X86 - Does the CALL instruction ALWAYS push the address specified by EIP onto the stack?

Question

Is there any condition where the return address is not pushed onto the stack during a function call in x86 architecture?

Answer 1

No. CALL, by definition, pops the return address onto the stack before moving to the destination address. This return address is EIP(or RIP) + sizeof(call instruction)(usually 5 bytes.)

Intel® 64 and IA-32 Software Developers Guide Volume 2 states that CALL:

Saves a procedure that associates stack and branch information with the called procedure specified using the target operand.

It includes:

• Near Call - " ", EIP .
• Far Call - " , , ", CS, EIP .

, , JMP.

C, , x86 CALL, : tail call, JMP. , . .

int bar(int a, int b);

int foo(int a, int b)
{
    if (a < b)
       return 0;

    return bar(a, b);   // Will probably be:    jmp  bar
}