JS: Summarise store steps for type tracking

Author: asgerf

javascript/ql/lib/semmle/javascript/dataflow/internal/StepSummary.qll

@@ -156,6 +156,9 @@ private module Cached {
         exists(string prop |
           param.getAPropertyRead(prop).flowsTo(fun.getAReturn()) and
           summary = LoadStep(prop)
+          or
+          fun.getAReturn().getALocalSource().getAPropertySource(prop) = param and
+          summary = StoreStep(prop)
         )
       ) and
       if param = fun.getAParameter()

javascript/ql/test/library-tests/TypeTracking/TypeTracking.expected

@@ -1,2 +1 @@
-| summarize.js:30:14:30:26 | // track: obj | Failed to track obj here. |
 | summarize.js:33:14:33:26 | // track: obj | Failed to track obj here. |