[Issue 10328] Possible multiple free() calls in rewrite_subst_compile()