void testBranchReachability(int arg) {
  if (arg > 10 && arg < 20) {
    switch (arg) {
    case 0x80000000 ... 4:
      clang_analyzer_warnIfReached();
      break;
    case 5 ... 9:
      clang_analyzer_warnIfReached();
      break;
    case 10 ... 15:
      clang_analyzer_warnIfReached();
      clang_analyzer_eval(arg > 10 && arg <= 15);
      break;
    default:
      clang_analyzer_warnIfReached();
      break;
    case 17 ... 25:
      clang_analyzer_warnIfReached();
      clang_analyzer_eval(arg >= 17 && arg < 20);
      break;
    case 26 ... 0x7fffffff:
      clang_analyzer_warnIfReached();
      break;
    case 16:
      clang_analyzer_warnIfReached();
      clang_analyzer_eval(arg == 16);
      break;
    }
  }
}


x86 assembly (clang, -O0):
<testBranchReachability>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x4(%rbp)
cmpl   $0xa,-0x4(%rbp)
jle    1250 <testBranchReachability+0x130>
cmpl   $0x14,-0x4(%rbp)
jge    1250 <testBranchReachability+0x130>
mov    -0x4(%rbp),%eax
mov    %eax,-0x14(%rbp)
add    $0xfffffffb,%eax
mov    %eax,%ecx
mov    %rcx,-0x10(%rbp)
sub    $0x14,%eax
ja     121b <testBranchReachability+0xfb>
mov    -0x10(%rbp),%rax
lea    0xe9e(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
jmp    124b <testBranchReachability+0x12b>
mov    -0x14(%rbp),%eax
sub    $0x80000000,%eax
cmp    $0x80000004,%eax
jbe    116b <testBranchReachability+0x4b>
jmp    11cf <testBranchReachability+0xaf>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
jmp    124b <testBranchReachability+0x12b>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
xor    %eax,%eax
cmpl   $0xa,-0x4(%rbp)
mov    %al,-0x15(%rbp)
jle    11bb <testBranchReachability+0x9b>
cmpl   $0xf,-0x4(%rbp)
setle  %al
mov    %al,-0x15(%rbp)
mov    -0x15(%rbp),%al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
jmp    124b <testBranchReachability+0x12b>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
jmp    124b <testBranchReachability+0x12b>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
xor    %eax,%eax
cmpl   $0x11,-0x4(%rbp)
mov    %al,-0x16(%rbp)
jl     11fb <testBranchReachability+0xdb>
cmpl   $0x14,-0x4(%rbp)
setl   %al
mov    %al,-0x16(%rbp)
mov    -0x16(%rbp),%al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
jmp    124b <testBranchReachability+0x12b>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
jmp    124b <testBranchReachability+0x12b>
mov    -0x14(%rbp),%eax
sub    $0x1a,%eax
cmp    $0x7fffffe5,%eax
jbe    120f <testBranchReachability+0xef>
jmp    1177 <testBranchReachability+0x57>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
cmpl   $0x10,-0x4(%rbp)
sete   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
jmp    1250 <testBranchReachability+0x130>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<testBranchReachability>:
push   %rax
lea    -0xb(%rdi),%eax
cmp    $0x8,%eax
ja     114f <testBranchReachability+0x2f>
cmp    $0x5,%eax
jb     113b <testBranchReachability+0x1b>
lea    -0x11(%rdi),%eax
cmp    $0x3,%eax
jb     113b <testBranchReachability+0x1b>
cmp    $0x10,%edi
jne    1151 <testBranchReachability+0x31>
xor    %eax,%eax
call   1040 <clang_analyzer_warnIfReached@plt>
mov    $0x1,%edi
xor    %eax,%eax
pop    %rcx
jmp    1030 <clang_analyzer_eval@plt>
pop    %rax
ret
xor    %eax,%eax
pop    %rcx
jmp    1040 <clang_analyzer_warnIfReached@plt>

