Partial fix for 9049: False negative: uninitialized variable with nested ifs (#8680)

This fixes the case for this:

```cpp
unsigned int g();
void f(bool a) {
    unsigned int dimensions = 0;
    bool mightBeLarger;
    if (a) {
        dimensions = g();
        if (dimensions >= 1)
            mightBeLarger = false;
    } else {
        mightBeLarger = false;
    }
    if (dimensions == 1)
        return;
    if (!mightBeLarger) {}
}
```

Which doesnt use a compund condition `dimensions >= 1 && b)` and it also
requires complete variables and functions. The compund condition could
be handled in the future by forking within the condition, so `if(a && b)
{ ... }` can be treated as `if(a) { if(b) { ... }}`.

Here is a summary of the changes:

1. Fork-based condition handling — lib/forwardanalyzer.cpp (the largest
change)
- When a condition can't be resolved, the traversal now forks: the
then-branch is walked by a separate ForwardTraversal, in analyze-only
mode when the value can't actually flow into it (opaque/correlated
conditions like if (f(x))), so the branch's effect is tracked but
nothing is reported there.
- Branch breaks are deferred: if the else kills the value on the main
path, the then-fork can still carry it forward.
- Escapes the traversal didn't flag (e.g. unknown noreturn calls) are
detected via isEscapeScope, and exit/abort are now recognized as escape
functions (lib/astutils.cpp).

2. Program-state anchoring at block boundaries — lib/vf_analyzers.cpp +
lib/analyzer.h
- assume() now anchors the assumed state at the block's end (not the
condition) when control is leaving an already-traversed branch. This
keeps an assumption on a variable modified inside the block (e.g. a
nested if narrowing a value computed there) from being discarded as
"modified" once control leaves the block.
- New Assume::Pending flag marks the pre-traversal assume (branch walked
separately) so it doesn't record premature boundary state.
- ProgramMemoryState::assume gained an optional origin parameter so the
anchor point can be overridden.

3. vars-aware execute — lib/programmemory.cpp / .h
- execute/conditionIsTrue/conditionIsFalse now take the tracked values
(vars). A tracked value is the authoritative current value of its
expression (returned and written back into the program memory), and any
cached compound that depends on a tracked value is re-evaluated instead
of served stale (getTrackedValue / dependsOnTrackedValue).
- The per-assignment substitution was removed from
fillProgramMemoryFromAssignments and now lives entirely in execute so it
can be used for all executions.

---------

Co-authored-by: Your Name <you@example.com>

Author: pfultz2

lib/analyzer.h

@@ -153,9 +153,13 @@ struct Analyzer {
     struct Assume {
         enum Flags : std::uint8_t {
             None = 0,
-            Quiet = (1 << 0),
-            Absolute = (1 << 1),
-            ContainerEmpty = (1 << 2),
+            Quiet = (1u << 0),
+            Absolute = (1u << 1),
+            ContainerEmpty = (1u << 2),
+            // The branch this condition guards is not traversed yet (a separate path walks it), so
+            // the assume must not record the program state at the branch boundaries - they would be
+            // premature. When unset, the branch has been traversed and control is leaving it.
+            Pending = (1u << 3),
         };
     };
 

lib/astutils.cpp

@@ -2230,6 +2230,8 @@ bool isEscapeFunction(const Token* ftok, const Library& library)
 {
     if (!Token::Match(ftok, "%name% ("))
         return false;
+    if (Token::Match(ftok, "exit|abort"))
+        return true;
     const Function* function = ftok->function();
     if (function) {
         if (function->isEscapeFunction())

lib/forwardanalyzer.cpp

@@ -28,6 +28,7 @@
 #include <map>
 #include <memory>
 #include <string>
+#include <tuple>
 #include <unordered_map>
 #include <utility>
 #include <vector>
@@ -161,20 +162,40 @@ struct CPPCHECKLIB ProgramMemory {
 };
 
