Fixed crash in CheckVaarg::va_start_argument (#6032)