The -fstack-stack switch prevents harmful stack overflows by enforcing the guarantee that the guard page at the end of stacks will be hit. It does this by injecting one byte writes for large uninitialized frames and any usage of alloca. It rarely needs to do anything because these cases are rare so it has no performance or code size impact in practice.

Without this feature, even "correct" code can cause a stack overflow overshooting the guard page. The most significant change is that an unbounded alloca can only cause a denial of service since it will reliability trigger a segfault. The stack protector feature can only catch buffer overflows past the stack frame boundary, so it provides no protection against these issues.