Update assume logic

Author: Your Name

lib/analyzer.h

@@ -156,6 +156,9 @@ struct Analyzer {
             Quiet = (1 << 0),
             Absolute = (1 << 1),
             ContainerEmpty = (1 << 2),
+            // Do not record the program state at the branch boundaries. Used when assuming a
+            // condition before the branch is traversed, where those states would be premature.
+            NoState = (1 << 3),
         };
     };
 

lib/forwardanalyzer.cpp

@@ -792,13 +792,16 @@ namespace {
                             // 'if (do_write)') it does not really reach there, so fork in analyze-only
                             // mode: the branch's effect is still tracked but nothing is reported in it.
                             ForwardTraversal ft = fork(!analyzer->updateScope(thenBranch.endBlock, false));
-                            ft.analyzer->assume(condTok, true);
+                            // The branch is traversed below, so don't record its boundary state here.
+                            ft.analyzer->assume(condTok, true, Analyzer::Assume::NoState);
                             Progress pThen = ft.updateBranch(thenBranch, depth - 1);
 
                             // Only commit the condition as false on the main path when it actually
-                            // matters
+                            // matters. With an else the else block is traversed below (so suppress the
+                            // boundary state); without one the false path continues past the closing
+                            // brace and must record the assumed state there.
                             if (thenBranch.isDead())
-                                analyzer->assume(condTok, false);
+                                analyzer->assume(condTok, false, hasElse ? Analyzer::Assume::NoState : Analyzer::Assume::None);
                             // The else block is traversed on the main path. If it kills the value
                             // (modified) the main path stops, but the then-fork may still carry the
                             // value forward, so defer the break until after the fork continues.

lib/vf_analyzers.cpp

@@ -735,7 +735,7 @@ struct ValueFlowAnalyzer : Analyzer {
             isCondBlock = Token::Match(parent->previous(), "if|while (");
         }
 
-        if (isCondBlock) {
+        if (isCondBlock && !(flags & Assume::NoState)) {
             const Token* startBlock = parent->link()->next();
             if (Token::simpleMatch(startBlock, ";") && Token::simpleMatch(parent->tokAt(-2), "} while ("))
                 startBlock = parent->linkAt(-2);
@@ -746,6 +746,10 @@ struct ValueFlowAnalyzer : Analyzer {
             } else {
                 if (Token::simpleMatch(endBlock, "} else {"))
                     pms.addState(endBlock->linkAt(2)->previous(), getProgramState());
+                else
+                    // No else: the false path continues past the closing brace, so record the
+                    // assumed state there so it is available to the rest of the enclosing scope.
+                    pms.addState(endBlock, getProgramState());
             }
         }
 

test/testvalueflow.cpp

@@ -6097,9 +6097,9 @@ class TestValueFlow : public TestFixture {
                "  c++;\n"
                "}\n";
         values = tokenValues(code, "c ++ ; }");
-        TODO_ASSERT_EQUALS(true, false, values.size() == 2);
-        // ASSERT_EQUALS(true, values.front().isUninitValue() || values.back().isUninitValue());
-        // ASSERT_EQUALS(true, values.front().isPossible() || values.back().isPossible());
+        ASSERT_EQUALS(true, values.size() == 2);
+        ASSERT_EQUALS(true, values.front().isUninitValue() || values.back().isUninitValue());
+        ASSERT_EQUALS(true, values.front().isPossible() || values.back().isPossible());
         // ASSERT_EQUALS(true, values.front().intvalue == 0 || values.back().intvalue == 0);
 
         code = "void b(bool d, bool e) {\n"