https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92056
--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Seems a bug introduced in r120581, COND_EXPR really needs to be handled like a PHI node, which is handled as: for (i = 0; i < gimple_phi_num_args (stmt); i++) { tree rhs = gimple_phi_arg (stmt, i)->def; if (object_sizes[object_size_type][varno] == unknown[object_size_type]) break; if (TREE_CODE (rhs) == SSA_NAME) reexamine |= merge_object_sizes (osi, var, rhs, 0); else if (osi->pass == 0) expr_object_size (osi, var, rhs); } and the break once we reach unknown size is what was missing in the COND_EXPR handling code. That said, I'm additionally wondering if determine_min_objsize shouldn't call init_object_sizes (); because otherwise it will handle only a very small subset of what compute_builtin_object_size can do. get_destination_size from gimple-ssa-sprintf.c calls it during the strlen pass if *printf is encountered, but if it is not, then no SSA_NAME objsz computation is done.