Hi,
in the dicussion on PR 99447 there was some confusion about release_body
being used in context where call edges/references survive. This is not
a valid use because it would leave stale pointers to ggc_freed memory
location. By auditing code I did not find any however this patch moves
the callees/references removal into the function itself that makes it
bit more robust.

Some code paths calling release_body already free these earlier, but
checking poitners for being NULL is not that expensive.

Bootstrapped/regtested x86_64-linux, comitted.

        PR lto/99447
        * cgraph.c (cgraph_node::release_body): Remove all callers and
        references.
        * cgraphclones.c (cgraph_node::materialize_clone): Do not do it here.
        * cgraphunit.c (cgraph_node::expand): And here.
diff --git a/gcc/cgraph.c b/gcc/cgraph.c
index 80140757d16..b77c676a58a 100644
--- a/gcc/cgraph.c
+++ b/gcc/cgraph.c
@@ -1860,6 +1860,9 @@ cgraph_node::release_body (bool keep_arguments)
       lto_free_function_in_decl_state_for_node (this);
       lto_file_data = NULL;
     }
+  gcc_assert (!clones);
+  remove_callees ();
+  remove_all_references ();
 }
 
 /* Remove function from symbol table.  */
diff --git a/gcc/cgraphclones.c b/gcc/cgraphclones.c
index 95103a423f7..9f86463b42d 100644
--- a/gcc/cgraphclones.c
+++ b/gcc/cgraphclones.c
@@ -1143,11 +1143,7 @@ cgraph_node::materialize_clone ()
   /* Function is no longer clone.  */
   remove_from_clone_tree ();
   if (!this_clone_of->analyzed && !this_clone_of->clones)
-    {
-      this_clone_of->release_body ();
-      this_clone_of->remove_callees ();
-      this_clone_of->remove_all_references ();
-    }
+    this_clone_of->release_body ();
 }
 
 #include "gt-cgraphclones.h"
diff --git a/gcc/cgraphunit.c b/gcc/cgraphunit.c
index 1c74cee69ac..0b70e4d4fde 100644
--- a/gcc/cgraphunit.c
+++ b/gcc/cgraphunit.c
@@ -1892,10 +1892,6 @@ cgraph_node::expand (void)
      comdat groups.  */
   assemble_thunks_and_aliases ();
   release_body ();
-  /* Eliminate all call edges.  This is important so the GIMPLE_CALL no longer
-     points to the dead function body.  */
-  remove_callees ();
-  remove_all_references ();
 }
 
 /* Node comparator that is responsible for the order that corresponds

Reply via email to