diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 9f03c0f2432293b1836d6105b884c453af832cc0..3235ba0da4521eddeb91752bf0f0706b127fd6d6 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,5 +1,9 @@
 2014-11-21  Jakub Jelinek  <jakub@redhat.com>
 
+	PR tree-optimization/61773
+	* tree-ssa-strlen.c (get_string_length): Don't assert
+	stpcpy has been prototyped if si->stmt is BUILT_IN_MALLOC.
+
 	PR target/63910
 	* simplify-rtx.c (simplify_immed_subreg): Return NULL for integer
 	modes wider than MAX_BITSIZE_MODE_ANY_INT.  If not using
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 034f4d941745f59b76d19f10651fc062be10a1c7..67e3895b9f1f0bde531235826e9bb4be47042a77 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,5 +1,8 @@
 2014-11-21  Jakub Jelinek  <jakub@redhat.com>
 
+	PR tree-optimization/61773
+	* gcc.dg/pr61773.c: New test.
+
 	PR target/63764
 	* c-c++-common/pr63764-1.c: New test.
 	* c-c++-common/pr63764-2.c: New test.
diff --git a/gcc/testsuite/gcc.dg/pr61773.c b/gcc/testsuite/gcc.dg/pr61773.c
new file mode 100644
index 0000000000000000000000000000000000000000..e0b4e60202d43115422b8c92620865230572087c
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr61773.c
@@ -0,0 +1,16 @@
+/* PR tree-optimization/61773 */
+/* { dg-do compile } */
+/* { dg-options "-O2" } */
+
+void
+foo (char **x)
+{
+  char *p = __builtin_malloc (64);
+  char *q = __builtin_malloc (64);
+  __builtin_strcat (q, "abcde");
+  __builtin_strcat (p, "ab");
+  p[1] = q[3];
+  __builtin_strcat (p, q);
+  x[0] = p;
+  x[1] = q;
+}
diff --git a/gcc/tree-ssa-strlen.c b/gcc/tree-ssa-strlen.c
index c02e6128aa7ced94775c4f71a0a35177d42e1fc9..7b1c0d95f4a18cf39e0e466a408080efa9e2c17b 100644
--- a/gcc/tree-ssa-strlen.c
+++ b/gcc/tree-ssa-strlen.c
@@ -430,7 +430,6 @@ get_string_length (strinfo si)
       callee = gimple_call_fndecl (stmt);
       gcc_assert (callee && DECL_BUILT_IN_CLASS (callee) == BUILT_IN_NORMAL);
       lhs = gimple_call_lhs (stmt);
-      gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY));
       /* unshare_strinfo is intentionally not called here.  The (delayed)
 	 transformation of strcpy or strcat into stpcpy is done at the place
 	 of the former strcpy/strcat call and so can affect all the strinfos
@@ -479,6 +478,7 @@ get_string_length (strinfo si)
 	case BUILT_IN_STRCPY_CHK:
 	case BUILT_IN_STRCPY_CHKP:
 	case BUILT_IN_STRCPY_CHK_CHKP:
+	  gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY));
 	  if (gimple_call_num_args (stmt) == (with_bounds ? 4 : 2))
 	    fn = builtin_decl_implicit (BUILT_IN_STPCPY);
 	  else