Python: reintroduce instance-attribute type-tracking without the classInstanceTracker blow-up (try 2) - #22965

Note: this is a copy of #22097, which was accidentally merged into an old release branch instead of main.

#22092 disabled the instanceFieldStep disjunct of TypeTrackingInput::levelStepCall because it identified instances via classInstanceTracker — a full type-tracker run — from inside levelStepCall, creating a mutual recursion that caused catastrophic slowdowns on OOP-heavy code bases (e.g. mypy, dask). This reintroduces the same flow (a value stored on self.attr in a method, read later as instance.attr) via a cheaper instance-identification strategy.

Change

• instanceAttrRead now identifies the instance using local flow (getALocalSource(), purely simpleLocalFlowStep-based) from a constructor call resolved by resolveClassCall/classTracker, instead of classInstanceTracker. This drops the recursive dependency to the same call-graph machinery already used by the un-disabled inheritedFieldStep.
• instanceFieldStep is otherwise unchanged (same levelStepCall shape, same getADirectSuperclass* relation).
• Updated QLDoc + change note.

private predicate instanceAttrRead(Class cls, string attr, DataFlowPublic::AttrRead read) {
  exists(DataFlowPublic::CallCfgNode construction |
    DataFlowDispatch::resolveClassCall(construction.asCfgNode(), cls) and
    read.getObject().getALocalSource() = construction
  ) and
  read.mayHaveAttributeName(attr)
}

Trade-off

Precision drops for instances that flow across a call/return before being read — these are no longer covered, since the instance is now tracked only by local flow rather than a dedicated instance type-tracker.

Notes for reviewers

• The 4 external-instance-read results previously produced by instanceFieldStep are reproduced; typetracking, dataflow, callgraph, ApiGraphs, and taint library tests pass.
• The performance improvement is argued from the dependency structure (classTracker + local flow vs. classInstanceTracker); it was not measured against mypy/dask in this environment, so confirming the blow-up is resolved on those code bases is worth doing before merge.