[cfe-dev] Confused by analysis

[Ben Laurie]

If I have a unit test like:

// RUN: clang -analyze -analyzer-constraints=range -checker-cfref -verify %s

void f2(int n) {
  char *p = 0;
  char a[10];

  if (n < 1)
    p = a;

  if (n > 0)
    *p = 'X';  // expected-warning{{Dereference of null pointer.}}

  if (n >= -3)
    *p = 'X';  // expected-warning{{Dereference of null pointer.}}
}

void f3(int n) {
  char *p = 0;
  char a[10];

  if (n < 1)
    p = a;

  if (n >= -3)
    *p = 'X';  // expected-warning{{Dereference of null pointer.}}
}

then the second expected warning is not emitted, but the third one is.
Why is this?