JS: Support return value of x++

javascript/ql/src/semmle/javascript/RangeAnalysis.qll

@@ -163,6 +163,12 @@ module RangeAnalysis {
         else
           bias = -1)
       or
+      exists (UpdateExpr update | r.asExpr() = update | // Return value of x++ is just x (coerced to an int)
+        root = update.getOperand().flow() and
+        not update.isPrefix() and
+        sign = 1 and
+        bias = 0)
+      or
       exists (CompoundAssignExpr assign | r = compoundAssignResult(assign) |
         root = assign.getLhs().flow() and
         sign = 1 and

javascript/ql/test/library-tests/RangeAnalysis/plus.js

@@ -26,3 +26,8 @@ function g(x) {
   if (z < x + 5) {} // NOT OK - always true
   if (z > x + 5) {} // NOT OK - always false 
 }
+
+function h(x) {
+  let y = x++;
+  if (x > y) {} // NOT OK - always true
+}