C++: Fix missing flow by adding a case for flow from 'InstructionNode' to 'SSaPhiNode'.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/Ssa.qll

@@ -348,6 +348,12 @@ private module Cached {
       nodeTo.(SsaPhiNode).hasInputAtRankInBlock(block, rnk)
     )
     or
+    exists(Def def, IRBlock block, int rnk |
+      def.getInstruction() = nodeFrom.asInstruction() and
+      def.hasRankInBlock(block, rnk) and
+      nodeTo.(SsaPhiNode).hasInputAtRankInBlock(block, rnk)
+    )
+    or
     // Def-use flow from a `StoreNode` to an `OperandNode`.
     exists(
       StoreNode store, IRBlock bb1, int i1, IRBlock bb2, int i2, Def def, Use use, Definition ssaDef

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp

@@ -263,7 +263,7 @@ int test_readv_and_writev(iovec* iovs) {
 void test4(char* buffer) {
   while (buffer != 0) {
     buffer = buffer - 1;
-    sink(buffer); // $ ast MISSING: ir
+    sink(buffer); // $ ast,ir
   }
 }