Fix builtin function return hidden flag inconsistency

Function returns for built-in functions now correctly match their
function call hidden flag. This is done by symex storing the combined
hidden flag in call frame.

Co-authored-by: Kiro autonomous agent

Fixes: #5207

Author: tautschnig

regression/cbmc/builtin-function-hidden-flag/test.c

@@ -0,0 +1,8 @@
+#include <assert.h>
+#include <stdlib.h>
+
+int main()
+{
+  char *x = malloc(1);
+  assert(0);
+}

regression/cbmc/builtin-function-hidden-flag/test.desc

@@ -0,0 +1,10 @@
+CORE
+test.c
+--json-ui
+activate-multi-line-match
+^EXIT=10$
+^SIGNAL=0$
+"function":[^}]*"displayName": "malloc",[^}]*hidden": false[^}]*"stepType": "function-call"
+"function":[^}]*"displayName": "malloc",[^}]*"hidden": false[^}]*"stepType": "function-return"
+--
+^warning: ignoring

regression/cbmc/builtin-function-hidden-flag/test_xml.desc

@@ -0,0 +1,10 @@
+CORE
+test.c
+--xml-ui
+activate-multi-line-match
+^EXIT=10$
+^SIGNAL=0$
+<function_call hidden="false" step_nr="\d+" thread="0">\n\s*<function display_name="malloc" identifier="malloc"
+<function_return hidden="false" step_nr="\d+" thread="0">\n\s*<function display_name="malloc" identifier="malloc"
+--
+^warning: ignoring

src/goto-symex/symex_function_call.cpp

@@ -344,7 +344,7 @@ void goto_symext::symex_function_call_post_clean(
   frame.call_lhs = cleaned_lhs;
   frame.end_of_function = --goto_function.body.instructions.end();
   frame.function_identifier=identifier;
-  frame.hidden_function = goto_function.is_hidden();
+  frame.hidden_function = hidden;
 
   // set up the 'return value symbol' when needed
   if(frame.call_lhs.is_not_nil())