[analyzer] Fix ValistChecker false-positive involving symbolic pointers

[steakhal]

Summary

In the following example:

int va_list_get_int(va_list *va) {
  return va_arg(*va, int); // FP
}

The *va expression will be something like Element{SymRegion{va}, 0, va_list}.
We use ElementRegions for representing the result of the dereference.
In this case, the IsSymbolic was set to false in the
getVAListAsRegion().

Hence, before checking if the memregion is a SymRegion, we should take
the base of that region.

Analogously to the previous example, one can craft other cases:

struct MyVaList {
  va_list l;
};
int va_list_get_int(struct MyVaList va) {
  return va_arg(va.l, int); // FP
}

But it would also work if the va_list would be in the base or derived
part of a class. ObjCIvarRegions are likely also susceptible.
I'm not explicitly demonstrating these cases.

PS: Check the MemRegion::getBaseRegion() definition.

Fixes #55009

[steakhal]

fix test

clang/lib/StaticAnalyzer/Checkers/ValistChecker.cpp

if (const auto *Cast = dyn_cast<CastExpr>(E)) {
     QualType Ty = Cast->getType();
     VaListModelledAsArray =
         Ty->isPointerType() && Ty->getPointeeType()->isRecordType();
   }
   if (const auto *DeclReg = Reg->getAs<DeclRegion>()) {
     if (isa<ParmVarDecl>(DeclReg->getDecl()))
       Reg = C.getState()->getSVal(SV.castAs<Loc>()).getAsRegion();
   }
-  IsSymbolic = Reg && Reg->getAs<SymbolicRegion>();
+  IsSymbolic = Reg && Reg->getBaseRegion()->getAs<SymbolicRegion>();
   // Some VarRegion based VA lists reach here as ElementRegions.
   const auto *EReg = dyn_cast_or_null<ElementRegion>(Reg);
   return (EReg && VaListModelledAsArray) ? EReg->getSuperRegion() : Reg;
 }
 
 void ValistChecker::checkPreStmt(const VAArgExpr *VAA,
                                  CheckerContext &C) const {
   ProgramStateRef State = C.getState();

clang/test/Analysis/valist-uninitialized-no-undef.c

 
 void call_inlined_uses_arg(int fst, ...) {
   va_list va;
   inlined_uses_arg(va); // expected-note{{Calling 'inlined_uses_arg'}}
 }
 
 void f6(va_list *fst, ...) {
   va_start(*fst, fst);
-  // FIXME: There should be no warning for this.
-  (void)va_arg(*fst, int); // expected-warning{{va_arg() is called on an uninitialized va_list}}
-  // expected-note@-1{{va_arg() is called on an uninitialized va_list}}
+  (void)va_arg(*fst, int);
   va_end(*fst);
-} 
+}
 
+int va_list_get_int(va_list *va) {
+  return va_arg(*va, int); // no-warning
+}
+
+struct MyVaList {
+  va_list l;
+};
+int va_list_get_int2(struct MyVaList *va) {
+  return va_arg(va->l, int); // no-warning
+}
+
 void call_vprintf_bad(int isstring, ...) {
   va_list va;
   vprintf(isstring ? "%s" : "%d", va); // expected-warning{{Function 'vprintf' is called with an uninitialized va_list argument}}
   // expected-note@-1{{Function 'vprintf' is called with an uninitialized va_list argument}}
   // expected-note@-2{{Assuming 'isstring' is 0}}
   // expected-note@-3{{'?' condition is false}}
 }
 
 void call_vsprintf_bad(char *buffer, ...) {
   va_list va;
   va_start(va, buffer); // expected-note{{Initialized va_list}}
   va_end(va); // expected-note{{Ended va_list}}
   vsprintf(buffer, "%s %d %d %lf %03d", va); // expected-warning{{Function 'vsprintf' is called with an uninitialized va_list argument}}
   // expected-note@-1{{Function 'vsprintf' is called with an uninitialized va_list argument}}
 }