CPP: IR weirdness with unexpected result for `getUnconvertedResultExpression`

/**
 * @name ff
 * @description aa
 * @kind graph
 * @id aaaaa
 * @tags security
 */

import cpp
import semmle.code.cpp.ir.IR
import semmle.code.cpp.ir.PrintIR
import semmle.code.cpp.Declaration

private class Foo extends PrintIRConfiguration {
  override predicate shouldPrintDeclaration(Declaration decl) {
    decl.(Function).getName() = "test_direct_bool_context"
  }
}

digraph {
  compound=true;
  subgraph cluster_0 {
    0[shape=point, width=0];
    "label"="void test_direct_bool_context()"; 
    
    subgraph cluster_1 {
      1[shape=point, width=0];
      "label"="Block 0"; 
      
      2["label"="v24_1(void) = EnterFunction : "; ];
      3["label"="m24_2(unknown) = AliasedDefinition : "; ];
      4["label"="m24_3(unknown) = InitializeNonLocal : "; ];
      5["label"="m24_4(unknown) = Chi : total:m24_2, partial:m24_3"; ];
      6["label"="r25_1(glval<int>) = VariableAddress[x] : "; ];
      7["label"="m25_2(int) = Uninitialized[x] : &:r25_1"; ];
      8["label"="r28_1(glval<int>) = VariableAddress[x] : "; ];
      9["label"="r28_2(int *) = CopyValue : r28_1"; ];
      10["label"="r28_3(int *) = Constant[0] : "; ];
      11["label"="r28_4(bool) = CompareNE : r28_2, r28_3"; ];
      12["label"="v28_5(void) = ConditionalBranch : r28_4"; ];
    }
    subgraph cluster_13 {
      13[shape=point, width=0];
      "label"="Block 1"; 
      
      14["label"="v28_6(void) = NoOp : "; ];
    }
    subgraph cluster_15 {
      15[shape=point, width=0];
      "label"="Block 2"; 
      
      16["label"="r29_1(glval<int>) = VariableAddress[x] : "; ];
      17["label"="r29_2(int *) = CopyValue : r29_1"; ];
      18["label"="r29_3(int *) = Constant[0] : "; ];
      19["label"="r29_4(bool) = CompareEQ : r29_2, r29_3"; ];
      20["label"="v29_5(void) = ConditionalBranch : r29_4"; ];
    }
    subgraph cluster_21 {
      21[shape=point, width=0];
      "label"="Block 3"; 
      
      22["label"="v29_6(void) = NoOp : "; ];
    }
    subgraph cluster_23 {
      23[shape=point, width=0];
      "label"="Block 4"; 
      
      24["label"="v30_1(void) = NoOp : "; ];
      25["label"="v24_5(void) = ReturnVoid : "; ];
      26["label"="v24_6(void) = AliasedUse : m24_3"; ];
      27["label"="v24_7(void) = ExitFunction : "; ];
    }
  }
  13 -> 15["label"="Goto"; "ltail"="cluster_13"; "lhead"="cluster_15"; ];
  21 -> 23["label"="Goto"; "ltail"="cluster_21"; "lhead"="cluster_23"; ];
  1 -> 15["label"="False"; "ltail"="cluster_1"; "lhead"="cluster_15"; ];
  15 -> 23["label"="False"; "ltail"="cluster_15"; "lhead"="cluster_23"; ];
  1 -> 13["label"="True"; "ltail"="cluster_1"; "lhead"="cluster_13"; ];
  15 -> 21["label"="True"; "ltail"="cluster_15"; "lhead"="cluster_21"; ];
}

/**
 * @name Suspicious check on address-of expression
 * @description Taking the address of a valid object always produces a non-NULL
 *              pointer, so checking the result against NULL is either redundant
 *              or indicates a bug where a different check was intended.
 * @kind problem
 * @problem.severity warning
 * @precision high
 * @id asymmetric-research/suspicious-address-of-null-check
 * @tags reliability
 *       correctness
 *       readability
 */

import cpp
import semmle.code.cpp.controlflow.Guards
/**
 * Technically, we'd ignore cases where we do something like &foo->first_field (where foo is a pointer)
 * this is because if foo is NULL, the expression could actually evaluate to NULL.
 * However, it doesn't seem likely that anyone would write code like that intentionally
 * and it's also undefined behavior to dereference a NULL pointer anyway.
 */
class ValidAddressOfExpr extends AddressOfExpr { }


from Instruction source
where
  source.getUnconvertedResultExpression() instanceof ValidAddressOfExpr and
    source.getLocation().getStartLine() = [28, 29]
select source, "twice!" + source.getUniqueId()

#define NULL ((void*)0)

struct foo {
    int a;
    long b;
};
typedef struct foo foo_t;

int global_var;
int global_array[10];

// Test direct comparisons with local variables
void test_direct_comparison_local(void) {
    int x;

    // Direct comparison of address-of with NULL - should alert
    if (&x == NULL) {}       // $ Alert
    if (&x != NULL) {}       // $ Alert
    if (NULL == &x) {}       // $ Alert
    if (0 == &x) {}          // $ Alert
}

// Test direct boolean context with local variables
void test_direct_bool_context(void) {
    int x;

    // Direct use in boolean context - should alert
    if (&x) {}               // $ Alert DUPLICATE HERE
    if (!&x) {}              // $ Alert
}