move hasDominatingWrite to the TypeTracking stage

Author: erik-krogh

javascript/ql/lib/semmle/javascript/GlobalAccessPaths.qll

@@ -557,7 +557,7 @@ module AccessPath {
      */
     cached
     predicate hasDominatingWrite(DataFlow::PropRead read) {
-      Stages::FlowSteps::ref() and
+      Stages::TypeTracking::ref() and
       // within the same basic block.
       exists(ReachableBasicBlock bb, Root root, string path, int ranking |
         read.asExpr() = rankedAccessPath(bb, root, path, ranking, AccessPathRead()) and

javascript/ql/lib/semmle/javascript/internal/CachedStages.qll

@@ -212,6 +212,8 @@ module Stages {
       any(DataFlow::Node node).hasUnderlyingType(_)
       or
       any(DataFlow::Node node).hasUnderlyingType(_, _)
+      or
+      AccessPath::DominatingPaths::hasDominatingWrite(_)
     }
   }
 
@@ -235,8 +237,6 @@ module Stages {
     predicate backref() {
       1 = 1
       or
-      AccessPath::DominatingPaths::hasDominatingWrite(_)
-      or
       DataFlow::SharedFlowStep::step(_, _)
     }
   }