give the same rank to all expressions inside a single stmt

Author: erik-krogh

javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll

@@ -444,7 +444,7 @@ module AccessPath {
           ref = getAccessTo(root, path, _) and
           ref.getBasicBlock() = bb
         |
-          ref order by any(int i | ref.asExpr() = bb.getNode(i))
+          ref order by any(int i | ref.asExpr().getEnclosingStmt() = bb.getNode(i))
         ) and
       result = getAccessTo(root, path, type)
     }

javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected

@@ -61,6 +61,10 @@ test_getAReferenceTo
 | test.js:39:14:39:16 | foo | foo |
 | test.js:39:14:39:20 | foo.bar | foo.bar |
 | test.js:40:3:40:10 | lazyInit | foo.bar |
+| test.js:44:13:44:18 | Object | Object |
+| test.js:44:13:44:25 | Object.create | Object.create |
+| test.js:50:7:50:12 | random | random |
+| test.js:56:7:56:12 | random | random |
 test_getAnAssignmentTo
 | other_ns.js:4:9:4:16 | NS \|\| {} | NS |
 | other_ns.js:6:12:6:13 | {} | Conflict |
@@ -71,9 +75,14 @@ test_getAnAssignmentTo
 | test.js:30:1:30:28 | functio ... on() {} | globalFunction |
 | test.js:32:1:35:1 | functio ... .baz'\\n} | destruct |
 | test.js:37:1:41:1 | functio ... Init;\\n} | lazy |
+| test.js:43:1:61:1 | functio ... // no\\n} | dominatingWrite |
 test_assignedUnique
 | GlobalClass |
 | destruct |
+| dominatingWrite |
 | f |
 | globalFunction |
 | lazy |
+hasDominatingWrite
+| test.js:48:3:48:11 | obj.prop1 |
+| test.js:57:5:57:13 | obj.prop3 |

javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.ql

@@ -9,3 +9,7 @@ query string test_getAnAssignmentTo(DataFlow::Node node) {
 }
 
 query string test_assignedUnique() { AccessPath::isAssignedInUniqueFile(result) }
+
+query DataFlow::PropRead hasDominatingWrite() {
+  AccessPath::DominatingPaths::hasDominatingWrite(result)
+}

javascript/ql/test/library-tests/GlobalAccessPaths/test.js

@@ -39,3 +39,23 @@ function lazy() {
   lazyInit = foo.bar; // 'foo.bar'
   lazyInit;
 }
+
+function dominatingWrite() {
+  var obj = Object.create();
+
+  obj.prop1; // no
+  obj.prop1 = "foo";
+  obj.prop1; // yes
+
+  if (random()) {
+    obj.prop2 = "foo";
+  }
+  obj.prop2; // no
+
+  obj.prop3 = "foo";
+  if (random()) {
+    obj.prop3; // yes
+  }
+
+  obj.prop4 = obj.prop4; // no
+}