Wrong code at -O1 on x86

Reproducer: https://godbolt.org/z/vYM3b4GrE
Reduced case:
```c
#include
#include
typedef uint16_t v2u16;
v2u16 g10;
_Bool g26;
uint8_t g3, g25, g16, g14, g13, g9;
_Bool g8, g29, launch_c15, launch_repair16;
void *g12, *g28;
uint16_t g17;
uint64_t g22, a;
__attribute__((__vector_size__(2 * sizeof(int)))) int launch_bc11;
void f5()
{
uint16_t ov10;
g13 = g9;
g16 = g26;
g8 = 0;
g8 = __builtin_add_overflow(g17, 4, &ov10);
g29 = 0;
}
int main()
{
void *init2 = &g26;
uint8_t v6 = 3;
_Bool c9;
uint32_t v10 = 0;
uint8_t v13;
g28 = aligned_alloc(1, 1);
lbl_b20:
launch_repair16 = v6 != 116;
if (launch_repair16) goto lbl_cont21;
if (v13) return 0;
goto lbl_b34;
lbl_cont21:
g14 = 116;
g22 = 6244999583442115601;
*(_Bool *)init2 = v10;
free(g28);
lbl_b34:
v6 = g14 % 212;
launch_c15 = g12;
c9 = g3;
g14 = g14 / 3;
g29 = 0;
g8 = g22;
g29 = init2 = &v13;
launch_bc11 = launch_bc11 >= 0;
g14 = a;
f5();
v10 = g25;
g29 = c9;
g10 = (v2u16){};
launch_c15 = g29 | g8;
g29 = launch_c15 & c9;
launch_c15 = 0;
v13 = g22;
launch_c15 = c9 | launch_c15;
g29 = 0;
goto lbl_b20;
}
```

This case triggers double-free at -O1, and terminates normally at -O0.

Start with the Godbolt reproducer and reduced C case in the issue, comparing behavior at -O0 and -O1 on x86. Reproduce the double-free at -O1, then investigate the LLVM optimization path that changes the program's behavior; no source file or test is identified in the issue. Done means identifying and fixing the cause, with a regression test showing the case no longer double-frees.

Written by the indexing model from the issue text.