For this code
void foo(void **ptr) {
static _Thread_local void *tmp;
tmp = *ptr;
*ptr = 0;
}
Clang generates
foo:
movq (%rdi), %rax
movq %rax, %fs:foo.tmp@TPOFF
movq $0, (%rdi)
retq
I think it's an alias analysis issue, because a _Thread_local int is optimized out. But even without alias analysis, we know that tmp hasn't had its address taken.