Bug path

test_22
‘test_22’: events 1-5
250 void *ptr = malloc (1024);
^~~~~~~~~~~~~
|
(1) allocated here
[...]
253 for (i = 5; i < 10; i++)
~~~~~~
|
(2) following ‘true’ branch (when ‘i <= 9’)...
254 foo ();
~~~~~~
|
(3) ...to here
255
256 free (ptr);
~~~~~~~~~~
|
(4) first ‘free’ here
257 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(5) second ‘free’ here; first ‘free’ was at (4)