 struct ProgramMemoryState {
+    struct ChangedKeyHash {
+        std::size_t operator()(const std::tuple<const Token*, const Token*, const Token*>& t) const
+        {
+            const std::hash<const Token*> h;
+            std::size_t seed = h(std::get<0>(t));
+            seed ^= h(std::get<1>(t)) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+            seed ^= h(std::get<2>(t)) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+            return seed;
+        }
+    };
+    using ChangedCache =
+        std::unordered_map<std::tuple<const Token*, const Token*, const Token*>, const Token*, ChangedKeyHash>;
+    // The token modifying expr between start and end, or nullptr.
+    using FindChangedFn = std::function<const Token*(const Token* expr, const Token* start, const Token* end)>;
+
     ProgramMemory state;
     std::map<nonneg int, const Token*> origins;
     const Settings& settings;
+    // Memoized findExpressionChanged() pre-filter; structural, so never invalidated.
+    std::shared_ptr<ChangedCache> changedCache;
 
     explicit ProgramMemoryState(const Settings& s);
 
     void replace(ProgramMemory pm, const Token* origin = nullptr);
 
     void addState(const Token* tok, const ProgramMemory::Map& vars);
 
-    void assume(const Token* tok, bool b, bool isEmpty = false);
+    void assume(const Token* tok, bool b, bool isEmpty = false, const Token* origin = nullptr);
 
     void removeModifiedVars(const Token* tok);
 
+    // A findExpressionChanged() closure memoized in changedCache
+    FindChangedFn getCachedFindExpressionChanged(bool skipDeadCode) const;
+
     ProgramMemory get(const Token* tok, const Token* ctx, const ProgramMemory::Map& vars) const;
 };
 
@@ -184,21 +205,30 @@ void execute(const Token* expr,
              ProgramMemory& programMemory,
              MathLib::bigint* result,
              bool* error,
-             const Settings& settings);
+             const Settings& settings,
+             const ProgramMemory::Map& vars = {});
 
 /**
  * Is condition always false when variable has given value?
  * \param condition   top ast token in condition
  * \param pm   program memory
+ * \param vars  optional tracked values that take precedence over the program memory
  */
-bool conditionIsFalse(const Token* condition, ProgramMemory pm, const Settings& settings);
+bool conditionIsFalse(const Token* condition,
+                      ProgramMemory pm,
+                      const Settings& settings,
+                      const ProgramMemory::Map& vars = {});
 
 /**
  * Is condition always true when variable has given value?
  * \param condition   top ast token in condition
  * \param pm   program memory
+ * \param vars  optional tracked values that take precedence over the program memory
  */
-bool conditionIsTrue(const Token* condition, ProgramMemory pm, const Settings& settings);
+bool conditionIsTrue(const Token* condition,
+                     ProgramMemory pm,
+                     const Settings& settings,
+                     const ProgramMemory::Map& vars = {});
 
 /**
  * Get program memory by looking backwards from given token.

lib/programmemory.cpp

@@ -335,6 +335,7 @@ void Settings::setCheckLevel(CheckLevel level)
         vfOptions.maxIfCount = 100;
         vfOptions.doConditionExpressionAnalysis = false;
         vfOptions.maxForwardBranches = 4;
+        vfOptions.maxForwardConditionForkDepth = 0;
         vfOptions.maxIterations = 1;
     }
     else if (level == CheckLevel::normal) {
@@ -344,6 +345,7 @@ void Settings::setCheckLevel(CheckLevel level)
         vfOptions.maxIfCount = 100;
         vfOptions.doConditionExpressionAnalysis = false;
         vfOptions.maxForwardBranches = 4;
+        vfOptions.maxForwardConditionForkDepth = 1;
     }
     else if (level == CheckLevel::exhaustive) {
         // Checking can take a little while. ~ 10 times slower than normal analysis is OK.
@@ -352,6 +354,8 @@ void Settings::setCheckLevel(CheckLevel level)
         vfOptions.maxSubFunctionArgs = 256;
         vfOptions.doConditionExpressionAnalysis = true;
         vfOptions.maxForwardBranches = -1;
+        vfOptions.maxForwardConditionForkDepth = 4;
+        vfOptions.maxForwardConditionForks = 256;
     }
 }
 

lib/programmemory.h

@@ -512,6 +512,15 @@ class CPPCHECKLIB WARN_UNUSED Settings {
         /** @brief Maximum performed forward branches */
         int maxForwardBranches = -1;
 
