Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r13-1786-gb852aa7f265424.

gcc/analyzer/ChangeLog:
        PR analyzer/106383
        * varargs.cc (region_model::impl_call_va_arg): When determining if
        we're doing interprocedural analysis, use the stack depth of the
        frame in which va_start was called, rather than the current stack
        depth.

gcc/testsuite/ChangeLog:
        PR analyzer/106383
        * gcc.dg/analyzer/stdarg-3.c: New test.

Signed-off-by: David Malcolm <dmalc...@redhat.com>
---
 gcc/analyzer/varargs.cc                  |  4 +-
 gcc/testsuite/gcc.dg/analyzer/stdarg-3.c | 57 ++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-3.c

diff --git a/gcc/analyzer/varargs.cc b/gcc/analyzer/varargs.cc
index c92a56dd2f9..c45585ce457 100644
--- a/gcc/analyzer/varargs.cc
+++ b/gcc/analyzer/varargs.cc
@@ -971,7 +971,7 @@ region_model::impl_call_va_arg (const call_details &cd)
          const frame_region *frame_reg = arg_reg->get_frame_region ();
          unsigned next_arg_idx = arg_reg->get_index ();
 
-         if (get_stack_depth () > 1)
+         if (frame_reg->get_stack_depth () > 1)
            {
              /* The interprocedural case: the called frame will have been
                 populated with any variadic aruguments.
@@ -1009,7 +1009,7 @@ region_model::impl_call_va_arg (const call_details &cd)
                 any specific var_arg_regions populated within it.
                 We already have a conjured_svalue for the result, so leave
                 it untouched.  */
-             gcc_assert (get_stack_depth () == 1);
+             gcc_assert (frame_reg->get_stack_depth () == 1);
            }
 
          if (saw_problem)
diff --git a/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c 
b/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c
new file mode 100644
index 00000000000..68146147adb
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/stdarg-3.c
@@ -0,0 +1,57 @@
+typedef __builtin_va_list va_list;
+
+struct printf_spec {
+  unsigned int type;
+};
+
+int
+format_decode(const char *fmt, struct printf_spec *spec);
+
+static int vbin_printf(const char *fmt, va_list args) {
+  struct printf_spec spec;
+  int width = 0;
+
+  while (*fmt) {
+    int read = format_decode(fmt, &spec);
+
+    fmt += read;
+
+    switch (spec.type) {
+    case 0:
+      break;
+    case 1:
+      width = __builtin_va_arg(args, int); /* { dg-bogus 
"-Wanalyzer-va-list-exhausted" } */
+      break;
+    }
+  }
+
+  return width;
+}
+
+int bprintf(const char *fmt, ...) {
+  va_list args;
+  int ret;
+
+  __builtin_va_start(args, fmt);
+  ret = vbin_printf(fmt, args);
+  __builtin_va_end(args);
+
+  return ret;
+}
+
+static int called_by_test_2 (va_list args)
+{
+  return __builtin_va_arg(args, int); /* { dg-bogus 
"-Wanalyzer-va-list-exhausted" } */
+}
+
+int test_2 (const char *fmt, ...)
+{
+  va_list args;
+  int ret;
+
+  __builtin_va_start (args, fmt);
+  ret = called_by_test_2 (args);
+  __builtin_va_end (args);
+
+  return ret;
+}
-- 
2.26.3

Reply via email to