NSObject
@end

@implementation A

- (NSArray *)f
{
	void (^tmp)(void) = ^{
		printf("a: %p", self);
	};
	return [NSArray arrayWithObjects:tmp, nil];
}

- (NSArray *)g
{
	return [NSArray arrayWithObjects:^{
		printf("b: %p", self);
	}, nil];
}

@end

test.s

test.o:
(__TEXT,__text) section
-[A f]:
0000000000000000	pushq	%rbp
0000000000000001	movq	%rsp,%rbp
0000000000000004	pushq	%rbx
0000000000000005	subq	$0x28,%rsp
0000000000000009	movq	__NSConcreteStackBlock(%rip),%rax
0000000000000010	movq	%rax,0xd0(%rbp)
0000000000000014	movl	$0x42000000,0xd8(%rbp)
000000000000001b	movl	$-[A f],0xdc(%rbp)
0000000000000022	leaq	___6-[A f]_block_invoke_0(%rip),%rax
0000000000000029	movq	%rax,-[A g](%rbp)
000000000000002d	leaq	___block_descriptor_tmp(%rip),%rax
0000000000000034	movq	%rax,0xe8(%rbp)
0000000000000038	callq	_objc_retain
000000000000003d	leaq	0xd0(%rbp),%rdx
0000000000000041	movq	%rax,0xf0(%rbp)
0000000000000045	movq	0x00000224(%rip),%rsi
000000000000004c	movq	0x000001fd(%rip),%rdi
0000000000000053	xorl	%ecx,%ecx
0000000000000055	xorb	%al,%al
0000000000000057	call	*_objc_msgSend(%rip)
000000000000005d	movq	%rax,%rdi
0000000000000060	callq	_objc_retainAutoreleasedReturnValue
0000000000000065	movq	%rax,%rbx
0000000000000068	movq	0xf0(%rbp),%rdi
000000000000006c	callq	_objc_release
0000000000000071	movq	%rbx,%rdi
0000000000000074	addq	$0x28,%rsp
0000000000000078	popq	%rbx
0000000000000079	popq	%rbp
000000000000007a	jmp	_objc_autoreleaseReturnValue
000000000000007f	nop
___6-[A f]_block_invoke_0:
0000000000000080	pushq	%rbp
0000000000000081	movq	%rsp,%rbp
0000000000000084	movq	0x20(%rdi),%rsi
0000000000000088	xorb	%al,%al
000000000000008a	leaq	L_.str(%rip),%rdi
0000000000000091	popq	%rbp
0000000000000092	jmp	_printf
0000000000000097	nopw	-[A f](%rax,%rax)
___copy_helper_block_:
00000000000000a0	pushq	%rbp
00000000000000a1	movq	%rsp,%rbp
00000000000000a4	addq	$0x20,%rdi
00000000000000a8	movq	0x20(%rsi),%rsi
00000000000000ac	movl	$0x00000003,%edx
00000000000000b1	popq	%rbp
00000000000000b2	jmp	__Block_object_assign
00000000000000b7	nopw	-[A f](%rax,%rax)
___destroy_helper_block_:
00000000000000c0	pushq	%rbp
00000000000000c1	movq	%rsp,%rbp
00000000000000c4	movq	0x20(%rdi),%rdi
00000000000000c8	movl	$0x00000003,%esi
00000000000000cd	popq	%rbp
00000000000000ce	jmp	__Block_object_dispose
00000000000000d3	nopl	%cs:-[A f](%rax,%rax)
-[A g]:
00000000000000e0	pushq	%rbp
00000000000000e1	movq	%rsp,%rbp
00000000000000e4	pushq	%r14
00000000000000e6	pushq	%rbx
00000000000000e7	subq	$0x30,%rsp
00000000000000eb	movq	0x0000015e(%rip),%r14
00000000000000f2	movq	__NSConcreteStackBlock(%rip),%rax
00000000000000f9	movq	%rax,0xc8(%rbp)
00000000000000fd	movl	$0x42000000,0xd0(%rbp)
0000000000000104	movl	$-[A f],0xd4(%rbp)
000000000000010b	leaq	___6-[A g]_block_invoke_0(%rip),%rax
0000000000000112	movq	%rax,0xd8(%rbp)
0000000000000116	leaq	___block_descriptor_tmp6(%rip),%rax
000000000000011d	movq	%rax,-[A g](%rbp)
0000000000000121	callq	_objc_retain
0000000000000126	leaq	0xc8(%rbp),%rdi
000000000000012a	movq	%rax,0xe8(%rbp)
000000000000012e	callq	_objc_retainBlock
0000000000000133	movq	%rax,%rbx
0000000000000136	movq	0x00000133(%rip),%rsi
000000000000013d	movq	%r14,%rdi
