Description
With the attached reproducer, the f2_* functions containing the second half of a two-instruction GOT entry reference are ICF'd, but the f1_* functions containing the first half of the reference are not. Because the two functions refer to different GOT entries, about half of the f1_* functions end up loading from the wrong GOT entry (or potentially from an address outside the GOT entirely).
clang --target=aarch64-linux -c icf-bug.s
ld.lld icf-bug.o --icf=all
objdump -d
[...]
00000000002128e4 <f1_504>:
2128e4: d0000080 adrp x0, 224000 <f1_1000+0xffdc>
2128e8: d2803f01 mov x1, #0x1f8 // #504
2128ec: 17fffa17 b 211148 <f2_0>
00000000002128f0 <f1_505>:
2128f0: d0000080 adrp x0, 224000 <f1_1000+0xffdc>
2128f4: d2803f21 mov x1, #0x1f9 // #505
2128f8: 17fffa14 b 211148 <f2_0>
00000000002128fc <f1_506>:
2128fc: f0000080 adrp x0, 225000 <f1_1000+0x10fdc>
212900: d2803f41 mov x1, #0x1fa // #506
212904: 17fffa11 b 211148 <f2_0>
0000000000212908 <f1_507>:
212908: f0000080 adrp x0, 225000 <f1_1000+0x10fdc>
21290c: d2803f61 mov x1, #0x1fb // #507
212910: 17fffa0e b 211148 <f2_0>