C++: make ConstructorCall df nodes the qualifier

This makes the dataflow node for a ConstructorCall be the outnode of the
qualifier, which is the resulting constructed object. This should make
`asExpr` on a ConstructorCall do the "right thing" rather than selecting
the void-typed CallInstruction.

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -738,11 +738,19 @@ private predicate exprNodeShouldBeIndirectOperand(IndirectOperand node, Expr e,
   not convertedExprMustBeOperand(e)
 }
 
+private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node, Expr e) {
+  exists(CallInstruction call |
+    e = call.getConvertedResultExpression() and
+    call.getThisArgumentOperand() = node.getAddressOperand()
+  )
+}
+
 /** Holds if `node` should be an instruction node that maps `node.asExpr()` to `e`. */
 predicate exprNodeShouldBeInstruction(Node node, Expr e) {
   e = node.asInstruction().getConvertedResultExpression() and
   not exprNodeShouldBeOperand(_, e) and
-  not exprNodeShouldBeIndirectOperand(_, e, _)
+  not exprNodeShouldBeIndirectOperand(_, e, _) and
+  not exprNodeShouldBeIndirectOutNode(_, e)
 }
 
 private class ExprNodeBase extends Node {
@@ -792,6 +800,17 @@ private class IndirectOperandExprNode extends ExprNodeBase, IndirectOperand {
   final override string toStringImpl() { result = this.getConvertedExpr().toString() }
 }
 
+private class IndirectArgumentOutExprNode extends ExprNodeBase, IndirectArgumentOutNode {
+
+  IndirectArgumentOutExprNode() { exprNodeShouldBeIndirectOutNode(this, _)}
+
+  final override Expr getConvertedExpr() { exprNodeShouldBeIndirectOutNode(this, result) }
+
+  final override Expr getExpr() { result = this.getConvertedExpr() }
+
+  final override string toStringImpl() { result = this.getConvertedExpr().toString() }
+}
+
 /**
  * An expression, viewed as a node in a data flow graph.
  */