From 83a816b1096d4833aa3838d9c3a613f27fc61f2f Mon Sep 17 00:00:00 2001
From: PKEuS <philipp.kloke@web.de>
Date: Wed, 4 Nov 2015 10:26:55 +0100
Subject: [PATCH] Fixed crash on garbage code (#7085)

---
 lib/tokenize.cpp     | 2 ++
 test/testgarbage.cpp | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 09a126b25..d4bc45a45 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -4304,6 +4304,8 @@ void Tokenizer::removeRedundantFor()
             const Token *vartok2 = tok->linkAt(2)->previous();
             if (vartok2->str() == "++")
                 vartok2 = vartok2->previous();
+            else if (vartok2->strAt(-1) != "++")
+                continue;
             if (varname != vartok2->str())
                 continue;
 
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index d9fbf57f7..2279b065a 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -197,6 +197,7 @@ private:
         TEST_CASE(garbageCode146); // #7081
         TEST_CASE(garbageCode147); // #7082
         TEST_CASE(garbageCode148); // #7090
+        TEST_CASE(garbageCode149); // #7085
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -1177,6 +1178,13 @@ private:
                                "b[0][0]"), InternalError);
     }
 
+    void garbageCode149() { // #7085
+        checkCode("int main() {\n"
+                  "    for (j = 0; j < 1; j)\n"
+                  "        j6;\n"
+                  "}");
+    }
+
     void garbageValueFlow() {
         // #6089
         const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"