[gcc r17-3478] analyzer: fix and clarify region model example in internals docs

https://gcc.gnu.org/g:d5c241ca7d13b92518030d4e25ceb50d58cba307

commit r17-3478-gd5c241ca7d13b92518030d4e25ceb50d58cba307
Author: Egas Ribeiro <[email protected]>
Date:   Fri Jun 19 19:05:17 2026 +0100

    analyzer: fix and clarify region model example in internals docs
    
    The Region Model example in the analyzer internals docs had a few
    inconsistencies with the dumps. Fix these, and add a note that
    heap-allocated region numbering depends on traversal order.
    
    gcc/ChangeLog:
    
            * doc/analyzer.texi (Region Model): Use malloc (n) in the
            example to match the dump; fix the frame for the result_4
            cluster; correct the heap region number; note that heap region
            numbering depends on traversal order.
    
    Signed-off-by: Egas Ribeiro <[email protected]>

Diff:
---
 gcc/doc/analyzer.texi | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/gcc/doc/analyzer.texi b/gcc/doc/analyzer.texi
index 05ae4ae39554..5d043dcdb4fc 100644
--- a/gcc/doc/analyzer.texi
+++ b/gcc/doc/analyzer.texi
@@ -322,7 +322,7 @@ Consider this example C code:
 void *
 calls_malloc (size_t n)
 @{
-  void *result = malloc (1024);
+  void *result = malloc (n);
   return result; /* HERE */
 @}
 
@@ -373,8 +373,8 @@ various local variables within frames for @code{test} and
 within @code{test} the whole cluster for @code{_1} is bound
 to a @code{binop_svalue} representing @code{n * 4}, and
 @item
-within @code{test} the whole cluster for @code{result_4} is bound to a
-@code{region_svalue} pointing at @code{HEAP_ALLOCATED_REGION(12)}.
+within @code{calls_malloc} the whole cluster for @code{result_4} is bound to a
+@code{region_svalue} pointing at @code{HEAP_ALLOCATED_REGION(27)}.
 @end itemize
 
 Additionally, this latter pointer has the @code{unchecked} state for the
@@ -384,6 +384,12 @@ Additionally, this latter pointer has the @code{unchecked} state for the
 We also see that the state has captured the size of the heap-allocated
 region (``Dynamic Extents'').
 
+@noindent
+The specific numbering of heap-allocated regions (such as the ``27'' in
+@code{HEAP_ALLOCATED_REGION(27)} above) depend on what other code has been
+explored and in what order before this point is reached, and thus should not be
+relied upon.
+
 This visualization can also be seen within the output of
 @option{-fdump-analyzer-exploded-nodes-2} and
 @option{-fdump-analyzer-exploded-nodes-3}.