Sema: fix crash when ref coercion dest is var args

When analyzing the `validate_ref_ty` ZIR instruction, an assertion would
trip if the result type was a var args function argument. The fix is the
same as e6b73be870 - inline the logic of
`resolveType` and handle the case of var args.

Closes #17494

src/Sema.zig

@@ -4371,13 +4371,19 @@ fn zirValidateRefTy(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileErr
     const mod = sema.mod;
     const un_tok = sema.code.instructions.items(.data)[inst].un_tok;
     const src = un_tok.src();
-    const ty_operand = sema.resolveType(block, src, un_tok.operand) catch |err| switch (err) {
+    // In case of GenericPoison, we don't actually have a type, so this will be
-        error.GenericPoison => {
+    // treated as an untyped address-of operator.
-            // We don't actually have a type, so this will be treated as an untyped address-of operator.
+    if (un_tok.operand == .var_args_param_type) return;
-            return;
+    const operand_air_inst = sema.resolveInst(un_tok.operand) catch |err| switch (err) {
-        },
+        error.GenericPoison => return,
         else => |e| return e,
     };
+    if (operand_air_inst == .var_args_param_type) return;
+    const ty_operand = sema.analyzeAsType(block, src, operand_air_inst) catch |err| switch (err) {
+        error.GenericPoison => return,
+        else => |e| return e,
+    };
+    if (ty_operand.isGenericPoison()) return;
     if (ty_operand.optEuBaseType(mod).zigTypeTag(mod) != .Pointer) {
         return sema.failWithOwnedErrorMsg(block, msg: {
             const msg = try sema.errMsg(block, src, "expected type '{}', found pointer", .{ty_operand.fmt(mod)});

test/behavior/var_args.zig

@@ -161,6 +161,37 @@ test "simple variadic function" {
     }
 }
 
+test "coerce reference to var arg" {
+    if (builtin.zig_backend == .stage2_aarch64) return error.SkipZigTest; // TODO
+    if (builtin.zig_backend == .stage2_sparc64) return error.SkipZigTest; // TODO
+    if (builtin.zig_backend == .stage2_arm) return error.SkipZigTest; // TODO
+    if (builtin.zig_backend == .stage2_wasm) return error.SkipZigTest; // TODO
+    if (builtin.zig_backend == .stage2_spirv64) return error.SkipZigTest;
+    if (builtin.os.tag != .macos and comptime builtin.cpu.arch.isAARCH64()) {
+        // https://github.com/ziglang/zig/issues/14096
+        return error.SkipZigTest;
+    }
+    if (builtin.cpu.arch == .x86_64 and builtin.os.tag == .windows) return error.SkipZigTest; // TODO
+
+    const S = struct {
+        fn addPtr(count: c_int, ...) callconv(.C) c_int {
+            var ap = @cVaStart();
+            defer @cVaEnd(&ap);
+            var i: usize = 0;
+            var sum: c_int = 0;
+            while (i < count) : (i += 1) {
+                sum += @cVaArg(&ap, *c_int).*;
+            }
+            return sum;
+        }
+    };
+
+    // Originally reported at https://github.com/ziglang/zig/issues/17494
+    var a: i32 = 12;
+    var b: i32 = 34;
+    try expect(46 == S.addPtr(2, &a, &b));
+}
+
 test "variadic functions" {
     if (builtin.zig_backend == .stage2_aarch64) return error.SkipZigTest; // TODO
     if (builtin.zig_backend == .stage2_sparc64) return error.SkipZigTest; // TODO