JavaScript: Improve type inference for captured variables.

Author: Max Schaefer

javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll

@@ -245,6 +245,8 @@ private class AnalyzedVariableCapture extends AnalyzedSsaDefinition, SsaVariable
     exists(LocalVariable v | v = getSourceVariable() |
       result = v.(AnalyzedCapturedVariable).getALocalValue()
       or
+      result = any(AnalyzedExplicitDefinition def | def.getSourceVariable() = v).getAnRhsValue()
+      or
       not guaranteedToBeInitialized(v) and result = getImplicitInitValue(v)
     )
   }

javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/client.js

@@ -5,3 +5,8 @@ const lib = require("./lib"),
 lib.f();
 /** calls:lib.f */
 f();
+
+(function() {
+  /** calls:lib.f */
+  f();
+})();