Bug path

test_3
‘test_3’: events 1-7
103 int *ptr = (int *)malloc (sizeof (int));
^~~~~~~~~~~~~~~~~~~~~
|
(1) allocated here
104 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
~~~~~~~~~
|
(2) assuming ‘ptr’ is non-NULL
105 if (x)
~
|
(3) following ‘false’ branch (when ‘x == 0’)...
[...]
108 *ptr = 19; /* { dg-warning "use after 'free' of 'ptr'" } */
~~~~~~~~~
|
(4) ...to here
[...]
111 if (y)
~
|
(5) following ‘false’ branch (when ‘y == 0’)...
[...]
114 return *ptr; /* { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */
~~~~
|
(6) ...to here
(7) ‘ptr’ leaks here; was allocated at (1)