One thing I need to point out first is, currently, even for regular fixed size array in the structure, We have this same issue, for example:
#define LENGTH 10 struct fix { size_t foo; int array[LENGTH]; }; … int main () { struct fix *p; p = alloc_buf_more (); expect(__builtin_object_size(p->array, 1), LENGTH * sizeof(int)); expect(__builtin_object_size(p->array, 0), -1); } Currently, for __builtin_object_size(p->array, 0), GCC return UNKNOWN for it. This is not a special issue for flexible array member. Qing On Aug 3, 2023, at 1:19 PM, Siddhesh Poyarekar <siddh...@gotplt.org> wrote: > > On 2023-08-03 12:43, Qing Zhao wrote: >>> Surely we could emit that for __bdos(q->array, 0) though, couldn't we? >> For __bdos(q->array, 0), we only have the access info for the sub-object >> q->array, we can surely decide the size of the sub-object q->array, but we >> still cannot >> decide the whole object that is pointed by q (the same reason as above), >> right? > > It's tricky, I mean we could assume p to be a valid object due to the > dereference and hence assume that q->foo is also valid and that there's at > least sizeof(*q) + q->foo * sizeof (q->array) bytes available. The question > then is whether q could be pointing to an element of an array of `struct > annotated`. Could we ever have a valid array of such structs that have a > flex array at the end? Wouldn't it always be a single object? > > In fact for all pointers to such structs with a flex array at the end, could > we always assume that it is a single object and never part of an array, and > hence return sizeof()? > > Thanks, > Sid