Failed to identify call spec of `printf` for some compiler

Describe the bug wrong FuncCallSpec of printf for some file compiled with clang-10

To Reproduce Steps to reproduce the behavior:

1. compile the following file with clang-10

#include <stdio.h>
#include <stdlib.h>
void foo() {
    int ****a = malloc(10 * sizeof(int**));
    for (int i = 0; i < 10; i++) {
        a[i] = malloc(10 * sizeof(int**));
        for(int j = 0; j < 10; j++) {
            a[i][j] = malloc(sizeof(int*));
            *a[i][j] = malloc(sizeof(int));
            **a[i][j] = i;
            printf("%d", **a[i][j]);
        }
    }
}

int main() {
    foo();
    return 0;
}

1. decompile it with ghidra

Expected behavior function printf should be called correctly in function foo.

Screenshots

Attachments 0x13_ptr4.zip

Environment (please complete the following information):

• OS: Arch Linux
• Java Version: java-18-openjdk
• Ghidra Version: 10.1.2-1
• Ghidra Origin: archlinux community/ghidra 10.1.2-1

Additional context Executable compiled with clang-13 can be decompiled properly.

The assembly of that bb for clang-10 version:

The assembly of that bb for clang-13 version:

and the decompilation result

Why is the result different for those almost identical codes?

[astrelsky]

https://user-images.githubusercontent.com/46897303/163356907-fa7ebce1-dec2-4bf9-afcb-3c2dc47ab0a5.mp4

Has the function signature for printf been properly set? You can also run the variadic function signature analyzer (I forget its name) which should automatically apply overrides to functions like printf to specify the parameter types in the call deduced from the format string.

[Katharsas]

@ghidracadabra I managed to fix it in my case by running the Variadic Function Signature analyzer ONLY on the function containing the calls (via Select -> Function, Analysis -> One Shot -> …). Before i always recomputed analysis for the whole executable. I now get basically the same result as with the other exe. Not entirely sure why this worked (i had both the Lookup and Printf functions commited even before that), but it works now, so thanks a lot!

And manual override would have worked, but it would have been a massive pain without scripting because i have these situations with lookup+printf a lot.