Bug path

‘test_3’: events 1-8

103	int ptr = (int )malloc (sizeof (int));
	^~~~~~~~~~~~~~~~~~~~~
	\|
	(1) allocated here
104	ptr = 42; / { dg-warning "dereference of possibly-NULL 'ptr'" } */
	~~~~~~~~~
	\|
	(2) assuming ‘ptr’ is non-NULL
105	if (x)
	~
	\|
	(3) following ‘false’ branch (when ‘x == 0’)...
[...]
108	ptr = 19; / { dg-warning "use after 'free' of 'ptr'" } */
	~~~~~~~~~
	\|
	(4) ...to here
[...]
111	if (y)
	~
	\|
	(5) following ‘true’ branch (when ‘y != 0’)...
112	free (ptr); /* No double-'free' warning: we've already attempted
	~~~~~~~~~~
	\|
	(6) ...to here
	(7) freed here
113	to dereference it above. */
114	return ptr; / { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */
	~~~~
	\|
	(8) use after ‘free’ of ‘ptr’; freed at (7)