[Bug analyzer/94355] support for C++ new expression

["redi at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94355

--- Comment #11 from Jonathan Wakely <redi at gcc dot gnu.org> ---
If we add a real bug (making a shallow copy of the object, which shares the
same heap pointer and then both destructors free the same one):

struct S {
    S() { p = new int(); }
    ~S() { delete p; }
    int* p = nullptr;
};

int main() {
    S s;
    S ss = s;
}

Then the analyzer still tells us the pointer is leaked:

dest.C: In function ‘int main()’:
dest.C:10:1: warning: leak of ‘s.S::p’ [CWE-401] [-Wanalyzer-malloc-leak]
   10 | }
      | ^
  ‘int main()’: events 1-2
    |
    |    7 | int main() {
    |      |     ^~~~
    |      |     |
    |      |     (1) entry to ‘main’
    |    8 |     S s;
    |      |       ~
    |      |       |
    |      |       (2) calling ‘S::S’ from ‘main’
    |
    +--> ‘S::S()’: events 3-5
           |
           |    2 |     S() { p = new int(); }
           |      |     ^     ~~~~~~~~~~~~~
           |      |     |       |         |
           |      |     |       |         (4) allocated here
           |      |     |       (5) assuming ‘operator new(4)’ is non-NULL
           |      |     (3) entry to ‘S::S’
           |
    <------+
    |
  ‘int main()’: events 6-7
    |
    |    8 |     S s;
    |      |       ^
    |      |       |
    |      |       (6) returning to ‘main’ from ‘S::S’
    |    9 |     S ss = s;
    |   10 | }
    |      | ~      
    |      | |
    |      | (7) ‘s.S::p’ leaks here; was allocated at (4)
    |

But strangely it also tells use there's a use-after-free, which is odd if it
thinks the pointer was nver freed:

dest.C: In destructor ‘S::~S()’:
dest.C:3:22: warning: use after ‘delete’ of ‘s.S::p’ [CWE-416]
[-Wanalyzer-use-after-free]
    3 |     ~S() { delete p; }
      |                      ^
  ‘int main()’: events 1-2
    |
    |    7 | int main() {
    |      |     ^~~~
    |      |     |
    |      |     (1) entry to ‘main’
    |    8 |     S s;
    |      |       ~
    |      |       |
    |      |       (2) calling ‘S::S’ from ‘main’
    |
    +--> ‘S::S()’: events 3-5
           |
           |    2 |     S() { p = new int(); }
           |      |     ^     ~~~~~~~~~~~~~
           |      |     |       |         |
           |      |     |       |         (4) allocated here
           |      |     |       (5) assuming ‘operator new(4)’ is non-NULL
           |      |     (3) entry to ‘S::S’
           |
    <------+
    |
  ‘int main()’: events 6-7
    |
    |    8 |     S s;
    |      |       ^
    |      |       |
    |      |       (6) returning to ‘main’ from ‘S::S’
    |    9 |     S ss = s;
    |   10 | }
    |      | ~      
    |      | |
    |      | (7) calling ‘S::~S’ from ‘main’
    |
    +--> ‘S::~S()’: events 8-11
           |
           |    3 |     ~S() { delete p; }
           |      |     ^      ~~~~~~~~
           |      |     |      |      |
           |      |     |      |      (10) ...to here
           |      |     |      |      (11) deleted here
           |      |     |      (9) following ‘true’ branch...
           |      |     (8) entry to ‘S::~S’
           |
    <------+
    |
  ‘int main()’: events 12-13
    |
    |   10 | }
    |      | ^
    |      | |
    |      | (12) returning to ‘main’ from ‘S::~S’
    |      | (13) calling ‘S::~S’ from ‘main’
    |
    +--> ‘S::~S()’: events 14-17
           |
           |    3 |     ~S() { delete p; }
           |      |     ^      ~~~~~~~~  ~
           |      |     |      |      |  |
           |      |     |      |      |  (17) use after ‘delete’ of
‘*this.S::p’; deleted at (11)
           |      |     |      |      (16) ...to here
           |      |     |      (15) following ‘true’ branch...
           |      |     (14) entry to ‘S::~S’
           |

I think it's (correctly) telling us that the destructor ss.~S() uses the value
after s.~S() already freed it. But it would be nice if it mentioned that the
second destructor is on ss, not s.

The earlier warning tells us the object: "warning: use after ‘delete’ of
‘s.S::p’" 

So it would be nice if the use-after-free was identified as being ss.S::p
(which has the same value as s.S::p).

And it's not actually a use-after-free (and certainly not at the closing brace
of the destructor where the location points to), it's a double-free.

Ideally it would have complained when we copied the pointer value in the
trivial copy constructor and didn't zero out the original. That shallow copy
was the actual bug, the double-free is a symptom of it.


dest.C: In constructor ‘S::S()’:
dest.C:2:13: warning: dereference of possibly-NULL ‘operator new(4)’ [CWE-690]
[-Wanalyzer-possible-null-dereference]
    2 |     S() { p = new int(); }
      |           ~~^~~~~~~~~~~
  ‘S::S()’: events 1-2
    |
    |    2 |     S() { p = new int(); }
    |      |           ~~~~~~~~~~~~^
    |      |             |         |
    |      |             |         (1) this call could return NULL
    |      |             (2) ‘operator new(4)’ could be NULL: unchecked value
from (1)
    |