Fix a false-positive in the register validity tracking logic by moving the
temporary register release call before the jump that uses that temporary
register.

FossilOrigin-Name: 9da48a5ca66dc67c8f7fb2d2471dac7ea696e35ecba5ddf65747d08d452436c1
diff --git a/src/expr.c b/src/expr.c
index 0c4a611..a89730f 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -3209,6 +3209,7 @@
       if( regCkNull && sqlite3ExprCanBeNull(pList->a[ii].pExpr) ){
         sqlite3VdbeAddOp3(v, OP_BitAnd, regCkNull, r2, regCkNull);
       }
+      sqlite3ReleaseTempReg(pParse, regToFree);
       if( ii<pList->nExpr-1 || destIfNull!=destIfFalse ){
         int op = rLhs!=r2 ? OP_Eq : OP_NotNull;
         sqlite3VdbeAddOp4(v, op, rLhs, labelOk, r2,
@@ -3227,7 +3228,6 @@
         VdbeCoverageIf(v, op==OP_IsNull);
         sqlite3VdbeChangeP5(v, zAff[0] | SQLITE_JUMPIFNULL);
       }
-      sqlite3ReleaseTempReg(pParse, regToFree);
     }
     if( regCkNull ){
       sqlite3VdbeAddOp2(v, OP_IsNull, regCkNull, destIfNull); VdbeCoverage(v);