void testDefaultBranchRange(int arg) {
  switch (arg) {
  case 0x80000000 ... 9:
    clang_analyzer_warnIfReached();
    break;
  case 20 ... 0x7fffffff:
    clang_analyzer_warnIfReached();
    clang_analyzer_eval(arg >= 20);
    break;
  default:
    clang_analyzer_warnIfReached();
    clang_analyzer_eval(arg == 16);
    clang_analyzer_eval(arg > 9);
    clang_analyzer_eval(arg <= 20);
  case 16:
    clang_analyzer_warnIfReached();
  }
}


x86 assembly (clang, -O0):
<testDefaultBranchRange>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %edi,-0x4(%rbp)
mov    -0x4(%rbp),%eax
mov    %eax,-0x8(%rbp)
sub    $0x10,%eax
je     11d8 <testDefaultBranchRange+0xb8>
jmp    1182 <testDefaultBranchRange+0x62>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
jmp    11df <testDefaultBranchRange+0xbf>
mov    -0x8(%rbp),%eax
sub    $0x80000000,%eax
cmp    $0x80000009,%eax
jbe    113f <testDefaultBranchRange+0x1f>
jmp    1198 <testDefaultBranchRange+0x78>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
cmpl   $0x14,-0x4(%rbp)
setge  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
jmp    11df <testDefaultBranchRange+0xbf>
mov    -0x8(%rbp),%eax
sub    $0x14,%eax
cmp    $0x7fffffeb,%eax
jbe    1163 <testDefaultBranchRange+0x43>
jmp    114b <testDefaultBranchRange+0x2b>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
cmpl   $0x10,-0x4(%rbp)
sete   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
cmpl   $0x9,-0x4(%rbp)
setg   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
cmpl   $0x14,-0x4(%rbp)
setle  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
mov    $0x0,%al
call   1040 <clang_analyzer_warnIfReached@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<testDefaultBranchRange>:
push   %rbx
cmp    $0x10,%edi
je     116e <testDefaultBranchRange+0x4e>
mov    %edi,%ebx
xor    %eax,%eax
cmp    $0x13,%edi
jle    1141 <testDefaultBranchRange+0x21>
call   1040 <clang_analyzer_warnIfReached@plt>
mov    $0x1,%edi
xor    %eax,%eax
pop    %rbx
jmp    1030 <clang_analyzer_eval@plt>
call   1040 <clang_analyzer_warnIfReached@plt>
cmp    $0xa,%ebx
jge    114d <testDefaultBranchRange+0x2d>
pop    %rbx
ret
xor    %edi,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
pop    %rbx
jmp    1040 <clang_analyzer_warnIfReached@plt>

LLVM IR (-O0):
define void @testDefaultBranchRange(i32 %0) {
%2 = alloca i32
store i32 %0, i32* %2
%3 = load i32, i32* %2
switch i32 %3, label %15 [
i32 16, label %32
]
4: ; preds = %6
%5 = call i32 (...) @clang_analyzer_warnIfReached()
br label %34
6: ; preds = %15
%7 = sub i32 %3, -2147483648
%8 = icmp ule i32 %7, -2147483639
br i1 %8, label %4, label %18
9: ; preds = %15
%10 = call i32 (...) @clang_analyzer_warnIfReached()
%11 = load i32, i32* %2
%12 = icmp sge i32 %11, 20
%13 = zext i1 %12 to i32
%14 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %13)
br label %34
15: ; preds = %1
%16 = sub i32 %3, 20
%17 = icmp ule i32 %16, 2147483627
br i1 %17, label %9, label %6
18: ; preds = %6
%19 = call i32 (...) @clang_analyzer_warnIfReached()
%20 = load i32, i32* %2
%21 = icmp eq i32 %20, 16
%22 = zext i1 %21 to i32
%23 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %22)
%24 = load i32, i32* %2
%25 = icmp sgt i32 %24, 9
%26 = zext i1 %25 to i32
%27 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %26)
%28 = load i32, i32* %2
%29 = icmp sle i32 %28, 20
%30 = zext i1 %29 to i32
%31 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %30)
br label %32
32: ; preds = %1, %18
%33 = call i32 (...) @clang_analyzer_warnIfReached()
br label %34
34: ; preds = %32, %9, %4
ret void
}

LLVM IR (-O2):
define void @testDefaultBranchRange(i32 %0) {
%2 = icmp eq i32 %0, 16
br i1 %2, label %15, label %9
3: ; preds = %9
%4 = icmp slt i32 %0, 10
%5 = tail call i32 (...) @clang_analyzer_warnIfReached()
br i1 %4, label %17, label %11
6: ; preds = %9
%7 = tail call i32 (...) @clang_analyzer_warnIfReached()
%8 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
br label %17
9: ; preds = %1
%10 = icmp sgt i32 %0, 19
br i1 %10, label %6, label %3
11: ; preds = %3
%12 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 0)
%13 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%14 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
br label %15
15: ; preds = %1, %11
%16 = tail call i32 (...) @clang_analyzer_warnIfReached()
br label %17
17: ; preds = %3, %15, %6
ret void
}