Bug path

test_5

‘test_5’: events 1-2

56	free (ptr);
	^~~~~~~~~~
	\|
	(1) freed here
57	return ptr; / { dg-warning "use after 'free' of 'ptr'" } */
	~~~~
	\|
	(2) use after ‘free’ of ‘ptr’; freed at (1)