wip11

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -415,15 +415,30 @@ private module Input3 implements InputSig3 {
   }
 
   bindingset[derefChainBorrow]
-  Type inferCallTypeIn(Call call, string derefChainBorrow, FunctionPosition pos, TypePath path) {
+  Type inferCallTypeBottomUp(Call call, string derefChainBorrow, FunctionPosition pos, TypePath path) {
     result = call.(FunctionCallMatchingInput::Access).getInferredType(derefChainBorrow, pos, path)
   }
 
-  Type inferCallTypeOut(AstNode n, TypePosition pos, TypePath path) {
-    result = inferFunctionCallTypeNonSelf(n, pos, path)
+  Type inferCallReturnType(AstNode n, TypePath path) {
+    exists(Call call, TypePath path0 |
+      result = inferCallReturnType(call, _, n, path0) and
+      if
+        // index expression `x[i]` desugars to `*x.index(i)`, so we must account for
+        // the implicit deref
+        call instanceof IndexExpr
+      then path0.isCons(getRefTypeParameter(_), path)
+      else path = path0
+    )
+  }
+
+  Type inferCallArgumentTypeTopDown(AstNode n, TypePath path) {
+    exists(FunctionCallMatchingInput::Access call, FunctionPosition pos |
+      result = inferCallArgumentTypeTopDown(call, pos, n, _, _, path) and
+      not call.(AssocFunctionResolution::AssocFunctionCall).hasReceiverAtPos(pos)
+    )
     or
     exists(FunctionCallMatchingInput::Access a |
-      result = inferFunctionCallTypeSelf(a, n, DerefChain::nil(), path) and
+      result = inferFunctionCallSelfArgumentTypeTopDown(a, n, DerefChain::nil(), path) and
       if a.(AssocFunctionResolution::AssocFunctionCall).hasReceiver()
       then not path.isEmpty()
       else any()
@@ -459,7 +474,7 @@ private module Input3 implements InputSig3 {
     )
   }
 
-  Type inferTypeCertainInput(AstNode n, TypePath path) {
+  Type inferTypeCertainSpecific(AstNode n, TypePath path) {
     result = inferFunctionBodyType(n, path)
     or
     result = inferLiteralType(n, path, true)
@@ -580,36 +595,31 @@ private module Input3 implements InputSig3 {
     prefix1.isEmpty()
   }
 
-  /**
-   * Holds if `child` is a child of `parent`, and the Rust compiler applies [least
-   * upper bound (LUB) coercion][1] to infer the type of `parent` from the type of
-   * `child`.
-   *
-   * In this case, we want type information to only flow from `child` to `parent`,
-   * to avoid (a) either having to model LUB coercions, or (b) risk combinatorial
-   * explosion in inferred types.
-   *
-   * [1]: https://doc.rust-lang.org/reference/type-coercions.html#r-coerce.least-upper-bound
-   */
-  predicate inferLubStep(AstNode child, TypePath path1, AstNode parent, TypePath prefix) {
+  predicate inferLubStep(AstNode n1, TypePath path1, AstNode n2, TypePath path2) {
     path1.isEmpty() and
     (
-      parent = any(ArrayListExpr ale | child = ale.getAnExpr()) and
-      prefix = TypePath::singleton(getArrayTypeParameter())
+      n2 = any(ArrayListExpr ale | n1 = ale.getAnExpr()) and
+      path2 = TypePath::singleton(getArrayTypeParameter())
       or
-      bodyReturns(parent, child) and
-      prefix.isEmpty()
+      bodyReturns(n2, n1) and
+      path2.isEmpty()
       or
       exists(Struct s |
-        child = [parent.(RangeExpr).getStart(), parent.(RangeExpr).getEnd()] and
-        prefix =
+        n1 = [n2.(RangeExpr).getStart(), n2.(RangeExpr).getEnd()] and
+        path2 =
           TypePath::singleton(TTypeParamTypeParameter(s.getGenericParamList().getATypeParam())) and
-        s = getRangeType(parent)
+        s = getRangeType(n2)
       )
     )
   }
 
-  Type inferTypeInput(AstNode n, TypePath path) {
+  Type inferTypeTopDown(AstNode n, TypePath path) {
+    result = inferTypeFromAnnotationTopDown(n, path)
+    or
+    result = inferClosureExprBodyTypeTopDown(n, path)
+  }
+
+  Type inferTypeSpecific(AstNode n, TypePath path) {
     result = inferAssignmentOperationType(n, path)
     or
     result = inferConstructionType(n, path)
@@ -634,7 +644,7 @@ private module Input3 implements InputSig3 {
     or
     result = inferDeconstructionPatType(n, path)
     or
-    result = inferUnknownTypeFromAnnotation(n, path)
+    result = inferUnknownType(n, path)
   }
 }
 
