[Rust] weird behavior in dataflow when trying to select a specific node #19983

predicate isSource(DataFlow::Node node) {
    exists(CallExpr ce, Function f | f.getName().getText() = "read_region" |
      node.asExpr().getExpr() = ce and ce.getStaticTarget() = f
    ) and
    node.getLocation().getStartLine() = 727
  }

  predicate isSink(DataFlow::Node node) {
    any()
  }

/**
 * @name Empty block
 * @kind path-problem
 * @problem.severity warning
 * @id rust/example/empty-block
 */

import rust
import codeql.rust.dataflow.DataFlow
import codeql.rust.dataflow.TaintTracking

module MyConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) {
    node.asPat().getPat().(IdentPat).getName().getText() = "data"
  }

  predicate isSink(DataFlow::Node node) {
    exists(IndexExpr ie | node.asExpr().getExpr().(RangeExpr) = ie.getIndex())
  }

  predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
    // If the start/end of a range is tainted, then the whole range is tainted.
    exists(RangeExpr re |
      pred.asExpr().getExpr() = [re.getStart(), re.getEnd()] and
      succ.asExpr().getExpr() = re
    )
    or
    // Propagate taint from `tainted` to the result of `tainted?`
    exists(TryExpr te |
      te.getExpr() = pred.asExpr().getExpr() and
      te = succ.asExpr().getExpr()
    )
    or
    // Propagate taint from `tainted` to `[tainted]`
    exists(ArrayListExpr ale |
      ale.getAnExpr() = pred.asExpr().getExpr() and
      ale = succ.asExpr().getExpr()
    )
    or
    // Propagate taint from `tainted` to `from_be_bytes(tainted)`
    exists(CallExpr ce, Function f |
      pred.asExpr().getExpr() = ce.getArg(0) and
      succ.asExpr().getExpr() = ce and
      ce.getStaticTarget() = f and
      f.getName().getText() = "from_be_bytes"
    )
    or
    // Propagate taint from `tainted` to `tainted as usize`
    exists(CastExpr ce |
      pred.asExpr().getExpr() = ce.getExpr() and
      succ.asExpr().getExpr() = ce and
      pred.getLocation().getFile().getAbsolutePath().matches("%section%")
    )
  }
}

module Flow = TaintTracking::Global<MyConfig>;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink, source, sink,
  "PrimaryQlClass: " + sink.getNode().asExpr().getExpr().getAPrimaryQlClass() + "start: " +
    sink.getLocation().getStartLine()