Dynamically determine the callback argument's position

An additional parameter may be anywhere in the
parameter list and shift around the exact index of
the callback argument in the parameter list.

So, "dynamically" determine the index by type-checking
a parameter in the parameter list.

Note 1: There may be multiple matches since we're
using `_` (don't care) as the argument index.

Note 2: We could have used DataFlow::InvokeNode.getCallback
if the supertype were not CallExpr, but jumping to
data flow node is an overkill here.

Author: jeongsoolee09

javascript/ql/lib/semmle/javascript/AMD.qll

@@ -91,7 +91,9 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
   Function getFactoryFunction() { TValueNode(result) = this.getFactoryNodeInternal() }
 
   private EarlyStageNode getFactoryNodeInternal() {
-    result = TValueNode(this.getArgument(1))
+    exists(Function factoryFunction | factoryFunction = this.getArgument(_) |
+      result = TValueNode(factoryFunction)
+    )
     or
     DataFlow::localFlowStep(result, this.getFactoryNodeInternal())
   }