@@ -928,9 +938,6 @@ private Type inferTypeFromAnnotationTopDown(AstNode n, TypePath path) {
   )
 }
 
-private predicate inferUnknownTypeFromAnnotation =
-  TopDownTyping<inferTypeFromAnnotationTopDown/2>::inferType/2;
-
 pragma[nomagic]
 private TupleType inferTupleRootType(AstNode n) {
   // `typeEquality` handles the non-root cases
@@ -2802,36 +2809,13 @@ private module FunctionCallMatchingInput implements MatchingWithEnvironmentInput
 }
 
 pragma[nomagic]
-private Type inferFunctionCallType0(
+private Type inferCallArgumentTypeTopDown(
   FunctionCallMatchingInput::Access call, FunctionPosition pos, AstNode n, DerefChain derefChain,
   BorrowKind borrow, TypePath path
 ) {
-  exists(TypePath path0 |
-    exists(string derefChainBorrow |
-      FunctionCallMatchingInput::decodeDerefChainBorrow(derefChainBorrow, derefChain, borrow)
-    |
-      n = call.getNodeAt(pos) and
-      call.hasUnknownTypeAt(derefChainBorrow, pos, path0) and
-      result = TUnknownType()
-      or
-      result = inferCallTypeOut(call, derefChainBorrow, pos, n, path0)
-    )
-  |
-    if
-      // index expression `x[i]` desugars to `*x.index(i)`, so we must account for
-      // the implicit deref
-      pos.isReturn() and
-      call instanceof IndexExpr
-    then path0.isCons(getRefTypeParameter(_), path)
-    else path = path0
-  )
-}
-
-pragma[nomagic]
-private Type inferFunctionCallTypeNonSelf(AstNode n, FunctionPosition pos, TypePath path) {
-  exists(FunctionCallMatchingInput::Access call |
-    result = inferFunctionCallType0(call, pos, n, _, _, path) and
-    not call.(AssocFunctionResolution::AssocFunctionCall).hasReceiverAtPos(pos)
+  exists(string derefChainBorrow |
+    FunctionCallMatchingInput::decodeDerefChainBorrow(derefChainBorrow, derefChain, borrow) and
+    result = inferCallArgumentTypeTopDown(call, derefChainBorrow, pos, n, path)
   )
 }
 
@@ -2843,12 +2827,12 @@ private Type inferFunctionCallTypeNonSelf(AstNode n, FunctionPosition pos, TypeP
  * empty, at which point the inferred type can be applied back to `n`.
  */
 pragma[nomagic]
-private Type inferFunctionCallTypeSelf(
+private Type inferFunctionCallSelfArgumentTypeTopDown(
   FunctionCallMatchingInput::Access call, AstNode n, DerefChain derefChain, TypePath path
 ) {
   exists(FunctionPosition pos, BorrowKind borrow, TypePath path0 |
     call.(AssocFunctionResolution::AssocFunctionCall).hasReceiverAtPos(pos) and
-    result = inferFunctionCallType0(call, pos, n, derefChain, borrow, path0)
+    result = inferCallArgumentTypeTopDown(call, pos, n, derefChain, borrow, path0)
   |
     borrow.isNoBorrow() and
     path = path0
@@ -2865,7 +2849,7 @@ private Type inferFunctionCallTypeSelf(
     DerefChain derefChain0, Type t0, TypePath path0, DerefImplItemNode impl, Type selfParamType,
     TypePath selfPath
   |
-    t0 = inferFunctionCallTypeSelf(call, n, derefChain0, path0) and
+    t0 = inferFunctionCallSelfArgumentTypeTopDown(call, n, derefChain0, path0) and
     derefChain0.isCons(impl, derefChain) and
     selfParamType = impl.resolveSelfTypeAt(selfPath)
   |
@@ -3041,17 +3025,37 @@ private module ConstructionMatching = Matching<ConstructionMatchingInput>;
 
 pragma[nomagic]
 private Type inferConstructionTypePreCheck(AstNode n, FunctionPosition pos, TypePath path) {
-  exists(ConstructionMatchingInput::Access a | n = a.getNodeAt(pos) |
+  exists(ConstructionMatchingInput::Access a |
+    n = a.getNodeAt(pos) and
     result = ConstructionMatching::inferAccessType(a, pos, path)
-    or
-    a.hasUnknownTypeAt(pos, path) and
-    result = TUnknownType()
   )
 }
 
 private predicate inferConstructionType =
   CheckContextTyping<inferConstructionTypePreCheck/3>::check/2;
 
