Bug path

test_1
‘test_1’: events 1-5
8int test_1 (int i, int flag)
^~~~~~
|
(1) entry to ‘test_1’
[...]
12 if (flag)
~
|
(2) following ‘true’ branch (when ‘flag != 0’)...
13 ptr = (int *)malloc (sizeof (int));
~~~~~~~~~~~~~~~~~~~~~
|
(3) ...to here
(4) this call could return NULL
14 callee_1 (ptr);
~~~~~~~~~~~~~~
|
(5) calling ‘callee_1’ from ‘test_1’
callee_1
‘callee_1’: events 6-7
3void __attribute__((noinline)) callee_1 (int *ptr)
^~~~~~~~
|
(6) entry to ‘callee_1’
4{
5 *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
~~~~~~~~~
|
(7) ‘ptr’ could be NULL: unchecked value from (4)