From 1ab5805d98c09beea638e92b10864878cf819208 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <daniel.marjamaki@gmail.com>
Date: Mon, 8 Feb 2016 10:43:41 +0100
Subject: [PATCH] Fixed #6616 (valueFlowForward: for loop, variable in 3rd
 expression is changed in loop body)

---
 lib/valueflow.cpp      | 4 ++--
 test/testvalueflow.cpp | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 90e045d63..bcbdbb2ed 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -1160,7 +1160,7 @@ static bool valueFlowForward(Token * const               startToken,
                 if (tok3->varId() == varid) {
                     for (std::list<ValueFlow::Value>::const_iterator it = values.begin(); it != values.end(); ++it)
                         setTokenValue(tok3, *it);
-                } else if (Token::Match(tok3, "%oror%|&&|?")) {
+                } else if (Token::Match(tok3, "%oror%|&&|?|;")) {
                     break;
                 }
             }
@@ -1229,7 +1229,7 @@ static bool valueFlowForward(Token * const               startToken,
                             for (it = values.begin(); it != values.end(); ++it)
                                 setTokenValue(condtok, *it);
                         }
-                        if (Token::Match(condtok, "%oror%|&&"))
+                        if (Token::Match(condtok, "%oror%|&&|?|;"))
                             break;
                     }
                     if (settings->debugwarnings)
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index b73e0fa8a..4a613afb1 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -1176,6 +1176,14 @@ private:
                "  a = x;\n" // <- x can be 0
                "}\n";
         ASSERT_EQUALS(true, testValueOfX(code, 9U, 0)); // x can be 0 at line 9
+
+        code = "void f(const int a[]) {\n" // #6616
+               "  const int *x = 0;\n"
+               "  for (int i = 0; i < 10; i = *x) {\n" // <- x is not 0
+               "    x = a[i];\n"
+               "  }\n"
+               "}\n";
+        ASSERT_EQUALS(false, testValueOfX(code, 3U, 0));
     }
 
     void valueFlowAfterCondition() {