| 
  
 test_1 
  | 
     ‘test_1’: events 1-5 
|     8 | int test_1 (int i, int flag) |  
 |     ^~~~~~ |  
 |     | |  
 |     (1) entry to ‘test_1’ |  
| [...] |  |  
|    12 |   if (flag) |  
 |      ~ |  
 |      | |  
 |      (2) following ‘true’ branch (when ‘flag != 0’)... |  
|    13 |     ptr = (int *)malloc (sizeof (int)); |  
 |                  ~~~~~~~~~~~~~~~~~~~~~ |  
 |                  | |  
 |                  (3) ...to here |  
 |                  (4) this call could return NULL |  
|    14 |   callee_1 (ptr); |  
 |   ~~~~~~~~~~~~~~ |  
 |   | |  
 |   (5) calling ‘callee_1’ from ‘test_1’ |  
 
 |   
   | 
  
 callee_1 
  | 
     ‘callee_1’: events 6-7 
|     3 | void __attribute__((noinline)) callee_1 (int *ptr) |  
 |                                ^~~~~~~~ |  
 |                                | |  
 |                                (6) entry to ‘callee_1’ |  
|     4 | { |  
|     5 |   *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */ |  
 |   ~~~~~~~~~                      |  
 |        | |  
 |        (7) ‘ptr’ could be NULL: unchecked value from (4) |  
 
 |   
 |   
 |