Minimal example showing the address of a function pointer being incorrect after a system callback

esp8266-function-pointer-failure.c

#include <c_types.h>
#include <osapi.h>
#include <user_interface.h>
#include <espconn.h>
#include <mem.h>
#include <gpio.h>

typedef int (* oGetValueCB)();
typedef void (* oSetValueCB)(int, int);

typedef struct {
  int type;
  oGetValueCB getValCB;
  oSetValueCB setValCB;
  int args;
} OHandler;

static OHandler *oHandlers;

int ICACHE_FLASH_ATTR oGpioToggleGetCB() {
  return 0;
}

void ICACHE_FLASH_ATTR oGpioToggleSetCB(int value, int gpio) {
}

void ICACHE_FLASH_ATTR handleTimeout() {
  char msg[64];

  os_printf("@oHandlers: 0x%8x\n@oGpioToggleGetCB: 0x%8x\n", &oHandlers, &oGpioToggleGetCB);
  os_printf("oHandlers[0].getValCB: 0x%8x\n", oHandlers[0].getValCB);
}

void user_init(void) {
  int gpioPin = 12;

  OHandler myHandlers[] = {
    {0x99, oGpioToggleGetCB, oGpioToggleSetCB, gpioPin},
    { NULL }
  };

  oHandlers = (OHandler*)myHandlers;

  handleTimeout();
  os_printf("\n\n");

  os_printf("starting timer\n");
  LOCAL os_timer_t timer;
  os_timer_disarm(&timer);
  os_timer_setfn(&timer, (os_timer_func_t *)handleTimeout, NULL);
  os_timer_arm(&timer, 1000, 0); 
}

As you can see, the address goes from something reasonable to complete nonsense.

Thanks to projectgus I have figure out the issue. By moving the declaration of myHandlers outside user_init it persistent after that function exited.