JS: Use Class#getAnInstanceReference

Author: asgerf

javascript/ql/lib/semmle/javascript/DOM.qll

@@ -420,13 +420,6 @@ module DOM {
     t.startInProp("target") and
     result = domEventSource()
     or
-    t.start() and
-    exists(DataFlow::ClassNode cls |
-      cls.getASuperClassNode().getALocalSource() =
-        DataFlow::globalVarRef(any(string s | s.matches("HTML%Element"))) and
-      result = cls.getAReceiverNode()
-    )
-    or
     exists(DataFlow::TypeTracker t2 | result = domValueRef(t2).track(t2, t))
   }
 
@@ -437,6 +430,12 @@ module DOM {
     result.hasUnderlyingType("Element")
     or
     result.hasUnderlyingType(any(string s | s.matches("HTML%Element")))
+    or
+    exists(DataFlow::ClassNode cls |
+      cls.getASuperClassNode().getALocalSource() =
+        DataFlow::globalVarRef(any(string s | s.matches("HTML%Element"))) and
+      result = cls.getAnInstanceReference()
+    )
   }
 
   module LocationSource {