https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104434
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Seen on https://github.com/xianyi/OpenBLAS/blob/c5f280a7f0e875d83833d895b2b8b0e341efabf4/lapack-netlib/LAPACKE/src/lapacke_cgbbrd_work.c where the code has: if( LAPACKE_lsame( vect, 'b' ) || LAPACKE_lsame( vect, 'p' ) ) { pt_t = (lapack_complex_float*) LAPACKE_malloc( sizeof(lapack_complex_float) * ldpt_t * MAX(1,n) ); ...snip... } [...snip lots of code...] if( LAPACKE_lsame( vect, 'b' ) || LAPACKE_lsame( vect, 'p' ) ) { LAPACKE_free( pt_t ); } where the analyzer considers the execution path where the conditions guarding the malloc and the free are first true, and then false. LAPACKE_lsame is a case-insensitive comparison, implemented in its own source file. I think if it were marked as "pure", the analyzer could fix this without needing LTO.