https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111519
--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> --- Reverting @@ -5089,8 +5123,9 @@ strlen_pass::handle_store (bool *zero_write) return false; } - if (storing_all_zeros_p - || storing_nonzero_p + if (storing_nonzero_p + || storing_all_zeros_p + || (full_string_p && lenrange[1] == 0) || (offset != 0 && store_before_nul[1] > 0)) { /* When STORING_NONZERO_P, we know that the string will start fixes the issue. We somehow compute a lenrange of { 0, 0, 1 } for d = _8 but also set storing_all_zeros_p to false. It seems that strlen_pass::count_nonzero_bytes happily skips intermediate stores when it handles SSA names here: gimple *stmt = SSA_NAME_DEF_STMT (exp); if (gimple_assign_single_p (stmt)) { exp = gimple_assign_rhs1 (stmt); if (!DECL_P (exp) && TREE_CODE (exp) != CONSTRUCTOR && TREE_CODE (exp) != MEM_REF) return false; /* Handle DECLs, CONSTRUCTOR and MEM_REF below. */ we have _8 = *_7; ... *_7 = prephitmp_89; d = _8; when we recursively process a memory reference we need to verify there are no intermediate aliases, the simplest thing would be to pass down a virtual use. Trying some prototype.