C++: More TPs from cpp/using-expired-stack-address

[MathiasVP]

This PR changes cpp/using-expired-stack-address so that the must-flow in the query follows flow into predicates. This should allow us to catch more true positive results (in particular, it fixes a missing result in our tests). I suggest reviewing the PR on a commit-by-commit basis.

• 9df923a fixes the missing must-flow
• bf10456 adds a path explanation to the query. This was a huge help when debugging the query results on LGTM, and I expect users will have the same opinion.

I've marked this as a draft while I run DCA. DCA looks good.

[geoffw0]

Happy with the new results. Its definitely nice to have paths from this query as well (e.g. https://lgtm.com/query/4938718690567093881/). 👍

The QL is difficult to review though - feels like in an ideal world most of it would be in a separate library with a clear spec and tests - but I suppose there's only one place we'd be using it at present.

[MathiasVP]

The QL is difficult to review though - feels like in an ideal world most of it would be in a separate library with a clear spec and tests - but I suppose there's only one place we'd be using it at present.

Indeed. There is some similarity between this new query, the cpp/return-stack-allocated-memory query, and the unsafe-use-of-this (i.e., they all use their own version of a must-flow relation). I'll create an issue that describes this in more detail. Hopefully, we can merge some if this code.