https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101665
--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> --- It was originally just guarding whether there can be an object at address zero. The later adjustment to also cover NULL pointer checks is incomplete at the implementation side. It's also not clear if it should cover like *p = 0; if (!p) abort (); I think it's reasonable to elide the null pointer check here so I think the documentation needs to be clarified on the additional effects. nonnull_arg_p for example was not adjusted to ignore the 'nonnull' attribute. I belive the documentation should single-out the 'nonnull' attribute explicitely as the only secondary effect and the implementation would have to be adjusted.
