[PATCH] ipa-icf: Step to the next caller past a thunk in redirect_all_callers

[Kees Cook <kees@kernel.org>]

redirect_all_callers walks the callers of N, but steps past a thunk
caller with next_callee, the next call the thunk makes.  A thunk makes
only that one call, so the walk ends there, and so the callers after
the thunk in the list would not be redirected.  This came with the thunk
check in commit 17d1bf760f8 ("re PR target/65263").

gcc/ChangeLog:

	* ipa-icf.cc (redirect_all_callers): Step to the next caller, not
	the next callee, past a thunk.

Signed-off-by: Kees Cook <kees@kernel.org>
---
I found this while looking through ICF code and Richard's recently
proposed changes with inlining, so it's technically unrelated, but it
looked wrong.  But I haven't found a way to reach it: on targets with
symbol aliases a thunk calls a local alias of its function (.LTHUNKn),
whose other callers come from redirections and so are ahead of the thunk
in the list, and on targets without them, such as Darwin, thunks are
expanded to GIMPLE before ICF.  So I have not been able to build a test
case for this, and I suspect it may just be accidentally/effectively
dead code?  But the intent of the function didn't seem to match the
result of the "else"'s list-walk.
---
 gcc/ipa-icf.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gcc/ipa-icf.cc b/gcc/ipa-icf.cc
index 64cc722bd7aa..7b524bdf16b1 100644
--- a/gcc/ipa-icf.cc
+++ b/gcc/ipa-icf.cc
@@ -995,7 +995,7 @@ redirect_all_callers (cgraph_node *n, cgraph_node *to)
           nredirected++;
 	}
       else
-	e = e->next_callee;
+	e = e->next_caller;
     }
   for (unsigned i = 0; n->iterate_direct_aliases (i, ref);)
     {
-- 
2.55.0