Bug path

test_2
‘test_2’: events 1-5
34 if (!flag)
^
|
(1) following ‘true’ branch (when ‘flag == 0’)...
35 {
36 void *ptr = malloc (16);
~~~~~~~~~~~
|
(2) ...to here
(3) allocated here
37 free (ptr);
~~~~~~~~~~
|
(4) first ‘free’ here
38 free (ptr); /* { dg-warning "double-'free' of 'ptr'" } */
~~~~~~~~~~
|
(5) second ‘free’ here; first ‘free’ was at (4)