LLVM IR (-O0):
define void @testBranchReachability(i32 %0) {
%2 = alloca i32
store i32 %0, i32* %2
%3 = load i32, i32* %2
%4 = icmp sgt i32 %3, 10
br i1 %4, label %5, label %53
5: ; preds = %1
%6 = load i32, i32* %2
%7 = icmp slt i32 %6, 20
br i1 %7, label %8, label %53
8: ; preds = %5
%9 = load i32, i32* %2
switch i32 %9, label %43 [
i32 5, label %15
i32 6, label %15
i32 7, label %15
i32 8, label %15
i32 9, label %15
i32 10, label %17
i32 11, label %17
i32 12, label %17
i32 13, label %17
i32 14, label %17
i32 15, label %17
i32 17, label %30
i32 18, label %30
i32 19, label %30
i32 20, label %30
i32 21, label %30
i32 22, label %30
i32 23, label %30
i32 24, label %30
i32 25, label %30
i32 16, label %46
]
10: ; preds = %12
%11 = call i32 (...) @clang_analyzer_warnIfReached()
br label %52
12: ; preds = %43
%13 = sub i32 %9, -2147483648
%14 = icmp ule i32 %13, -2147483644
br i1 %14, label %10, label %28
15: ; preds = %8, %8, %8, %8, %8
%16 = call i32 (...) @clang_analyzer_warnIfReached()
br label %52
17: ; preds = %8, %8, %8, %8, %8, %8
%18 = call i32 (...) @clang_analyzer_warnIfReached()
%19 = load i32, i32* %2
%20 = icmp sgt i32 %19, 10
br i1 %20, label %21, label %24
21: ; preds = %17
%22 = load i32, i32* %2
%23 = icmp sle i32 %22, 15
br label %24
24: ; preds = %21, %17
%25 = phi i1 [ false, %17 ], [ %23, %21 ]
%26 = zext i1 %25 to i32
%27 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %26)
br label %52
28: ; preds = %12
%29 = call i32 (...) @clang_analyzer_warnIfReached()
br label %52
30: ; preds = %8, %8, %8, %8, %8, %8, %8, %8, %8
%31 = call i32 (...) @clang_analyzer_warnIfReached()
%32 = load i32, i32* %2
%33 = icmp sge i32 %32, 17
br i1 %33, label %34, label %37
34: ; preds = %30
%35 = load i32, i32* %2
%36 = icmp slt i32 %35, 20
br label %37
37: ; preds = %34, %30
%38 = phi i1 [ false, %30 ], [ %36, %34 ]
%39 = zext i1 %38 to i32
%40 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %39)
br label %52
41: ; preds = %43
%42 = call i32 (...) @clang_analyzer_warnIfReached()
br label %52
43: ; preds = %8
%44 = sub i32 %9, 26
%45 = icmp ule i32 %44, 2147483621
br i1 %45, label %41, label %12
46: ; preds = %8
%47 = call i32 (...) @clang_analyzer_warnIfReached()
%48 = load i32, i32* %2
%49 = icmp eq i32 %48, 16
%50 = zext i1 %49 to i32
%51 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %50)
br label %52
52: ; preds = %46, %41, %37, %28, %24, %15, %10
br label %53
53: ; preds = %52, %5, %1
ret void
}

LLVM IR (-O2):
define void @testBranchReachability(i32 %0) {
%2 = add i32 %0, -11
%3 = icmp ult i32 %2, 9
br i1 %3, label %4, label %16
4: ; preds = %1
switch i32 %0, label %11 [
i32 16, label %13
i32 19, label %8
i32 18, label %8
i32 17, label %8
i32 15, label %5
i32 14, label %5
i32 11, label %5
i32 12, label %5
i32 13, label %5
]
5: ; preds = %4, %4, %4, %4, %4
%6 = tail call i32 (...) @clang_analyzer_warnIfReached()
%7 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
br label %16
8: ; preds = %4, %4, %4
%9 = tail call i32 (...) @clang_analyzer_warnIfReached()
%10 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
br label %16
11: ; preds = %4
%12 = tail call i32 (...) @clang_analyzer_warnIfReached()
br label %16
13: ; preds = %4
%14 = tail call i32 (...) @clang_analyzer_warnIfReached()
%15 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
br label %16
16: ; preds = %5, %11, %8, %13, %1
ret void
}