+        /** @brief Maximum depth of nested condition-fork continuations in the forward analyzer.
+            Bounds the exponential fan-out of carrying condition state forward at exhaustive level (where
+            maxForwardBranches is unlimited); past it the forward analysis continues on a single linear path
+            without skipping any branch. 0 disables forking (linear); a negative value means unlimited. */
+        int maxForwardConditionForkDepth = 4;
+
+        /** @brief Maximum total condition-fork continuations in one forward traversal. */
+        int maxForwardConditionForks = 256;
+
         /** @brief Maximum performed alignof recursion */
         int maxAlignOfRecursion = 100;
 

lib/settings.cpp

@@ -678,16 +678,20 @@ struct ValueFlowAnalyzer : Analyzer {
         if (const ValueFlow::Value* v = tok->getKnownValue(ValueFlow::Value::ValueType::INT))
             return {v->intvalue};
         std::vector<MathLib::bigint> result;
-        ProgramMemory pm = getProgramMemoryFunc();
+        // Pass the tracked values so a cached program-memory value that depends on one (e.g. 'h(p)'
+        // after 'p' was reassigned) is re-evaluated rather than served stale. The memory is built
+        // from the same state, so compute it once and hand it to the builder.
+        const ProgramState vars = getProgramState();
+        ProgramMemory pm = getProgramMemoryFunc(vars);
         if (Token::Match(tok, "&&|%oror%")) {
-            if (conditionIsTrue(tok, pm, getSettings()))
+            if (conditionIsTrue(tok, pm, getSettings(), vars))
                 result.push_back(1);
-            if (conditionIsFalse(tok, std::move(pm), getSettings()))
+            if (conditionIsFalse(tok, std::move(pm), getSettings(), vars))
                 result.push_back(0);
         } else {
             MathLib::bigint out = 0;
             bool error = false;
-            execute(tok, pm, &out, &error, getSettings());
+            execute(tok, pm, &out, &error, getSettings(), vars);
             if (!error)
                 result.push_back(out);
         }
@@ -696,16 +700,16 @@ struct ValueFlowAnalyzer : Analyzer {
 
     std::vector<MathLib::bigint> evaluateInt(const Token* tok) const
     {
-        return evaluateInt(tok, [&] {
-            return ProgramMemory{getProgramState()};
+        return evaluateInt(tok, [](const ProgramState& vars) {
+            return ProgramMemory{vars};
         });
     }
 
     std::vector<MathLib::bigint> evaluate(Evaluate e, const Token* tok, const Token* ctx = nullptr) const override
     {
         if (e == Evaluate::Integral) {
-            return evaluateInt(tok, [&] {
-                return pms.get(tok, ctx, getProgramState());
+            return evaluateInt(tok, [&](const ProgramState& vars) {
+                return pms.get(tok, ctx, vars);
             });
         }
         if (e == Evaluate::ContainerEmpty) {
@@ -723,30 +727,43 @@ struct ValueFlowAnalyzer : Analyzer {
         return {};
     }
 
-    void assume(const Token* tok, bool state, unsigned int flags) override {
-        // Update program state
-        pms.removeModifiedVars(tok);
-        pms.addState(tok, getProgramState());
-        pms.assume(tok, state, flags & Assume::ContainerEmpty);
-
+    void assume(const Token* tok, bool state, unsigned int flags) override
+    {
         bool isCondBlock = false;
         const Token* parent = tok->astParent();
         if (parent) {
             isCondBlock = Token::Match(parent->previous(), "if|while (");
         }
 
