flow: object inside arrays

I believe the following code is not producing the expected result or diagnostics.

```c
#pragma safety enable

void free(void* _Owner _Opt p);
struct X
{
    int size;
    int * _Owner *_Owner data;
};

void f(struct X* _Owner p)
{
    for (int i = 0; i < p->size; i++)
    {
        free(p->data[i]);
    }
    free(p->data);
    free(p);
}
```