+pragma[nomagic]
+private Type inferUnknownType(AstNode n, TypePath path) {
+  result = TUnknownType() and
+  (
+    exists(FunctionCallMatchingInput::Access call, FunctionPosition pos |
+      n = call.getNodeAt(pos) and
+      call.hasUnknownTypeAt(_, pos, path)
+    )
+    or
+    exists(ConstructionMatchingInput::Access a, FunctionPosition pos |
+      n = a.getNodeAt(pos) and
+      a.hasUnknownTypeAt(pos, path)
+    )
+    or
+    exists(Param p |
+      not p.hasTypeRepr() and
+      n = p.getPat() and
+      path.isEmpty()
+    )
+  )
+}
+
 /**
  * A matching configuration for resolving types of operations like `a + b`.
  */
@@ -3633,29 +3637,14 @@ private Type inferClosureExprBodyTypeTopDown(AstNode n, TypePath path) {
 }
 
 pragma[nomagic]
-private Type inferClosureExprType(AstNode n, TypePath path) {
-  exists(ClosureExpr ce |
-    n = ce and
-    (
-      path = TypePath::singleton(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam())) and
-      result.(TupleType).getArity() = ce.getNumberOfParams()
-      or
-      exists(TypePath path0 |
-        result = ce.getRetType().getTypeRepr().(TypeMention).getTypeAt(path0) and
-        path = closureReturnPath().append(path0)
-      )
-    )
-    or
-    exists(Param p |
-      p = ce.getAParam() and
-      not p.hasTypeRepr() and
-      n = p.getPat() and
-      result = TUnknownType() and
-      path.isEmpty()
-    )
-  )
+private Type inferClosureExprType(ClosureExpr ce, TypePath path) {
+  path = TypePath::singleton(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam())) and
+  result.(TupleType).getArity() = ce.getNumberOfParams()
   or
-  result = TopDownTyping<inferClosureExprBodyTypeTopDown/2>::inferType(n, path)
+  exists(TypePath suffix |
+    result = ce.getRetType().getTypeRepr().(TypeMention).getTypeAt(suffix) and
+    path = closureReturnPath().append(suffix)
+  )
 }
 
 pragma[nomagic]

rust/ql/test/library-tests/dataflow/models/CONSISTENCY/PathResolutionConsistency.expected

@@ -0,0 +1,2 @@
+multipleResolvedTargets
+| main.rs:218:20:218:25 | ... != ... |

rust/ql/test/library-tests/type-inference/type-inference.expected

@@ -10250,7 +10250,6 @@ inferType
 | main.rs:1412:17:1412:20 | self | TRef.TSlice | main.rs:1410:14:1410:23 | T |
 | main.rs:1412:17:1412:27 | self.get(...) |  | {EXTERNAL LOCATION} | Option |
 | main.rs:1412:17:1412:27 | self.get(...) | T | {EXTERNAL LOCATION} | & |
-| main.rs:1412:17:1412:27 | self.get(...) | T.TRef | main.rs:1410:14:1410:23 | T |
 | main.rs:1412:17:1412:36 | ... .unwrap() |  | {EXTERNAL LOCATION} | & |
 | main.rs:1412:17:1412:36 | ... .unwrap() | TRef | main.rs:1410:14:1410:23 | T |
 | main.rs:1412:26:1412:26 | 0 |  | {EXTERNAL LOCATION} | i32 |
@@ -11591,8 +11590,6 @@ inferType
 | main.rs:2221:18:2221:21 | true |  | {EXTERNAL LOCATION} | bool |
 | main.rs:2223:9:2223:15 | S(...) |  | main.rs:2107:5:2107:19 | S |
 | main.rs:2223:9:2223:15 | S(...) | T | {EXTERNAL LOCATION} | i64 |
-| main.rs:2223:9:2223:15 | S(...) | T | main.rs:2107:5:2107:19 | S |
-| main.rs:2223:9:2223:15 | S(...) | T.T | {EXTERNAL LOCATION} | i64 |
 | main.rs:2223:9:2223:31 | ... .my_add(...) |  | main.rs:2107:5:2107:19 | S |
 | main.rs:2223:9:2223:31 | ... .my_add(...) | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:2223:9:2223:31 | ... .my_add(...) | T | main.rs:2107:5:2107:19 | S |
@@ -11611,8 +11608,6 @@ inferType
 | main.rs:2224:24:2224:27 | 3i64 |  | {EXTERNAL LOCATION} | i64 |
 | main.rs:2225:9:2225:15 | S(...) |  | main.rs:2107:5:2107:19 | S |
 | main.rs:2225:9:2225:15 | S(...) | T | {EXTERNAL LOCATION} | i64 |
-| main.rs:2225:9:2225:15 | S(...) | T | {EXTERNAL LOCATION} | & |
-| main.rs:2225:9:2225:15 | S(...) | T.TRef | {EXTERNAL LOCATION} | i64 |
 | main.rs:2225:9:2225:29 | ... .my_add(...) |  | main.rs:2107:5:2107:19 | S |
 | main.rs:2225:9:2225:29 | ... .my_add(...) | T | {EXTERNAL LOCATION} | i64 |
 | main.rs:2225:11:2225:14 | 1i64 |  | {EXTERNAL LOCATION} | i64 |