Istvan Haller

The member function is still called via the object, see (instance.*f)();. I am not saying that this is a common use-case, but it is part of the C++ specifications. Also...

And the displacements themselves are not randomized, so any attacker with access to the binary on disk can figure out the right absolute and relative values to use. Actually this...

Actually for the test you want to have the address taking operation in another bytecode file from the call-site, because those are the sources of the types that you are...