https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82732
--- Comment #1 from Marc Glisse <glisse at gcc dot gnu.org> --- We do recognize the memset early enough. What we fail to recognize is that the size argument to malloc is the same as the length of the memset: _1 = (long unsigned int) size_8(D); _2 = _1 * 4; p_11 = malloc (_2); if (size_8(D) != 0) goto <bb 3>; [85.00%] [count: INV] else goto <bb 4>; [15.00%] [count: INV] <bb 3> [12.75%] [count: INV]: _18 = size_8(D) + 4294967295; _21 = (sizetype) _18; _7 = _21 + 1; _6 = _7 * 4; __builtin_memset (p_11, 0, _6); VRP could be taught to simplify (unsigned long)(u-1)+1 to (unsigned long)u for unsigned int u non-zero (though there is no VRP between ldist and strlen), or we could try to generate some simpler code in ldist...