https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86203
--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> --- You're right, a strict reading of the standard does imply that the pointer argument to strlen could point to the integer. I keep forgetting about this unfortunate loophole. Ironically, the equivalent code using snprintf could be optimized because the argument to %s "shall be a pointer to the initial element of an array of character type." I.e., it cannot point to an int object: int n; int f (char *s) { n = __builtin_snprintf (0, 0, "%s", s); return __builtin_snprintf (0, 0, "%s", s); // could be replaced by return n; }