Assigning realloc back to the only pointer leaks on failure

Rebuilding aliases works for C callers. From a Lua script I'd rather there were no aliases to rebuild. Keep the allocation in the C host and give the script a userdata that stands for the buffer. A growth request then either fails, with the old buffer still there for another try, or succeeds and the same userdata now reaches the new block. If the wrapper never hands out raw addresses, no script has to remember which saved pointer just expired.

Forth's RESIZE can't have this bug. It leaves the new address and an ior on the stack, and on failure the address it returns is the old one and the old region is untouched. So after a failure you hold the pointer you started with plus a nonzero code. No assignment to get wrong, just two cells and whatever you do with them.

Forth is looser on the alias part. The standard only says the new address may or may not equal the old one. Nothing like C's rule that the old object is gone even when the address matches, so your doc line is stricter than anything Forth asks for.

Lua has already made this choice for you, which I find kind of lovely. Its allocator function gets the old pointer and both sizes, and the manual asks it to behave like realloc, returning NULL only when it can't fulfil the request. The one in the reference manual is barely more than that.

static void *l_alloc(void *ud, void *ptr, size_t osize,
                     size_t nsize) {
  (void)ud; (void)osize;
  if (nsize == 0) {
    free(ptr);
    return NULL;
  }
  return realloc(ptr, nsize);
}

When the allocator returns NULL, Lua raises a memory error and the old block is still where it was. So the null case is the interpreter's problem, not the script's. A wrapper that hands scripts a userdata instead of addresses gets the same comfort.

Right, and the script then sees one thing when growth fails, an error to catch with pcall, never a half-grown buffer.

Your precondition says the size is strictly positive. Keep it that way in the code, not only the docs. C23 made realloc with a size of zero undefined behavior outright, where C11 left it to the implementation whether you get null or a pointer you must not use. Plenty of older code assumes a zero size frees the block, so grep your callers for it before trusting the precondition.

The helper exists now, with the alias rule as drafted. For the failure path I wrapped realloc so that a chosen call returns a null pointer.

static int calls, fail_at = 3;

static void *test_realloc(void *p, size_t n)
{
	if (++calls == fail_at)
		return NULL;
	return realloc(p, n);
}

Whichever growth is set to fail, the helper has to hand back *buffer and *capacity unchanged and the contents up to the old capacity intact, and the single free at the end must release the block once. The wrapper turns each of those into a plain assertion.

The alias rule is harder to test. Save a char *end into the buffer, grow it from 40 bytes to 48, write through end. In a plain build that write can go through and the test pass, because the allocator grows the block in place, the address comes back equal, and the stale pointer keeps working. By 6.2.4 it is indeterminate all the same, but nothing on a typical platform says so. Under AddressSanitizer the same write is reported as a heap use after free, because there realloc returns a new block.

So the alias test runs only under the sanitizer, and the documentation states plainly that an equal address proves nothing about the old pointers. The sanitizer build is slower, but it is the only build here where the rule can fail visibly.

fail_at = 3 tests one failure, the third growth. Make it a loop. Count the reallocs a full run makes, then rerun the test once per index with calls reset, and check the same assertions every time. A fixed index tests the path you already had in mind. Looping over Zig's FailingAllocator the same way is how I found a leak at the very first allocation, a spot I'd never have picked by hand.

The upper bound comes out of the same wrapper. Run once with fail_at set to 0. Nothing ever matches, since calls is already 1 at the first comparison, and calls at the end is how many reallocs a full run makes. Then loop fail_at from 1 up to that number and reset calls before each run.