[gcc r13-1786] analyzer: fix -Wanalyzer-va-list-exhausted false +ve on va_arg in subroutine [PR106383]

[David Malcolm <dmalcolm@gcc.gnu.org>]

https://gcc.gnu.org/g:b852aa7f265424c8e2036899da5d8306ff06a16c

commit r13-1786-gb852aa7f265424c8e2036899da5d8306ff06a16c
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Jul 21 17:29:26 2022 -0400

    analyzer: fix -Wanalyzer-va-list-exhausted false +ve on va_arg in subroutine [PR106383]
    
    gcc/analyzer/ChangeLog:
            PR analyzer/106383
            * varargs.cc (region_model::impl_call_va_arg): When determining if
            we're doing interprocedural analysis, use the stack depth of the
            frame in which va_start was called, rather than the current stack
            depth.
    
    gcc/testsuite/ChangeLog:
            PR analyzer/106383
            * gcc.dg/analyzer/stdarg-3.c: New test.
    
    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Diff:
---
 gcc/analyzer/varargs.cc                  |  4 +--
 gcc/testsuite/gcc.dg/analyzer/stdarg-3.c | 57 ++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/gcc/analyzer/varargs.cc b/gcc/analyzer/varargs.cc
index c92a56dd2f9..c45585ce457 100644
--- a/gcc/analyzer/varargs.cc
+++ b/gcc/analyzer/varargs.cc
@@ -971,7 +971,7 @@ region_model::impl_call_va_arg (const call_details &cd)
 	  const frame_region *frame_reg = arg_reg->get_frame_region ();
 	  unsigned next_arg_idx = arg_reg->get_index ();
 
-	  if (get_stack_depth () > 1)
+	  if (frame_reg->get_stack_depth () > 1)
 	    {
 	      /* The interprocedural case: the called frame will have been
 		 populated with any variadic aruguments.
@@ -1009,7 +1009,7 @@ region_model::impl_call_va_arg (const call_details &cd)
 		 any specific var_arg_regions populated within it.
 		 We already have a conjured_svalue for the result, so leave
 		 it untouched.  */
-	      gcc_assert (get_stack_depth () == 1);
+	      gcc_assert (frame_reg->get_stack_depth () == 1);
 	    }
 
 	  if (saw_problem)
diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c b/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c
new file mode 100644
index 00000000000..68146147adb
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c
@@ -0,0 +1,57 @@
+typedef __builtin_va_list va_list;
+
+struct printf_spec {
+  unsigned int type;
+};
+
+int
+format_decode(const char *fmt, struct printf_spec *spec);
+
+static int vbin_printf(const char *fmt, va_list args) {
+  struct printf_spec spec;
+  int width = 0;
+
+  while (*fmt) {
+    int read = format_decode(fmt, &spec);
+
+    fmt += read;
+
+    switch (spec.type) {
+    case 0:
+      break;
+    case 1:
+      width = __builtin_va_arg(args, int); /* { dg-bogus "-Wanalyzer-va-list-exhausted" } */
+      break;
+    }
+  }
+
+  return width;
+}
+
+int bprintf(const char *fmt, ...) {
+  va_list args;
+  int ret;
+
+  __builtin_va_start(args, fmt);
+  ret = vbin_printf(fmt, args);
+  __builtin_va_end(args);
+
+  return ret;
+}
+
+static int called_by_test_2 (va_list args)
+{
+  return __builtin_va_arg(args, int); /* { dg-bogus "-Wanalyzer-va-list-exhausted" } */
+}
+
+int test_2 (const char *fmt, ...)
+{
+  va_list args;
+  int ret;
+
+  __builtin_va_start (args, fmt);
+  ret = called_by_test_2 (args);
+  __builtin_va_end (args);
+
+  return ret;
+}