diff --git a/lib/programmemory.cpp b/lib/programmemory.cpp
index 37141a8e1..766141cfc 100644
--- a/lib/programmemory.cpp
+++ b/lib/programmemory.cpp
@@ -361,7 +361,6 @@ void ProgramMemoryState::replace(const ProgramMemory &pm, const Token* origin)
 void ProgramMemoryState::addState(const Token* tok, const ProgramMemory::Map& vars)
 {
     ProgramMemory pm = state;
-    fillProgramMemoryFromConditions(pm, tok, settings);
     for (const auto& p:vars) {
         nonneg int exprid = p.first;
         const ValueFlow::Value &value = p.second;
@@ -369,6 +368,7 @@ void ProgramMemoryState::addState(const Token* tok, const ProgramMemory::Map& va
         if (value.varId)
             pm.setIntValue(value.varId, value.varvalue);
     }
+    fillProgramMemoryFromConditions(pm, tok, settings);
     ProgramMemory local = pm;
     fillProgramMemoryFromAssignments(pm, tok, local, vars);
     replace(pm, tok);
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 1d2f65711..ba467faa4 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -119,6 +119,7 @@ private:
         TEST_CASE(nullpointer77);
         TEST_CASE(nullpointer78); // #7802
         TEST_CASE(nullpointer79); // #10400
+        TEST_CASE(nullpointer80); // #10410
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -2441,6 +2442,20 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void nullpointer80() // #10410
+    {
+        check("int f(int* a, int* b) {\n"
+              "    if( a || b ) {\n"
+              "        int n = a ? *a : *b;\n"
+              "        if( b )\n"
+              "            n++;\n"
+              "        return n;\n"
+              "    }\n"
+              "    return 0;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"