[aschackmull]

Unified added ad-hoc support for post-updates in SSA DataFlowIntegration to occur later in the CFG than the corresponding reads.
This PR refactors this support to make it a more principled inclusion in the various parts of SSA.
Along the way I uncovered a bug: when a read coincides with a write in the CFG then we mistakenly used to add outgoing use-use steps from the read. Fixing this uncovered another bug in C/C++, which had accidentally relied on the faulty use-use steps to get the desired flow steps. With the help of copilot and @MathiasVP, I also added a commit to fix this.

[Copilot]

🟡 Changes recommended

Unresolved post-update SSA defects lose mutation flow and can introduce cross-variable flow, while a missing counter expectation will fail the Rust diagnostic test.

3 open issues

• Restore explicit post-update mutation flow · New
• Filter post-update mappings by source variable · New
• Update expected output for new consistency counter · New

What changed in this PR

Refactors post-update handling in shared SSA, moving logic out of Unified’s data-flow integration and replacing synthetic reads with explicit read-to-update associations.

Changes:

• Adds mappings between variable reads and their post-update control-flow positions.
• Centralizes post-update traversal in shared SSA and adds a consistency check.
• Simplifies Unified’s SSA node mapping and local-flow integration.

File	Description
unified/​ql/​lib/​codeql/​unified/​internal/​dataflow/​LocalSsa.qll	Supplies explicit post-update mappings and removes Unified-specific traversal workarounds.
shared/​ssa/​codeql/​ssa/​Ssa.qll	Implements shared post-update handling across reference traversal, data-flow nodes, and diagnostics.

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

Critical SSA defects can skip write definitions and conflate post-update nodes, producing incorrect same-variable links and pre-update read mappings.

2 open issues

• Exclude all writes from pure post-update classification · New
• Preserve originating reads in post-update node identities · New

3 resolved since last review

• Filter post-update mappings by source variable
• Restore explicit post-update mutation flow
• Update expected output for new consistency counter

_{Review effort: Max}

[aschackmull]

Irrelevant. We should get rid of getPreUpdateNode in the SSA output, since from the SSA point of view we actually want to conflate those two post-updates.

[asgerf]

Unified and SSA changes LGTM