https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90905
--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> --- I meant for f1 not to see the string pointed to by p. The warning usually triggers either for the "must return" and "may return" case but in f1 it's too complicated for it to see that the return pointer may be that to str._M_local_buf. It might be possible to figure it out from the 'if (&str.D.19209._M_local_buf != _7)' below: <bb 9> [local count: 346356134]: # _23 = PHI <&str.D.19209._M_local_buf(8), _16(5)> __builtin_memcpy (_23, p.0_1, _15); <bb 10> [local count: 1073612976]: __dnew.6_20 = __dnew; MEM[(size_type *)&str + 8B] = __dnew.6_20; _21 = MEM[(char * *)&str]; _22 = _21 + __dnew.6_20; MEM[(char_type &)_22] = 0; __dnew ={v} {CLOBBER}; D.28812 ={v} {CLOBBER}; D.28808 ={v} {CLOBBER}; _7 = MEM[(char * *)&str]; if (&str.D.19209._M_local_buf != _7) goto <bb 11>; [53.47%] else goto <bb 12>; [46.53%] <bb 11> [local count: 574060859]: _5 = str.D.19209._M_allocated_capacity; _3 = _5 + 1; operator delete (_7, _3); <bb 12> [local count: 1073612977]: str ={v} {CLOBBER}; return _7; } I've been enhancing the warning to resolve pr71924 (and pr90549) so I might look into this if I get a chance.