CPP: IR weirdness with unexpected result for `getUnconvertedResultExpression`

(Kind of related to #21241 and #21240)

While testing my query, I noticed that I had a duplicate result for line 28 (`if (&x)`).
(Only visible when looking at the `.expected` file of my test output)
The IR supposedly had **two address-of instruction** at that line.
I don't understand why and looking at the IR the only difference between line 28 and 29 is that there is one CompareNE instruction in the one case and one CompareEQ instruction in the other case (as expected).

> | twice!NonSSA: NonSSA: 8:ResultCopy | AddressOfNullCheck.c:28:9
> | twice!NonSSA: NonSSA: 7:ValCondCondCompare | AddressOfNullCheck.c:28:9
> | twice!NonSSA: NonSSA: 15:ResultCopy | AddressOfNullCheck.c:29:10

IR graph dump query

```ql
/**
* @name ff
* @description aa
* @kind graph
* @id aaaaa
* @tags security
*/

import cpp
import semmle.code.cpp.ir.IR
import semmle.code.cpp.ir.PrintIR
import semmle.code.cpp.Declaration

private class Foo extends PrintIRConfiguration {
override predicate shouldPrintDeclaration(Declaration decl) {
decl.(Function).getName() = "test_direct_bool_context"
}
}

```

Dot file

```dot
digraph {
compound=true;
subgraph cluster_0 {
0[shape=point, width=0];
"label"="void test_direct_bool_context()";

subgraph cluster_1 {
1[shape=point, width=0];
"label"="Block 0";

2["label"="v24_1(void) = EnterFunction : "; ];
3["label"="m24_2(unknown) = AliasedDefinition : "; ];
4["label"="m24_3(unknown) = InitializeNonLocal : "; ];
5["label"="m24_4(unknown) = Chi : total:m24_2, partial:m24_3"; ];
6["label"="r25_1(glval) = VariableAddress[x] : "; ];
7["label"="m25_2(int) = Uninitialized[x] : &:r25_1"; ];
8["label"="r28_1(glval) = VariableAddress[x] : "; ];
9["label"="r28_2(int *) = CopyValue : r28_1"; ];
10["label"="r28_3(int *) = Constant[0] : "; ];
11["label"="r28_4(bool) = CompareNE : r28_2, r28_3"; ];
12["label"="v28_5(void) = ConditionalBranch : r28_4"; ];
}
subgraph cluster_13 {
13[shape=point, width=0];
"label"="Block 1";

14["label"="v28_6(void) = NoOp : "; ];
}
subgraph cluster_15 {
15[shape=point, width=0];
"label"="Block 2";

16["label"="r29_1(glval) = VariableAddress[x] : "; ];
17["label"="r29_2(int *) = CopyValue : r29_1"; ];
18["label"="r29_3(int *) = Constant[0] : "; ];
19["label"="r29_4(bool) = CompareEQ : r29_2, r29_3"; ];
20["label"="v29_5(void) = ConditionalBranch : r29_4"; ];
}
subgraph cluster_21 {
21[shape=point, width=0];
"label"="Block 3";

22["label"="v29_6(void) = NoOp : "; ];
}
subgraph cluster_23 {
23[shape=point, width=0];
"label"="Block 4";

24["label"="v30_1(void) = NoOp : "; ];
25["label"="v24_5(void) = ReturnVoid : "; ];
26["label"="v24_6(void) = AliasedUse : m24_3"; ];
27["label"="v24_7(void) = ExitFunction : "; ];
}
}
13 -> 15["label"="Goto"; "ltail"="cluster_13"; "lhead"="cluster_15"; ];
21 -> 23["label"="Goto"; "ltail"="cluster_21"; "lhead"="cluster_23"; ];
1 -> 15["label"="False"; "ltail"="cluster_1"; "lhead"="cluster_15"; ];
15 -> 23["label"="False"; "ltail"="cluster_15"; "lhead"="cluster_23"; ];
1 -> 13["label"="True"; "ltail"="cluster_1"; "lhead"="cluster_13"; ];
15 -> 21["label"="True"; "ltail"="cluster_15"; "lhead"="cluster_21"; ];
}

```

Query

```ql
/**
* @name Suspicious check on address-of expression
* @description Taking the address of a valid object always produces a non-NULL
* pointer, so checking the result against NULL is either redundant
* or indicates a bug where a different check was intended.
* @kind problem
* @problem.severity warning
* @precision high
* @id asymmetric-research/suspicious-address-of-null-check
* @tags reliability
* correctness
* readability
*/

import cpp
import semmle.code.cpp.controlflow.Guards
/**
* Technically, we'd ignore cases where we do something like &foo->first_field (where foo is a pointer)
* this is because if foo is NULL, the expression could actually evaluate to NULL.
* However, it doesn't seem likely that anyone would write code like that intentionally
* and it's also undefined behavior to dereference a NULL pointer anyway.
*/
class ValidAddressOfExpr extends AddressOfExpr { }

from Instruction source
where
source.getUnconvertedResultExpression() instanceof ValidAddressOfExpr and
source.getLocation().getStartLine() = [28, 29]
select source, "twice!" + source.getUniqueId()

```

Testcase

```c
#define NULL ((void*)0)

struct foo {
int a;
long b;
};
typedef struct foo foo_t;

int global_var;
int global_array[10];

// Test direct comparisons with local variables
void test_direct_comparison_local(void) {
int x;

// Direct comparison of address-of with NULL - should alert
if (&x == NULL) {} // $ Alert
if (&x != NULL) {} // $ Alert
if (NULL == &x) {} // $ Alert
if (0 == &x) {} // $ Alert
}

// Test direct boolean context with local variables
void test_direct_bool_context(void) {
int x;

// Direct use in boolean context - should alert
if (&x) {} // $ Alert DUPLICATE HERE
if (!&x) {} // $ Alert
}
```

Start with the supplied CodeQL query's use of getUnconvertedResultExpression and the test_direct_bool_context testcase. Compare the IR and query results for the line 28 and line 29 conditions, then verify the testcase reports one alert for each expected line without the duplicate on line 28.

索引モデルが issue の本文から書いたものです。