C++: SSA and range analysis for reference parameters

[jbj]

This PR changes the AST-based SSA and RangeSSA libraries to make the same assumption about reference-typed parameters that the IR does: that they don't alias any value that'll be mutated from within the function body.

A further commit, authored by @lcartey, adds support for reference-typed parameters in SimpleRangeAnalysis.

[jbj]

Started https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1373/. I expect to see a lot of differences on real-world code.

[MathiasVP]

I think this LGTM, but I'll wait with the formal approval until we've validated the CPP-difference.

[jbj]

The CPP-Differences LGTM. The only changes are three new results from cpp/comparison-with-wider-type similar to this one. The index variable on the LHS is of type PropertyIndex&, which is a typedef for unsigned short &.

I had expected to see changes in all the queries that use SSA, and I can't really explain why the impact is so small.

[jbj]

I'd be tempted to say that the use of a reference-parameter SsaDefinition is actually the ReferenceDereferenceExpr conversion. With this PR, the SsaDefinition.getAUse predicate still has a VariableAccess result since I think it would be too disruptive to relax that to Expr. Almost all our queries and libraries assume that variable uses are of type VariableAccess. Unfortunately, getType() on these variable accesses gives T& instead of T, and I don't know if all queries deal with that properly. The cpp/comparison-with-wider-type query already had support for reference types.

On balance, I think this change is the least disruptive thing we can do that fixes the range analysis. Queries that want more information about indirections will have to use IR.

[MathiasVP]

LGTM!