diff --git a/gcc/analyzer/varargs.cc b/gcc/analyzer/varargs.cc
index c45585ce4576237207c15685419f46e548bd34c8..9400086b10e9c07bbde36c3fa720c26d4f82891a 100644
--- a/gcc/analyzer/varargs.cc
+++ b/gcc/analyzer/varargs.cc
@@ -667,11 +667,27 @@ region_model::impl_call_va_start (const call_details &cd)
const svalue *ptr_to_impl_reg = m_mgr->get_ptr_svalue (NULL_TREE, impl_reg);
set_value (out_reg, ptr_to_impl_reg, cd.get_ctxt ());
- /* "*(&IMPL_REGION) = VA_LIST_VAL (0);". */
- const region *init_var_arg_reg
- = m_mgr->get_var_arg_region (get_current_frame (), 0);
- const svalue *ap_sval = m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
- set_value (impl_reg, ap_sval, cd.get_ctxt ());
+ if (get_stack_depth () > 1)
+ {
+ /* The interprocedural case: the frame containing the va_start call
+ will have been populated with any variadic aruguments.
+ Initialize IMPL_REGION with a ptr to var_arg_region 0. */
+ const region *init_var_arg_reg
+ = m_mgr->get_var_arg_region (get_current_frame (), 0);
+ const svalue *ap_sval
+ = m_mgr->get_ptr_svalue (NULL_TREE, init_var_arg_reg);
+ set_value (impl_reg, ap_sval, cd.get_ctxt ());
+ }
+ else
+ {
+ /* The frame containing va_start is an entry-point to the analysis,
+ so there won't be any specific var_arg_regions populated within it.
+ Initialize IMPL_REGION as the UNKNOWN_SVALUE to avoid state
+ explosions on repeated calls to va_arg. */
+ const svalue *unknown_sval
+ = m_mgr->get_or_create_unknown_svalue (NULL_TREE);
+ set_value (impl_reg, unknown_sval, cd.get_ctxt ());
+ }
}
/* Handle the on_call_pre part of "__builtin_va_copy". */
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c b/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
new file mode 100644
index 0000000000000000000000000000000000000000..8275b0fa9baa797251df815bf9e16a963c34f95a
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/stdarg-4.c
@@ -0,0 +1,329 @@
+/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
+
+#include "../analyzer-decls.h"
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+int test_1a (const char *fmt, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+ char ch;
+
+ __builtin_va_start(args, fmt);
+
+ while (ch = *fmt++)
+ if (ch == '%')
+ sum += __builtin_va_arg(args, int);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+static int test_1b_callee (const char *fmt, __builtin_va_list args)
+{
+ int sum = 0;
+ char ch;
+
+ while (ch = *fmt++)
+ if (ch == '%')
+ sum += __builtin_va_arg(args, int);
+
+ return sum;
+}
+
+int test_1b_caller (const char *fmt, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, fmt);
+
+ sum = test_1b_callee (fmt, args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+ with specific args. */
+
+static int
+test_1c_inner (const char *fmt, __builtin_va_list args)
+{
+ int sum = 0;
+ char ch;
+
+ while (ch = *fmt++)
+ if (ch == '%')
+ sum += __builtin_va_arg(args, int);
+
+ return sum;
+}
+
+static int
+test_1c_middle (const char *fmt, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, fmt);
+
+ sum = test_1c_inner (fmt, args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+void test_1c_outer (void)
+{
+ int sum = test_1c_middle ("%%", 42, 17);
+
+ __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)59'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+int test_2a (int count, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+ char ch;
+
+ __builtin_va_start(args, count);
+
+ while (count-- > 0)
+ sum += __builtin_va_arg(args, int);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+static int test_2b_callee (int count, __builtin_va_list args)
+{
+ int sum = 0;
+
+ while (count-- > 0)
+ sum += __builtin_va_arg(args, int);
+
+ return sum;
+}
+
+int test_2b_caller (int count, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, count);
+
+ sum = test_2b_callee (count, args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+ with specific args. */
+
+static int test_2c_inner (int count, __builtin_va_list args)
+{
+ int sum = 0;
+
+ while (count-- > 0)
+ sum += __builtin_va_arg(args, int);
+
+ return sum;
+}
+
+int test_2c_middle (int count, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, count);
+
+ sum = test_2c_inner (count, args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+void test_2c_outer (void)
+{
+ int sum = test_2c_middle (2, 50, 42);
+
+ __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)92'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+int test_3a (int placeholder, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+ int val;
+
+ __builtin_va_start(args, placeholder);
+
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with no caller to function containing va_start. */
+
+static int test_3b_callee (__builtin_va_list args)
+{
+ int sum = 0;
+ int val;
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+ return sum;
+}
+
+int test_3b_caller (int placeholder, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, placeholder);
+
+ sum = test_3b_callee (args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+ with specific args. */
+
+static int test_3c_inner (__builtin_va_list args)
+{
+ int sum = 0;
+ int val;
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+ return sum;
+}
+
+int test_3c_middle (int placeholder, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+
+ __builtin_va_start(args, placeholder);
+
+ sum = test_3c_inner (args);
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+void test_3c_outer (void)
+{
+ int sum = test_3c_middle (0, 5, 12, 0);
+ __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)17'" } */
+}
+
+/* va_arg in loop, with no caller to function containing va_start,
+ with a va_copy. */
+
+static int test_3d_callee (__builtin_va_list args)
+{
+ int sum = 0;
+ int val;
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+ return sum;
+}
+
+int test_3d_caller (int placeholder, ...)
+{
+ __builtin_va_list args1, args2;
+ int sum = 0;
+
+ __builtin_va_start(args1, placeholder);
+ __builtin_va_copy (args2, args1);
+
+ sum = test_3d_callee (args1);
+ __builtin_va_end(args1);
+
+ sum += test_3d_callee (args2);
+ __builtin_va_end(args2);
+
+ return sum;
+}
+
+/* va_arg in loop, with a caller to the function containing va_start,
+ with specific args, with a va_copy. */
+
+static int test_3e_inner (__builtin_va_list args)
+{
+ int sum = 0;
+ int val;
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+ return sum;
+}
+
+int test_3e_middle (int placeholder, ...)
+{
+ __builtin_va_list args1, args2;
+ int sum = 0;
+
+ __builtin_va_start(args1, placeholder);
+ __builtin_va_copy (args2, args1);
+
+ sum = test_3e_inner (args1);
+ __builtin_va_end(args1);
+
+ sum += test_3e_inner (args2);
+ __builtin_va_end(args2);
+
+ return sum;
+}
+
+void test_3e_outer (void)
+{
+ int sum = test_3e_middle (0, 5, 6, 0);
+ __analyzer_describe (0, sum); /* { dg-message "'\\(int\\)22'" } */
+}
+
+/* va_arg in loop, with specific symbolic args. */
+
+static int test_3f_callee (int placeholder, ...)
+{
+ __builtin_va_list args;
+ int sum = 0;
+ int val;
+
+ __builtin_va_start(args, placeholder);
+
+ while (val = __builtin_va_arg(args, int))
+ sum += val;
+
+ __builtin_va_end(args);
+
+ return sum;
+}
+
+void test_3f_caller (int x, int y, int z)
+{
+ int sum = test_3f_callee (0, x, y, z, 0);
+ __analyzer_describe (0, sum); /* { dg-message "'UNKNOWN\\(int\\)'" } */
+}