I'm analysing how the compiler implements the variable-length array in c99. The following is my c code and disassembly which is commented on my understanding. The code is compiled with "-O3 -fomit-frame-pointer -fno-stack-protector -fpie"

c code:

# include<stdio.h>

int main() {
  size_t sz; // never be signed
  scanf("%zd", &sz);
  volatile char s[sz 1]; // prevent to be optimized away.
  s[sz] = '\0';     
}

disassembly:

Reading symbols from a.out...
(gdb) disass main
Dump of assembler code for function main():
   0x0000000000001060 < 0>:     endbr64                  
   0x0000000000001064 < 4>:     push   %rbp              # save the current frame pointer.
   0x0000000000001065 < 5>:     lea    0xf98(%rip),%rdi  # rdi = "%zd". 1st param
   0x000000000000106c < 12>:    xor