cex: fix miscellaneous leaks

* src/counterexample.c (unifying_counterexample): Always free
stage3result when it exists.
* src/conflicts.c (report_state_counterexamples): free leaked bitset.
* src/state-item.c (prune_disabled_paths): free leaked queue.

3 files changed, 5 insertions, 4 deletions

diff --git a/src/conflicts.c b/src/conflicts.c
index b6cccd76..f007e204 100644
--- a/src/conflicts.c
+++ b/src/conflicts.c
@@ -677,6 +677,7 @@ report_state_counterexamples (const state *s)
                     }
                 }
             }
+          bitset_free (conf);
         }
     }
 }
diff --git a/src/counterexample.c b/src/counterexample.c
index 0909652c..e87d5d2b 100644
--- a/src/counterexample.c
+++ b/src/counterexample.c
@@ -1110,10 +1110,7 @@ cex_search_end:;
       // If a search state from Stage 3 is available, use it
       // to construct a more compact nonunifying counterexample.
       if (stage3result)
-        {
-          cex = complete_diverging_examples (stage3result, next_sym);
-          search_state_free (stage3result);
-        }
+        cex = complete_diverging_examples (stage3result, next_sym);
       // Otherwise, construct a nonunifying counterexample that
       // begins from the start state using the shortest
       // lookahead-sensitive path to the reduce item.
@@ -1122,6 +1119,8 @@ cex_search_end:;
     }
   gl_list_free (ssb_queue);
   hash_free (visited);
+  if (stage3result)
+    search_state_free (stage3result);
   return cex;
 }
 
diff --git a/src/state-item.c b/src/state-item.c
index 13362ec0..62d2d210 100644
--- a/src/state-item.c
+++ b/src/state-item.c
@@ -449,6 +449,7 @@ prune_disabled_paths (void)
                   }
               }
             }
+          gl_list_free (queue);
         }
     }
 }