Add assembly constraints to disable some overly aggressive GCC optimizations

sandbox/linux/seccomp/sandbox.cc

 #include "library.h"
 #include "sandbox_impl.h"
 #include "syscall_table.h"
 
 namespace playground {
 
 // Global variables
 int                           Sandbox::pid_;
 int                           Sandbox::processFdPub_;
 int                           Sandbox::cloneFdPub_;
@@ skipping 311 matching lines @@
       ".pushsection \".rodata\"\n"
 #ifndef NDEBUG
   "100:.asciz \"RDTSC(P): Executing handler\\n\"\n"
   "200:.asciz \"INT $0x0: Executing handler\\n\"\n"
 #endif
   "300:.ascii \"Segmentation fault\\n\"\n"
   "301:\n"
       ".popsection\n"
   "999:pop  %0\n"
       : "=g"(fnc)
+      :
+      : "memory"
+#if defined(__x86_64__)
+        , "rsp"
+#elif defined(__i386__)
+        , "esp"
+#endif
   );
   return fnc;
 }
 
 void Sandbox::snapshotMemoryMappings(int processFd) {
   SysCalls sys;
   int mapsFd = sys.open("/proc/self/maps", O_RDONLY, 0);
   if (mapsFd < 0 || !sendFd(processFd, mapsFd, -1, NULL, 0)) {
  failure:
     die("Cannot access /proc/self/maps");
@@ skipping 72 matching lines @@
 
   // Take a snapshot of the current memory mappings. These mappings will be
   // off-limits to all future mmap(), munmap(), mremap(), and mprotect() calls.
   snapshotMemoryMappings(processFdPub_);
 
   // Creating the trusted thread enables sandboxing
   createTrustedThread(processFdPub_, cloneFdPub_, secureMem);
 }
 
 } // namespace