diff --git a/Makefile b/Makefile
index 6f86e205f77..aeb3070408a 100644
--- a/Makefile
+++ b/Makefile
@@ -844,7 +844,7 @@ test/testmathlib.o: test/testmathlib.cpp lib/check.h lib/checkers.h lib/color.h
 test/testmemleak.o: test/testmemleak.cpp lib/check.h lib/checkers.h lib/checkimpl.h lib/checkmemoryleak.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/refthunk.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h test/fixture.h test/helpers.h
 	$(CXX) ${INCLUDE_FOR_TEST} ${CFLAGS_FOR_TEST} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ test/testmemleak.cpp
 
-test/testnullpointer.o: test/testnullpointer.cpp lib/check.h lib/checkers.h lib/checkimpl.h lib/checknullpointer.h lib/color.h lib/config.h lib/ctu.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/refthunk.h lib/settings.h lib/smallvector.h lib/standards.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h test/fixture.h test/helpers.h
+test/testnullpointer.o: test/testnullpointer.cpp externals/tinyxml2/tinyxml2.h lib/check.h lib/checkers.h lib/checkimpl.h lib/checknullpointer.h lib/color.h lib/config.h lib/ctu.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/refthunk.h lib/settings.h lib/smallvector.h lib/standards.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h lib/xml.h test/fixture.h test/helpers.h
 	$(CXX) ${INCLUDE_FOR_TEST} ${CFLAGS_FOR_TEST} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ test/testnullpointer.cpp
 
 test/testoptions.o: test/testoptions.cpp lib/check.h lib/checkers.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/refthunk.h lib/settings.h lib/standards.h lib/utils.h test/fixture.h test/options.h
diff --git a/lib/ctu.cpp b/lib/ctu.cpp
index feef065d3ac..3346329dc65 100644
--- a/lib/ctu.cpp
+++ b/lib/ctu.cpp
@@ -124,7 +124,7 @@ std::string CTU::FileInfo::FunctionCall::toXmlString() const
 std::string CTU::FileInfo::NestedCall::toXmlString() const
 {
     std::ostringstream out;
-    out << "<function-call"
+    out << "<nested-call"
         << toBaseXmlString()
         << " " << ATTR_MY_ID << "=\"" << myId << "\""
         << " " << ATTR_MY_ARGNR << "=\"" << myArgNr << "\""
diff --git a/test/cli/whole-program_test.py b/test/cli/whole-program_test.py
index dfb4e8112d1..aee2d2abafb 100644
--- a/test/cli/whole-program_test.py
+++ b/test/cli/whole-program_test.py
@@ -430,3 +430,51 @@ def test_nullpointer_out_of_memory(tmpdir, single_file):
     else:
         # the bug is found using ctu analysis
         assert results == ['[ctunullpointerOutOfMemory]']
+
+
+def __test_nullpointer_nested_call(tmpdir, extra_args):
+    with open(tmpdir / 'header.h', 'wt') as f:
+        f.write('void wrapper(int *p);\n')
+    with open(tmpdir / 'test1.c', 'wt') as f:
+        f.write('#include "header.h"\n'
+                'int g;\n'
+                'void deref(int *p) { g = *p; }\n'
+                'void wrapper(int *p) { deref(p); }\n')
+    with open(tmpdir / 'test2.c', 'wt') as f:
+        f.write('#include "header.h"\n'
+                'void f(void) { wrapper(0); }\n')
+
+    args = [
+        '-q',
+        '--template=simple',
+        '--error-exitcode=1',
+        'test1.c',
+        'test2.c'
+    ]
+
+    args += extra_args
+
+    ret, stdout, stderr = cppcheck(args, cwd=tmpdir)
+    lines = stderr.splitlines()
+    assert lines == [
+        'test1.c:3:27: error: Null pointer dereference: p [ctunullpointer]'
+    ]
+    assert stdout == ''
+    assert ret == 1, stdout
+
+
+def test_nullpointer_nested_call(tmpdir):
+    __test_nullpointer_nested_call(tmpdir, ['-j1'])
+
+
+def test_nullpointer_nested_call_builddir_cached(tmpdir):
+    build_dir = os.path.join(tmpdir, 'b1')
+    os.mkdir(build_dir)
+    __test_nullpointer_nested_call(tmpdir, ['-j1', '--cppcheck-build-dir={}'.format(build_dir)])
+    __test_nullpointer_nested_call(tmpdir, ['-j1', '--cppcheck-build-dir={}'.format(build_dir)])
+
+
+def test_nullpointer_nested_call_builddir_j(tmpdir):
+    build_dir = os.path.join(tmpdir, 'b1')
+    os.mkdir(build_dir)
+    __test_nullpointer_nested_call(tmpdir, ['-j2', '--cppcheck-build-dir={}'.format(build_dir)])
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index ca5c183c911..68298cab54a 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -26,6 +26,7 @@
 #include "settings.h"
 #include "standards.h"
 #include "token.h"
+#include "xml.h"
 
 #include <cstddef>
 #include <list>
@@ -183,6 +184,7 @@ class TestNullPointer : public TestFixture {
         TEST_CASE(isPointerDeRefFunctionDecl);
 
         TEST_CASE(ctuTest);
+        TEST_CASE(ctuXml);
     }
 
     struct CheckOptions
@@ -5089,6 +5091,26 @@ class TestNullPointer : public TestFixture {
             "}\n");
         ASSERT_EQUALS("", errout_str());
     }
+
+    void ctuXml() {
+        SimpleTokenizer tokenizer(settings, *this);
+        ASSERT(tokenizer.tokenize("void use(int *p) { a = *p + 3; }\n"
+                                  "void call(int x, int *p) { x++; use(p); }\n"
+                                  "int main() {\n"
+                                  "  call(4,0);\n"
+                                  "}\n"));
+        const CTU::FileInfo *fi1 = CTU::getFileInfo(tokenizer);
+        ASSERT_EQUALS(1U, fi1->nestedCalls.size());
+
+        tinyxml2::XMLDocument doc;
+        const tinyxml2::XMLError xmlError = doc.Parse(("<FileInfo>" + fi1->toString() + "</FileInfo>").c_str());
+        ASSERT_EQUALS(tinyxml2::XML_SUCCESS, xmlError);
+        CTU::FileInfo fi2;
+        fi2.loadFromXml(doc.FirstChildElement());
+        ASSERT_EQUALS(1U, fi2.nestedCalls.size());
+        ASSERT_EQUALS(fi1->toString(), fi2.toString());
+        delete fi1;
+    }
 };
 
 REGISTER_TEST(TestNullPointer)