Suppress GCC's false -Warray-bounds error in set_parents() with JSON_DIAGNOSTICS

With JSON_DIAGNOSTICS, GCC 13 to 15 report a false -Warray-bounds error
at -O3 when set_parents() is inlined right after a non-container value
(e.g., a string) was created: the std::map access in the object branch
is checked against the string allocation although m_type rules that
branch out. GCC 15 fixed the pattern from #4819 but not this one.

Suppress -Warray-bounds around set_parents() only, and add a regression
test that is compiled with -O3 -Werror=array-bounds on GCC.

Fixes #5742

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/cancel_closed_pr_runs.yml

@@ -1,53 +0,0 @@
-name: "Cancel runs of closed pull requests"
-
-# The concurrency groups of the other workflows cancel superseded runs when a
-# pull request gets new commits, but nothing stops the runs of its last commit
-# once the pull request is merged or closed. They then keep the runners busy
-# for hours while the queue of the open pull requests waits.
-#
-# pull_request_target is needed to get a token that can cancel runs for pull
-# requests from forks. This is safe because the workflow never checks out or
-# runs code from the pull request; it only calls the API.
-on:
-  pull_request_target:
-    types: [closed]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  cancel:
-    permissions:
-      actions: write
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
-        with:
-          egress-policy: audit
-
-      - name: Cancel unfinished runs of the pull request's head commit
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          SELF: ${{ github.run_id }}
-        # only runs triggered by the pull request: when a branch is pushed to
-        # develop directly, its push runs share the head commit
-        run: |
-          gh api --paginate "repos/$GH_REPO/actions/runs?head_sha=$HEAD_SHA&per_page=100" \
-            --jq ".workflow_runs[]
-                  | select(.status != \"completed\" and .id != $SELF)
-                  | select(.event == \"pull_request\" or .event == \"pull_request_target\")
-                  | \"\(.id) \(.name)\"" |
-          while read -r id name; do
-            echo "Cancelling run $id ($name)"
-            # a run may finish between listing and cancelling; that is not an error
-            gh run cancel "$id" || true
-          done

.github/workflows/check_amalgamation.yml

@@ -2,23 +2,16 @@ name: "Check amalgamation"
 
 on:
   pull_request:
-  # also check develop itself: a PR can be merged before its own run of this
-  # workflow completes (e.g. while it is still queued), leaving single_include
-  # stale on develop without any failing check
-  push:
-    branches:
-      - develop
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   save:
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -50,11 +43,11 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Checkout pull request or pushed commit
+      - name: Checkout pull request
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: main
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
       - name: Checkout tools

.github/workflows/comment_check_amalgamation.yml

@@ -10,8 +10,7 @@ permissions:
 
 jobs:
   comment:
-    # push runs on develop have no PR to comment on (and no "pr" artifact)
-    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read

include/nlohmann/json.hpp

@@ -763,6 +763,15 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         static_cast<void>(check_parents);
     }
 
+    // GCC 13 to at least 15 report a false -Warray-bounds error when set_parents()
+    // is inlined at -O3 right after a non-container value was created: the analysis
+    // does not use m_type to rule out the object/array branches and checks
+    // the std::map access against the allocation of, e.g., a string.
+    // See https://github.com/nlohmann/json/issues/5742 and #4819.
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
     void set_parents()
     {
 #if JSON_DIAGNOSTICS
@@ -799,6 +808,9 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         }
 #endif
     }
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
 
     iterator set_parents(iterator it, std::ptrdiff_t count_set_parents)
     {

single_include/nlohmann/json.hpp

@@ -27441,6 +27441,15 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         static_cast<void>(check_parents);
     }
 
+    // GCC 13 to at least 15 report a false -Warray-bounds error when set_parents()
+    // is inlined at -O3 right after a non-container value was created: the analysis
+    // does not use m_type to rule out the object/array branches and checks
+    // the std::map access against the allocation of, e.g., a string.
+    // See https://github.com/nlohmann/json/issues/5742 and #4819.
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
     void set_parents()
     {
 #if JSON_DIAGNOSTICS
@@ -27477,6 +27486,9 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         }
 #endif
     }
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
 
     iterator set_parents(iterator it, std::ptrdiff_t count_set_parents)
     {

tests/CMakeLists.txt

@@ -139,6 +139,11 @@ json_test_set_test_options(test-unicode4 TEST_PROPERTIES TIMEOUT 3000)
 # only the #972 regression test needs thirdparty/fifo_map on its include path
 json_test_set_test_options(test-regression1 LINK_LIBRARIES fifo_map_include)
 
+# GCC's false -Warray-bounds error with JSON_DIAGNOSTICS only shows up when optimizing (#5742)
+json_test_set_test_options(test-diagnostics-optimized
+    COMPILE_OPTIONS $<$<CXX_COMPILER_ID:GNU>:-O3 -Werror=array-bounds>
+)
+
 #############################################################################
 # add unit tests
 #############################################################################

tests/src/unit-diagnostics-optimized.cpp

@@ -0,0 +1,76 @@
+//     __ _____ _____ _____
+//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
+// |  |  |__   |  |  | | | |  version 3.12.0
+// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
+//
+// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
+// SPDX-License-Identifier: MIT
+
+// Regression test for https://github.com/nlohmann/json/issues/5742: with
+// JSON_DIAGNOSTICS, GCC (13 to at least 15) reports a false -Warray-bounds
+// error in the inlined set_parents() at -O3. The warning depends on GCC's
+// inlining decisions, so the sections cover patterns that trigger it on
+// different GCC versions (#4819: GCC 13 and 14; #5742: GCC 14 and 15).
+// On GCC, this file is compiled with -O3 -Werror=array-bounds (see
+// tests/CMakeLists.txt), so the test fails to build if the warning returns.
+
+#include "doctest_compatibility.h"
+
+#ifdef JSON_DIAGNOSTICS
+    #undef JSON_DIAGNOSTICS
+#endif
+
+#define JSON_DIAGNOSTICS 1
+
+#include <nlohmann/json.hpp>
+using nlohmann::json;
+
+#include <algorithm>
+#include <iterator>
+#include <utility>
+#include <vector>
+
+namespace
+{
+enum class diag_color
+{
+    red,
+    green,
+    blue
+};
+
+void to_json(json& j, const diag_color& c)
+{
+    static const std::pair<diag_color, json> m[] = // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays)
+    {
+        {diag_color::red, "r"},
+        {diag_color::green, "g"},
+        {diag_color::blue, "b"},
+    };
+    const auto* it = std::find_if(std::begin(m), std::end(m), [c](const std::pair<diag_color, json>& p)
+    {
+        return p.first == c;
+    });
+    j = it->second;
+}
+} // namespace
+
+TEST_CASE("diagnostics with optimization")
+{
+    SECTION("issue #4819 - object in vector")
+    {
+        std::vector<json> jsons{};
+        jsons.emplace_back(json({{"key", "value"}}));
+        CHECK(jsons.back()["key"] == "value");
+    }
+
+    SECTION("issue #5742 - string values from a static table")
+    {
+        json j = json::array();
+        j.push_back(diag_color::red);
+        j.push_back(diag_color::green);
+        j.push_back(diag_color::blue);
+        CHECK(j.dump() == R"(["r","g","b"])");
+        CHECK_THROWS_WITH_AS(j[1].get<int>(), "[json.exception.type_error.302] (/1) type must be number, but is string", json::type_error);
+    }
+}