Fix remaining tests

Author: Your Name

lib/forwardanalyzer.cpp

@@ -412,8 +412,23 @@ namespace {
             return bail;
         }
 
-        Progress updateBranch(Branch& branch, int depth)
+        Progress updateBranch(Branch& branch, int depth, bool flow)
         {
+            // Determine the branch's effect on the value without reporting (read-only)
+            branch.action |= analyzeScope(branch.endBlock);
+            // Mirror checkBranch()/tryForkUpdateScope(): only flow the value into the branch when
+            // the analyzer allows it. A conditional value (e.g. a possible null carried under an
+            // unrelated condition) must not be propagated into the branch, otherwise it produces
+            // false positives. 'flow' is evaluated on the unassumed value by the caller.
+            if (!flow) {
+                bool unknown = false;
+                if (isEscapeScope(branch.endBlock, unknown)) {
+                    branch.escape = true;
+                    branch.escapeUnknown = unknown;
+                }
+                return Progress::Continue;
+            }
+
             // Save and reset actions
             Analyzer::Action prevActions = actions;
             actions = Analyzer::Action::None;
@@ -765,20 +780,34 @@ namespace {
                         const bool hasElse = Token::simpleMatch(endBlock, "} else {");
                         tok = hasElse ? endBlock->linkAt(2) : endBlock;
                         if (thenBranch.check) {
+                            // The condition is only "known" because of an earlier assumption, so the
+                            // skipped else block could still modify the value -> lower to possible
+                            if (analyzer->isConditional() && hasElse && analyzeScope(elseBranch.endBlock).isModified() &&
+                                !analyzer->lowerToPossible())
+                                return Break(Analyzer::Terminate::Bail);
                             if (updateScope(thenBranch.endBlock, depth - 1) == Progress::Break)
                                 return Break();
                         } else if (elseBranch.check) {
+                            // Likewise the skipped then block could still modify the value
+                            if (analyzer->isConditional() && analyzeScope(thenBranch.endBlock).isModified() &&
+                                !analyzer->lowerToPossible())
+                                return Break(Analyzer::Terminate::Bail);
                             if (elseBranch.endBlock && updateScope(elseBranch.endBlock, depth - 1) == Progress::Break)
                                 return Break();
                         } else {
-                            const bool conditional = analyzer->isConditional();
+                            const bool conditional = stopOnCondition(condTok);
+                            // Decide whether the value may flow into each branch using the unassumed
+                            // value (as checkBranch() does), before assume() makes the forks conditional
+                            const bool flowThen = analyzer->updateScope(thenBranch.endBlock, analyzeScope(thenBranch.endBlock).isModified());
+                            const bool flowElse = hasElse && elseBranch.endBlock &&
+                                                  analyzer->updateScope(elseBranch.endBlock, analyzeScope(elseBranch.endBlock).isModified());
                             ForwardTraversal ft = fork();
                             ft.analyzer->assume(condTok, true);
-                            Progress p = ft.updateBranch(thenBranch, depth - 1);
+                            Progress p = ft.updateBranch(thenBranch, depth - 1, flowThen);
 
                             analyzer->assume(condTok, false);
                             if (hasElse) {
-                                if (updateBranch(elseBranch, depth - 1) == Progress::Break)
+                                if (updateBranch(elseBranch, depth - 1, flowElse) == Progress::Break)
                                     return Break();
                             }
                             if (thenBranch.isDead() || elseBranch.isDead()) {

test/testautovariables.cpp

@@ -4848,7 +4848,7 @@ class TestAutoVariables : public TestFixture {
               "        return *iPtr;\n"
               "    return 0;\n"
               "}");
-        ASSERT_EQUALS("[test.cpp:5:16] -> [test.cpp:4:13] -> [test.cpp:8:17]: (error) Using pointer to local variable 'x' that is out of scope. [invalidLifetime]\n", errout_str());
+        ASSERT_EQUALS("[test.cpp:5:16] -> [test.cpp:7:10] -> [test.cpp:4:13] -> [test.cpp:8:17]: (error) Using pointer to local variable 'x' that is out of scope. [invalidLifetime]\n", errout_str());
 
         // #11753
         check("int main(int argc, const char *argv[]) {\n"

test/testother.cpp

@@ -11491,7 +11491,7 @@ class TestOther : public TestFixture {
               "        x = a + b;\n"
               "    return x;\n"
               "}\n");
-        ASSERT_EQUALS("[test.cpp:2:11] -> [test.cpp:4:9]: (style) Variable 'x' is assigned an expression that holds the same value. [redundantAssignment]\n",
+        ASSERT_EQUALS("[test.cpp:2:11] -> [test.cpp:3:9] -> [test.cpp:4:9]: (style) Variable 'x' is assigned an expression that holds the same value. [redundantAssignment]\n",
                       errout_str());
     }
 

test/teststl.cpp

@@ -368,7 +368,7 @@ class TestStl : public TestFixture {
                     "    if(b) ++x;\n"
                     "    return s[x];\n"
                     "}");
-        ASSERT_EQUALS("[test.cpp:5:13]: error: Out of bounds access in 's[x]', if 's' size is 6 and 'x' is 6 [containerOutOfBounds]\n", errout_str());
+        ASSERT_EQUALS("[test.cpp:5:13]: error: Out of bounds access in 's[x]', if 's' size is 6 and 'x' is 7 [containerOutOfBounds]\n", errout_str());
 
         checkNormal("void f() {\n"
                     "    static const int N = 4;\n"
@@ -2736,7 +2736,7 @@ class TestStl : public TestFixture {
               "}\n", s);
         ASSERT_EQUALS("[test.cpp:5:9]: warning: Array index -1 is out of bounds. [negativeContainerIndex]\n"
                       "[test.cpp:8:8]: note: Calling function 'f', 1st argument '-1' value is -1\n"
-                      "[test.cpp:3:9]: note: Assuming condition is false\n"
+                      "[test.cpp:3:9]: note: Assuming condition is true\n"
                       "[test.cpp:5:9]: note: Negative array index\n",
                       errout_str());
     }

test/testuninitvar.cpp

@@ -4284,7 +4284,7 @@ class TestUninitVar : public TestFixture {
                         "    else y = 123;\n" // <- y is always initialized
                         "    return y;\n"
                         "}");
-        TODO_ASSERT_EQUALS("", "[test.cpp:5:9] -> [test.cpp:7:12]: (warning) Uninitialized variable: y [uninitvar]\n", errout_str());
+        ASSERT_EQUALS("", errout_str()); // #4560: fork-based condition analysis tracks x==0 -> else branch -> y initialized
 
         valueFlowUninit("void f(int x) {\n" // #3948
                         "  int value;\n"