diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 5fe9f9b81b7..0c22c668d3a 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -3200,7 +3200,7 @@ static void valueFlowForward(Token* startToken,
                              const Settings* settings)
 {
     const Token* expr = solveExprValues(exprTok, values);
-    if (Token::Match(expr, "%var%")) {
+    if (Token::Match(expr, "%var%") && expr->variable()) {
         valueFlowForwardVariable(startToken,
                                  endToken,
                                  expr->variable(),
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index 0ef8c8be0f6..07d1988b22b 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -128,6 +128,8 @@ class TestValueFlow : public TestFixture {
         TEST_CASE(valueFlowUnknownFunctionReturn);
 
         TEST_CASE(valueFlowPointerAliasDeref);
+
+        TEST_CASE(valueFlowCrashIncompleteCode);
     }
 
     static bool isNotTokValue(const ValueFlow::Value &val) {
@@ -4278,6 +4280,17 @@ class TestValueFlow : public TestFixture {
                "}\n";
         ASSERT_EQUALS(true, testValueOfX(code, 5U, 123));
     }
+
+    void valueFlowCrashIncompleteCode() {
+        const char* code;
+
+        code = "void SlopeFloor::setAttr(const Value &val) {\n"
+               "    int x = val;\n"
+               "    if (x >= -1)\n"
+               "        state = x;\n"
+               "}\n";
+        valueOfTok(code, "=");
+    }
 };
 
 REGISTER_TEST(TestValueFlow)