GCC Newspaper
OCTOBER 6, 2026
Date
/
Architectures
Components
Topics
News & Policy
Other
ipa-icf

ICF now checks function non-null contracts to prevent incorrect merging.

Inter-Function Cloning (ICF) now correctly compares function non-null argument contracts, preventing it from merging functions with differing promises and caus…

This commit fixes a bug in GCC’s Inter-Function Cloning (ICF) pass where it failed to consider the non-null contract promises of functions. Previously, ICF could merge identical function bodies even if they made different guarantees about their arguments’ non-nullability. This could lead to a function with a strict non-null promise being unified with one that accepts nulls, subsequently causing a null pointer dereference when called via the latter symbol. The changes ensure that ICF correctly compares function type attributes and differentiates between METHOD_TYPE and FUNCTION_TYPE to prevent such dangerous merges.

In Details

The ICF pass in ipa-icf.cc incorrectly equated functions solely based on identical bodies, overlooking differences in their non-null argument contracts. sem_function::equals_wpa used comp_type_attributes, which ignores attributes like nonnull that don't set affects_type_identity. It also failed to properly compare METHOD_TYPE (implicit non-null this) against FUNCTION_TYPE. This commit modifies equals_wpa to compare TYPE_ATTRIBUTES as a list and to reject merging METHOD_TYPE with FUNCTION_TYPE, addressing PR123227.

For Context
ICF
Inter-Function Cloning, an optimization pass in GCC that identifies identical function bodies and merges them into a single copy to reduce code size and potentially improve instruction cache utilization.
non-null contract
A guarantee made by a function that its specified arguments will not be null pointers. This contract can be explicitly stated via attributes or implicitly through types like C++ references or METHOD_TYPE.
METHOD_TYPE
In C++, a type representing a member function. Such functions implicitly receive a non-null pointer to the object instance (the 'this' pointer) as their first argument.
FUNCTION_TYPE
A type representing a function pointer or a function declaration in C/C++. It specifies the return type and parameter types.
type attributes
Metadata associated with a type that provides additional information or constraints, such as const, volatile, or nonnull.
Filed Under: optimizationIPAcompiler