https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87489
--- Comment #12 from Martin Sebor <msebor at gcc dot gnu.org> --- Created attachment 50098 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50098&action=edit Patch to move -Wnonnull to pass_merge_phi. No change in GCC 11 so far. I've reduced the test case in attachment 44775 to just the essentials and copied it below. The dumps confirm that the warning in this case is issued too early, before the strlen(0B) call has been eliminated. As Jeff notes in comment #11, FRE3 is the first pass where the bad strlen call has been removed. $ cat pr87489.c && gcc -O -S -Wall -Wpedantic -fdump-tree-all pr87489.c && grep strlen * | grep 0B extern void f (const void*, int); static void g (int i, const char *s) { int j = 0; if (i) j |= 1; if (j) f (&j, 0); if (j & 1) f (s, __builtin_strlen (s)); } void h (void) { g (0, 0); } In function ‘g’, inlined from ‘h’ at ../pr87489.c:19:3: pr87489.c:14:11: warning: argument 1 null where non-null expected [-Wnonnull] 14 | f (s, __builtin_strlen (s)); | ^~~~~~~~~~~~~~~~~~~~ pr87489.c: In function ‘h’: pr87489.c:14:11: note: in a call to built-in function ‘__builtin_strlen’ pr87489.c.092t.fixup_cfg3: _6 = __builtin_strlen (0B); pr87489.c.097t.adjust_alignment: _6 = __builtin_strlen (0B); pr87489.c.098t.ccp2: _6 = __builtin_strlen (0B); pr87489.c.099t.post_ipa_warn1: _6 = __builtin_strlen (0B); pr87489.c.101t.backprop: _6 = __builtin_strlen (0B); pr87489.c.102t.phiprop: _6 = __builtin_strlen (0B); pr87489.c.103t.forwprop2: _6 = __builtin_strlen (0B); pr87489.c.104t.objsz2: _6 = __builtin_strlen (0B); pr87489.c.105t.alias: _6 = __builtin_strlen (0B); pr87489.c.106t.retslot: _6 = __builtin_strlen (0B); As an experiment, I tried running -Wnonnull later, in mergephi2 (see the attached patch titled gcc-87489.diff). That avoids the warning, passes bootstrap, and causes no testsuite regressions.