Bug path

‘test’: events 1-5

10	void p = malloc (1024); / { dg-message "allocated here" } */
	^~~~~~~~~~~~~
	\|
	(1) allocated here
[...]
17	if (c) /* { dg-message "following 'true' branch" } */
	~
	\|
	(2) following ‘true’ branch (when ‘c != 0’)...
18	free (p); /* { dg-message "first 'free' here" } */
	~~~~~~~~
	\|
	(3) ...to here
	(4) first ‘free’ here
19	free (p); /* { dg-warning "double-'free' of 'p'" } */
	~~~~~~~~
	\|
	(5) second ‘free’ here; first ‘free’ was at (4)