[SCCP][FuncSpec] Poison unreachable constant global variable user

llvm/lib/Transforms/IPO/SCCP.cpp

@@ -330,12 +330,15 @@ static bool runIPSCCP(
     LLVM_DEBUG(dbgs() << "Found that GV '" << GV->getName()
                       << "' is constant!\n");
     for (User *U : make_early_inc_range(GV->users())) {
-      // We can remove LoadInst here, because we already replaced its users
-      // with a constant.
+      // We can remove LoadInst here. The LoadInsts in dead functions marked by
+      // FuncSpec are not simplified to constants, thus poison them.
       assert((isa<StoreInst>(U) || isa<LoadInst>(U)) &&
              "Only Store|Load Instruction can be user of GlobalVariable at "
              "reaching here.");
-      cast<Instruction>(U)->eraseFromParent();
+      Instruction *I = cast<Instruction>(U);
+      if (isa<LoadInst>(I))
+        I->replaceAllUsesWith(PoisonValue::get(I->getType()));
+      I->eraseFromParent();
     }
 
     // Try to create a debug constant expression for the global variable

llvm/test/Transforms/FunctionSpecialization/dead-gv-load.ll

@@ -0,0 +1,31 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
+; RUN: opt -passes=ipsccp  --funcspec-min-function-size=1 -S < %s | FileCheck %s
+
+@gv = internal global ptr null
+
+define i8 @caller() {
+; CHECK-LABEL: define i8 @caller() {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[CALL1:%.*]] = call i8 @callee.specialized.1(i32 1)
+; CHECK-NEXT:    [[CALL2:%.*]] = call i8 @callee.specialized.2(i32 0)
+; CHECK-NEXT:    ret i8 undef
+;
+entry:
+  %call1 = call i8 @callee(i32 1)
+  %call2 = call i8 @callee(i32 0)
+  ret i8 %call2
+}
+
+define internal i8 @callee(i32 %arg) {
+entry:
+  %useless = icmp ne i32 %arg, 0
+  br label %loop
+
+loop:                                       ; preds = %loop, %entry
+  br label %loop
+
+dead_bb:                                       ; No predecessors!
+  %l1 = load ptr, ptr @gv, align 8
+  %l2 = load ptr, ptr %l1, align 8
+  ret i8 0
+}