Merge from fork

Author: Your Name

lib/forwardanalyzer.cpp

@@ -682,9 +682,10 @@ namespace {
                         // here via the 'then' branch, so the value established there is still
                         // definite - keep it known instead of lowering to possible.
                         bool elseEscape = false;
-                        bool unknownEscape = false;
-                        if (!inLoop && !inElse && hasElse)
+                        if (!inLoop && !inElse && hasElse) {
+                            bool unknownEscape = false;
                             elseEscape = isEscapeScope(tok->linkAt(2), unknownEscape);
+                        }
                         if (!condTok->hasKnownIntValue() || inLoop) {
                             if (!elseEscape && !analyzer->lowerToPossible())
                                 return Break(Analyzer::Terminate::Bail);
@@ -793,6 +794,9 @@ namespace {
                             // The branch is traversed below, so don't record its boundary state here.
                             ft.analyzer->assume(condTok, true, Analyzer::Assume::Pending);
                             Progress pThen = ft.updateBranch(thenBranch, depth - 1);
+                            // Merge the fork's actions so a modification in the then-branch bubbles up
+                            // to the enclosing branch's isModified().
+                            actions |= thenBranch.action;
 
                             // Commit the condition as false on the main path only when the then-branch
                             // is dead. The else block, if any, is traversed separately (Pending); with

test/testcondition.cpp

@@ -4911,6 +4911,17 @@ class TestCondition : public TestFixture {
         ASSERT_EQUALS("[test.cpp:3:10]: (style) Condition 'b()' is always false [knownConditionTrueFalse]\n"
                       "[test.cpp:4:9]: (style) Condition '!b()' is always true [knownConditionTrueFalse]\n",
                       errout_str());
+
+        check("int g();\n" // a value modified inside a nested branch must be lowered to possible
+              "void f(int outer, int inner) {\n"
+              "    int bits = 0;\n"
+              "    if (outer) {\n"
+              "        if (inner == 1)\n"
+              "            bits = g();\n"
+              "    }\n"
+              "    if (bits > 0) {}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void alwaysTrueSymbolic()