analyzer: fix ICE on region creation during get_referenced_base_regions [PR108003]

gcc/analyzer/ChangeLog:
	PR analyzer/108003
	* call-summary.cc
	(call_summary_replay::convert_region_from_summary_1): Convert
	heap_regs_in_use from auto_sbitmap to auto_bitmap.
	* region-model-manager.cc
	(region_model_manager::get_or_create_region_for_heap_alloc):
	Convert from sbitmap to bitmap.
	* region-model-manager.h: Likewise.
	* region-model.cc
	(region_model::get_or_create_region_for_heap_alloc): Convert from
	auto_sbitmap to auto_bitmap.
	(region_model::get_referenced_base_regions): Likewise.
	* region-model.h: Include "bitmap.h" rather than "sbitmap.h".
	(region_model::get_referenced_base_regions): Convert from
	auto_sbitmap to auto_bitmap.

gcc/testsuite/ChangeLog:
	PR analyzer/108003
	* g++.dg/analyzer/pr108003.C: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

6 files changed, 44 insertions, 7 deletions

diff --git a/gcc/analyzer/call-summary.cc b/gcc/analyzer/call-summary.cc
index 3167473..a18a1b1 100644
--- a/gcc/analyzer/call-summary.cc
+++ b/gcc/analyzer/call-summary.cc
@@ -726,7 +726,7 @@ call_summary_replay::convert_region_from_summary_1 (const region *summary_reg)
 	/* If we have a heap-allocated region in the summary, then
 	   it was allocated within the callee.
 	   Create a new heap-allocated region to summarize this.  */
-	auto_sbitmap heap_regs_in_use (mgr->get_num_regions ());
+	auto_bitmap heap_regs_in_use;
 	get_caller_model ()->get_referenced_base_regions (heap_regs_in_use);
 	return mgr->get_or_create_region_for_heap_alloc (heap_regs_in_use);
       }
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 0fb9638..dad7c41 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -1698,7 +1698,7 @@ get_region_for_unexpected_tree_code (region_model_context *ctxt,
 
 const region *
 region_model_manager::
-get_or_create_region_for_heap_alloc (const sbitmap &base_regs_in_use)
+get_or_create_region_for_heap_alloc (const bitmap &base_regs_in_use)
 {
   /* Try to reuse an existing region, if it's unreferenced in the
      client state.  */
diff --git a/gcc/analyzer/region-model-manager.h b/gcc/analyzer/region-model-manager.h
index 13fbe48..ca9a498 100644
--- a/gcc/analyzer/region-model-manager.h
+++ b/gcc/analyzer/region-model-manager.h
@@ -155,7 +155,7 @@ public:
      The number of these within the analysis can grow arbitrarily.
      They are still owned by the manager.  */
   const region *
-  get_or_create_region_for_heap_alloc (const sbitmap &base_regs_in_use);
+  get_or_create_region_for_heap_alloc (const bitmap &base_regs_in_use);
   const region *create_region_for_alloca (const frame_region *frame);
 
   void log_stats (logger *logger, bool show_objs) const;
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 18eaf22..f6cd34f 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -4904,7 +4904,7 @@ region_model::get_or_create_region_for_heap_alloc (const svalue *size_in_bytes,
   /* Determine which regions are referenced in this region_model, so that
      we can reuse an existing heap_allocated_region if it's not in use on
      this path.  */
-  auto_sbitmap base_regs_in_use (m_mgr->get_num_regions ());
+  auto_bitmap base_regs_in_use;
   get_referenced_base_regions (base_regs_in_use);
   const region *reg
     = m_mgr->get_or_create_region_for_heap_alloc (base_regs_in_use);
@@ -4917,7 +4917,7 @@ region_model::get_or_create_region_for_heap_alloc (const svalue *size_in_bytes,
    reachable in this region_model.  */
 
 void
-region_model::get_referenced_base_regions (auto_sbitmap &out_ids) const
+region_model::get_referenced_base_regions (auto_bitmap &out_ids) const
 {
   reachable_regions reachable_regs (const_cast<region_model *> (this));
   m_store.for_each_cluster (reachable_regions::init_cluster_cb,
diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
index 291bb2f..626b10d 100644
--- a/gcc/analyzer/region-model.h
+++ b/gcc/analyzer/region-model.h
@@ -26,7 +26,7 @@ along with GCC; see the file COPYING3.  If not see
       (Zhongxing Xu, Ted Kremenek, and Jian Zhang)
      http://lcs.ios.ac.cn/~xuzb/canalyze/memmodel.pdf  */
 
-#include "sbitmap.h"
+#include "bitmap.h"
 #include "selftest.h"
 #include "analyzer/svalue.h"
 #include "analyzer/region.h"
@@ -390,7 +390,7 @@ class region_model
 				       region_model_context *ctxt);
   const region *create_region_for_alloca (const svalue *size_in_bytes,
 					  region_model_context *ctxt);
-  void get_referenced_base_regions (auto_sbitmap &out_ids) const;
+  void get_referenced_base_regions (auto_bitmap &out_ids) const;
 
   tree get_representative_tree (const svalue *sval) const;
   tree get_representative_tree (const region *reg) const;
diff --git a/gcc/testsuite/g++.dg/analyzer/pr108003.C b/gcc/testsuite/g++.dg/analyzer/pr108003.C
new file mode 100644
index 0000000..c93e959
--- /dev/null
+++ b/gcc/testsuite/g++.dg/analyzer/pr108003.C
@@ -0,0 +1,37 @@
+/* Regression test for ICE.  */
+/* { dg-additional-options "-Wno-analyzer-possible-null-argument" } */
+/* { dg-additional-options "-Wno-analyzer-malloc-leak" } */
+/* { dg-additional-options "-Wno-analyzer-possible-null-dereference" } */
+
+/* { dg-additional-options "-O1 --param analyzer-max-svalue-depth=5" } */
+
+struct locale {
+  class _Impl;
+  _Impl *_M_impl;
+
+  template <typename _Facet>
+  locale (const locale &, _Facet *);
+
+  static locale
+  classic ();
+};
+
+struct locale::_Impl {
+  _Impl (_Impl, int);
+};
+
+template <typename _Facet>
+locale::locale (const locale &, _Facet *)
+{
+  new _Impl (*_M_impl, 1);
+}
+
+struct codecvt {
+  virtual void do_max_lengththrow ();
+};
+
+void
+test01 ()
+{
+  locale (locale::classic (), new codecvt);
+}