Bug path

‘test_1’: events 1-5

8	int test_1 (int i, int flag)
	^~~~~~
	\|
	(1) entry to ‘test_1’
[...]
12	if (flag)
	~
	\|
	(2) following ‘true’ branch (when ‘flag != 0’)...
13	ptr = (int *)malloc (sizeof (int));
	~~~~~~~~~~~~~~~~~~~~~
	\|
	(3) ...to here
	(4) this call could return NULL
14	callee_1 (ptr);
	~~~~~~~~~~~~~~
	\|
	(5) calling ‘callee_1’ from ‘test_1’

‘callee_1’: events 6-7

3	void __attribute__((noinline)) callee_1 (int *ptr)
	^~~~~~~~
	\|
	(6) entry to ‘callee_1’
4	{
5	ptr = 42; / { dg-warning "dereference of possibly-NULL 'ptr'" } */
	~~~~~~~~~
	\|
	(7) ‘ptr’ could be NULL: unchecked value from (4)