https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90766
--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> --- Yes, good catch, thanks! The call can only be folded if i is known to be less than or equal to the length of the string, or if the rest of the buffer is all nuls. The strlen pass can readily determine the first, i.e., it can do the folding here: extern char a[8]; unsigned f (unsigned i) { __builtin_strcpy (a, "123"); if (i > 3) i = 3; return __builtin_strlen (&a[i]); // can be folded to 3 - i } The pass doesn't track the the trailing nuls yet so it can't easily do the folding in cases like below: unsigned g (unsigned i) { __builtin_memset (a, 0, sizeof a); __builtin_strcpy (a, "123"); return __builtin_strlen (&a[i]); // can be folded to (i <= 3 ? 3 - i : 0) } like the folder does for constant strings: const char a[8] = "123"; unsigned h (unsigned i) { return __builtin_strlen (&a[i]); // folded to (i <= 3 ? 3 - i : 0) }