Add a test case demonstrating a false negative in output parameter handling

PiperOrigin-RevId: 563786945
Change-Id: Iac53d26e687cd44fc4ca4e515737a82c23cc7c64
diff --git a/nullability/test/function_calls.cc b/nullability/test/function_calls.cc
index 9935cfb..e9d9434 100644
--- a/nullability/test/function_calls.cc
+++ b/nullability/test/function_calls.cc
@@ -246,6 +246,28 @@
       *p;
     }
   )cc"));
+
+  EXPECT_TRUE(checkDiagnostics(R"cc(
+    template <typename T>
+    struct S {
+      void maybeModify(T& ref);
+    };
+    void target(S<int* _Nullable> s, int* _Nullable p) {
+      s.maybeModify(p);
+      *p;  // false negative
+    }
+  )cc"));
+
+  EXPECT_TRUE(checkDiagnostics(R"cc(
+    template <typename T>
+    struct S {
+      void maybeModify(T& ref);
+    };
+    void target(S<int* _Nonnull> s, int* _Nonnull p) {
+      s.maybeModify(p);
+      *p;
+    }
+  )cc"));
 }
 
 TEST(PointerNullabilityTest, CallExprParamAssignment) {