[llvm] [FunctionSpecializer] Keep the blocks in dead functions and remove the callsites of dead function properly. (PR #154668)

[via llvm-commits]

================
@@ -844,6 +844,16 @@ void FunctionSpecializer::removeDeadFunctions() {
                       << F->getName() << "\n");
     if (FAM)
       FAM->clear(*F, F->getName());
+
+    // Remove all the callsites that were proven unreachable once, and replace
+    // them with poison.
+    for (User *U : make_early_inc_range(F->users())) {
+      assert((isa<CallInst>(U) || isa<InvokeInst>(U)) &&
----------------
XChy wrote:

I find out why such a mistake is not exposed:
 https://github.com/llvm/llvm-project/blob/79566b2e831c605a8457e5f517b2375f1afa56a4/llvm/lib/Transforms/IPO/FunctionSpecialization.cpp#L1209
`Solver.isArgumentTrackedFunction` guarantees that the address of the function is not taken, so there are no other users of the fully specialized function by coincidence.


https://github.com/llvm/llvm-project/pull/154668