CPP: IR weirdness with unexpected result for `getUnconvertedResultExpression`

(Kind of related to #21241 and #21240)

While testing my query, I noticed that I had a duplicate result for line 28 (`if (&x)`).
(Only visible when looking at the `.expected` file of my test output)
The IR supposedly had **two address-of instruction** at that line.
I don't understand why and looking at the IR the only difference between line 28 and 29 is that there is one CompareNE instruction in the one case and one CompareEQ instruction in the other case (as expected).

> | twice!NonSSA: NonSSA: 8:ResultCopy | AddressOfNullCheck.c:28:9
> | twice!NonSSA: NonSSA: 7:ValCondCondCompare | AddressOfNullCheck.c:28:9
> | twice!NonSSA: NonSSA: 15:ResultCopy | AddressOfNullCheck.c:29:10

IR graph dump query

```ql
/**
* @name ff
* @description aa
* @kind graph
* @id aaaaa
* @tags security
*/

import cpp
import semmle.code.cpp.ir.IR
import semmle.code.cpp.ir.PrintIR
import semmle.code.cpp.Declaration

private class Foo extends PrintIRConfiguration {
override predicate shouldPrintDeclaration(Declaration decl) {
decl.(Function).getName() = "test_direct_bool_context"
}
}

```

Dot file

```dot
digraph {
compound=true;
subgraph cluster_0 {
0[shape=point, width=0];
"label"="void test_direct_bool_context()";

subgraph cluster_1 {
1[shape=point, width=0];
"label"="Block 0";

2["label"="v24_1(void) = EnterFunction : "; ];
3["label"="m24_2(unknown) = AliasedDefinition : "; ];
4["label"="m24_3(unknown) = InitializeNonLocal : "; ];
5["label"="m24_4(unknown) = Chi : total:m24_2, partial:m24_3"; ];
6["label"="r25_1(glval) = VariableAddress[x] : "; ];
7["label"="m25_2(int) = Uninitialized[x] : &:r25_1"; ];
8["label"="r28_1(glval) = VariableAddress[x] : "; ];
9["label"="r28_2(int *) = CopyValue : r28_1"; ];
10["label"="r28_3(int *) = Constant[0] : "; ];
11["label"="r28_4(bool) = CompareNE : r28_2, r28_3"; ];
12["label"="v28_5(void) = ConditionalBranch : r28_4"; ];
}
subgraph cluster_13 {
13[shape=point, width=0];
"label"="Block 1";

14["label"="v28_6(void) = NoOp : "; ];
}
subgraph cluster_15 {
15[shape=point, width=0];
"label"="Block 2";

16["label"="r29_1(glval) = VariableAddress[x] : "; ];
17["label"="r29_2(int *) = CopyValue : r29_1"; ];
18["label"="r29_3(int *) = Constant[0] : "; ];
19["label"="r29_4(bool) = CompareEQ : r29_2, r29_3"; ];
20["label"="v29_5(void) = ConditionalBranch : r29_4"; ];
}
subgraph cluster_21 {
21[shape=point, width=0];
"label"="Block 3";

22["label"="v29_6(void) = NoOp : "; ];
}
subgraph cluster_23 {
23[shape=point, width=0];
"label"="Block 4";

24["label"="v30_1(void) = NoOp : "; ];
25["label"="v24_5(void) = ReturnVoid : "; ];
26["label"="v24_6(void) = AliasedUse : m24_3"; ];
27["label"="v24_7(void) = ExitFunction : "; ];
}
}
13 -> 15["label"="Goto"; "ltail"="cluster_13"; "lhead"="cluster_15"; ];
21 -> 23["label"="Goto"; "ltail"="cluster_21"; "lhead"="cluster_23"; ];
1 -> 15["label"="False"; "ltail"="cluster_1"; "lhead"="cluster_15"; ];
15 -> 23["label"="False"; "ltail"="cluster_15"; "lhead"="cluster_23"; ];
1 -> 13["label"="True"; "ltail"="cluster_1"; "lhead"="cluster_13"; ];
15 -> 21["label"="True"; "ltail"="cluster_15"; "lhead"="cluster_21"; ];
}

```

Query

```ql
/**
* @name Suspicious check on address-of expression
* @description Taking the address of a valid object always produces a non-NULL
* pointer, so checking the result against NULL is either redundant
* or indicates a bug where a different check was intended.
* @kind problem
* @problem.severity warning
* @precision high
* @id asymmetric-research/suspicious-address-of-null-check
* @tags reliability
* correctness
* readability
*/

import cpp
import semmle.code.cpp.controlflow.Guards
/**
* Technically, we'd ignore cases where we do something like &foo->first_field (where foo is a pointer)
* this is because if foo is NULL, the expression could actually evaluate to NULL.
* However, it doesn't seem likely that anyone would write code like that intentionally
* and it's also undefined behavior to dereference a NULL pointer anyway.
*/
class ValidAddressOfExpr extends AddressOfExpr { }

from Instruction source
where
source.getUnconvertedResultExpression() instanceof ValidAddressOfExpr and
source.getLocation().getStartLine() = [28, 29]
select source, "twice!" + source.getUniqueId()

```

Testcase

```c
#define NULL ((void*)0)

struct foo {
int a;
long b;
};
typedef struct foo foo_t;

int global_var;
int global_array[10];

// Test direct comparisons with local variables
void test_direct_comparison_local(void) {
int x;

// Direct comparison of address-of with NULL - should alert
if (&x == NULL) {} // $ Alert
if (&x != NULL) {} // $ Alert
if (NULL == &x) {} // $ Alert
if (0 == &x) {} // $ Alert
}

// Test direct boolean context with local variables
void test_direct_bool_context(void) {
int x;

// Direct use in boolean context - should alert
if (&x) {} // $ Alert DUPLICATE HERE
if (!&x) {} // $ Alert
}
```

Bắt đầu với việc sử dụng getUnconvertedResultExpression trong truy vấn CodeQL được cung cấp và testcase test_direct_bool_context. So sánh kết quả IR và kết quả truy vấn cho các điều kiện ở dòng 28 và dòng 29, sau đó xác minh rằng testcase báo cáo một alert cho mỗi dòng dự kiến mà không có bản trùng lặp ở dòng 28.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.