+        const Token* endBlock = nullptr;
         if (isCondBlock) {
             const Token* startBlock = parent->link()->next();
             if (Token::simpleMatch(startBlock, ";") && Token::simpleMatch(parent->tokAt(-2), "} while ("))
                 startBlock = parent->linkAt(-2);
-            const Token* endBlock = startBlock->link();
-            if (state) {
-                pms.removeModifiedVars(endBlock);
-                pms.addState(endBlock->previous(), getProgramState());
-            } else {
-                if (Token::simpleMatch(endBlock, "} else {"))
-                    pms.addState(endBlock->linkAt(2)->previous(), getProgramState());
-            }
+            endBlock = startBlock->link();
+        }
+
+        // Without Pending the 'then' block has been traversed and control is leaving it, so anchor
+        // the assumed state at the block end instead of the condition. That keeps assumptions on
+        // variables modified inside the block (e.g. an 'if' narrowing a value computed there) from
+        // being discarded as "modified" once control leaves the block.
+        const bool scopeEnd = !(flags & Assume::Pending) && state && endBlock;
+        const Token* anchor = scopeEnd ? endBlock : tok;
+        const Token* origin = scopeEnd ? endBlock : nullptr;
+
+        // Update program state
+        pms.removeModifiedVars(anchor);
+        pms.addState(anchor, getProgramState());
+        pms.assume(tok, state, flags & Assume::ContainerEmpty, origin);
+
+        // The false path (the true path uses scopeEnd above): record the assumed state where control
+        // continues - the end of the else block, or the closing brace when there is no else - so it
+        // reaches the enclosing scope.
+        if (isCondBlock && !(flags & Assume::Pending) && !state) {
+            if (Token::simpleMatch(endBlock, "} else {"))
+                pms.addState(endBlock->linkAt(2)->previous(), getProgramState());
+            else
+                pms.addState(endBlock, getProgramState());
         }
 
         if (!(flags & Assume::Quiet)) {

lib/settings.h

@@ -4941,7 +4941,9 @@ class TestAutoVariables : public TestFixture {
               "        return *iPtr;\n"
               "    return 0;\n"
               "}");
-        ASSERT_EQUALS("[test.cpp:5:16] -> [test.cpp:4:13] -> [test.cpp:8:17]: (error) Using pointer to local variable 'x' that is out of scope. [invalidLifetime]\n", errout_str());
+        ASSERT_EQUALS(
+            "[test.cpp:5:16] -> [test.cpp:7:10] -> [test.cpp:4:13] -> [test.cpp:8:17]: (error) Using pointer to local variable 'x' that is out of scope. [invalidLifetime]\n",
+            errout_str());
 
         // #11753
         check("int main(int argc, const char *argv[]) {\n"

lib/vf_analyzers.cpp

@@ -4911,6 +4911,30 @@ class TestCondition : public TestFixture {
         ASSERT_EQUALS("[test.cpp:3:10]: (style) Condition 'b()' is always false [knownConditionTrueFalse]\n"
                       "[test.cpp:4:9]: (style) Condition '!b()' is always true [knownConditionTrueFalse]\n",
                       errout_str());
+
+        check("int g();\n" // a value modified inside a nested branch must be lowered to possible
+              "void f(int outer, int inner) {\n"
+              "    int bits = 0;\n"
+              "    if (outer) {\n"
+              "        if (inner == 1)\n"
+              "            bits = g();\n"
+              "    }\n"
+              "    if (bits > 0) {}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
+
+        check("int g();\n" // the modifying branch has an escaping sibling - still must be lowered
+              "void f(int t, int u) {\n"
+              "    int v = 0;\n"
+              "    if (t) {\n"
+              "        if (u == 2)\n"
+              "            v = g();\n"
+              "        else\n"
+              "            return;\n"
+              "    }\n"
+              "    if (v > 0) {}\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void alwaysTrueSymbolic()