0000000000000140	movq	%rbx,%rdx
0000000000000143	xorl	%ecx,%ecx
0000000000000145	xorb	%al,%al
0000000000000147	call	*_objc_msgSend(%rip)
000000000000014d	movq	%rax,%rdi
0000000000000150	callq	_objc_retainAutoreleasedReturnValue
0000000000000155	movq	%rax,%r14
0000000000000158	movq	%rbx,%rdi
000000000000015b	callq	_objc_release
0000000000000160	movq	0xe8(%rbp),%rdi
0000000000000164	callq	_objc_release
0000000000000169	movq	%r14,%rdi
000000000000016c	addq	$0x30,%rsp
0000000000000170	popq	%rbx
0000000000000171	popq	%r14
0000000000000173	popq	%rbp
0000000000000174	jmp	_objc_autoreleaseReturnValue
0000000000000179	nopl	-[A f](%rax)
___6-[A g]_block_invoke_0:
0000000000000180	pushq	%rbp
0000000000000181	movq	%rsp,%rbp
0000000000000184	movq	0x20(%rdi),%rsi
0000000000000188	xorb	%al,%al
000000000000018a	leaq	L_.str2(%rip),%rdi
0000000000000191	popq	%rbp
0000000000000192	jmp	_printf
0000000000000197	nopw	-[A f](%rax,%rax)
___copy_helper_block_3:
00000000000001a0	pushq	%rbp
00000000000001a1	movq	%rsp,%rbp
00000000000001a4	addq	$0x20,%rdi
00000000000001a8	movq	0x20(%rsi),%rsi
00000000000001ac	movl	$0x00000003,%edx
00000000000001b1	popq	%rbp
00000000000001b2	jmp	__Block_object_assign
00000000000001b7	nopw	-[A f](%rax,%rax)
___destroy_helper_block_4:
00000000000001c0	pushq	%rbp
00000000000001c1	movq	%rsp,%rbp
00000000000001c4	movq	0x20(%rdi),%rdi
00000000000001c8	movl	$0x00000003,%esi
00000000000001cd	popq	%rbp
00000000000001ce	jmp	__Block_object_dispose
Contents of (__DATA,__objc_classlist) section
0000000000000398 0x368 _OBJC_CLASS_$_A
           isa 0x0 _OBJC_METACLASS_$_A
    superclass 0x0 _OBJC_CLASS_$_NSObject
         cache 0x0 __objc_empty_cache
        vtable 0x0 __objc_empty_vtable
          data l_OBJC_CLASS_RO_$_A (struct class_ro_t *)
                    flags 0x80
            instanceStart 8
             instanceSize 8
                 reserved 0x0
               ivarLayout 0x0
                     name L_OBJC_CLASS_NAME_7 A
              baseMethods l_OBJC_$_INSTANCE_METHODS_A (struct method_list_t *)
		   entsize 24
		     count 2
		      name L_OBJC_METH_VAR_NAME_8 f
		     types L_OBJC_METH_VAR_TYPE_ @16@0:8
		       imp -[A f]
		      name L_OBJC_METH_VAR_NAME_9 g
		     types L_OBJC_METH_VAR_TYPE_ @16@0:8
		       imp -[A g]
            baseProtocols 0x0
                    ivars 0x0
           weakIvarLayout 0x0
           baseProperties 0x0
Meta Class
           isa 0x0 _OBJC_METACLASS_$_NSObject
    superclass 0x0 _OBJC_METACLASS_$_NSObject
         cache 0x0 __objc_empty_cache
        vtable 0x0 __objc_empty_vtable
          data l_OBJC_METACLASS_RO_$_A (struct class_ro_t *)
                    flags 0x81 RO_META
            instanceStart 40
             instanceSize 40
                 reserved 0x0
               ivarLayout 0x0
                     name L_OBJC_CLASS_NAME_7 A
              baseMethods 0x0 (struct method_list_t *)
            baseProtocols 0x0
                    ivars 0x0
           weakIvarLayout 0x0
           baseProperties 0x0
Contents of (__DATA,__objc_classrefs) section
0000000000000250 0x0 _OBJC_CLASS_$_NSArray
Contents of (__DATA,__objc_imageinfo) section
  version 0
    flags 0x10