[Bug analyzer/109365] Double delete yields -Wanalyzer-use-after-free instead of -Wanalyzer-double-free

[vultkayn at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109365

Benjamin Priour <vultkayn at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vultkayn at gcc dot gnu.org

--- Comment #3 from Benjamin Priour <vultkayn at gcc dot gnu.org> ---
Changing the second delete expression into a direct call to "operator delete"
results in the correct warning Wanalyzer-double-free being emitted.

This is due to delete expression first calling the destructor and performing
extra operations, whose one of them is a dereference.

"delete expression" compiled with -O0 results on my x86_64-linux-gnu
to analyzer ipa:

  if (a.0_11 != 0B)
    goto <bb 3>; [INV]
  else
    goto <bb 4>; [INV]

  <bb 3> :
  *a.0_11 ={v} {CLOBBER};
  operator delete (a.0_11, 8);

  <bb 4> :
  _14 = 0;

Entry statement of bb3 is the one actually detected as -Wanalyzer-double-free.