https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98109
--- Comment #6 from Giuseppe Piscitelli <ooonea at gmail dot com> ---
Still reproducible with GCC 16.2.0 on x86_64-unknown-linux-gnu. This arose
while qualifying an optimized UBSan build of OpenZFS; the reduced case below
needs no OpenZFS headers or libraries.
The warning in test() is a false positive: its arguments are unknown pointers,
not source-level null constants. negative() is an intentional real-null control
whose warning must remain. Both functions use a nonzero access size.
Testcase (pr98109.c):
```c
/* PR middle-end/98109 */
/* { dg-do compile } */
/* Late access warnings require code generation, also with -flto. */
/* { dg-options "-O2 -Wall -fsanitize=undefined -ffat-lto-objects" } */
extern void copy (char *, const char *, __SIZE_TYPE__)
__attribute__((nonnull (1, 2), access (write_only, 1, 3)));
extern char *find (const char *, const char *) __attribute__((nonnull (1, 2)));
void test (char *p, const char *q)
{
copy (p, q, 16); /* { dg-bogus "argument 1 is null" } */
if (find (p, "x"))
find (p, "x")[0] = 0;
}
void negative (char *p)
{
for (int i = 0; i < 4; ++i)
{
char *q = p;
if (i == 3)
q = 0;
copy (q, "0123456789abcde", 16); /* { dg-warning "argument 1 is null" }
*/
}
}
```
Command:
```
gcc -fsanitize=undefined -O2 -Wall -fdiagnostics-plain-output
-fdiagnostics-color=never -S pr98109.c -o /dev/null
```
GCC emits this warning twice for test():
```
pr98109.c:12:3: warning: argument 1 is null but the corresponding size argument
3 value is 16 [-Wnonnull]
pr98109.c:6:13: note: in a call to function ‘copy’ declared with attribute
‘access (write_only, 1, 3)’
```
It also correctly diagnoses the intentional null in negative() at line 24.
Removing only -fsanitize=undefined removes both warnings at line 12 while
retaining the real-null warning at line 24. Compilation exits zero in both
cases; -Werror=nonnull would make the false diagnostic a build failure.
The same result was checked with the packaged GCC 16.2.0 and a separately
built original GCC 16.2 C compiler. The behavior matches the sanitizer-created
null paths and subsequent jump threading already described in comments 1 and 5:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98109#c1
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98109#c5
Assisted-by: OpenAI Codex
