https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82046
--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> --- I suppose fancy threading gets in the way... <bb 10> [84.09%]: # p_4 = PHI <p_55(6), p_14(9)> if (p_4 == 0B) goto <bb 11>; [0.04%] else goto <bb 20>; [99.96%] <bb 11> [0.03%]: __builtin___ubsan_handle_nonnull_arg (&*.Lubsan_data0); __builtin_sprintf (0B, "%lu", last_count_13); __builtin___ubsan_handle_nonnull_arg (&*.Lubsan_data2); <bb 12> [84.09%]: _1 = __builtin_strlen (p_4); threaded the two nonnull checks on p for sprintf and strlen. Not sure what we can do about these cases (besides forcing no-warning on all stmts in duplicated blocks by threading). Less stupid sanitizing maybe, or earlier simplifying. Or not exposing the NULL checks early but combine them with the sanitizer builtins. __builtin___ubsan_handle_nunull_arg (p_4, &*.Lubsan_data0); etc. this way we can even "CSE" dominating ones (I suppose getting the redundant ubsan warning on strlen isn't important). We'd then lower the control flow at sanopt time for example or in an extra pass.