wip10

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -916,7 +916,7 @@ private predicate bodyReturns(Expr body, Expr e) {
 }
 
 pragma[nomagic]
-private Type inferUnknownTypeFromAnnotationCand(AstNode n, TypePath path, TypePath prefix) {
+private Type inferTypeFromAnnotationTopDown(AstNode n, TypePath path) {
   // Normally, these are coercion sites, but in case a type is unknown we
   // allow for type information to flow from the type annotation.
   exists(TypeMention tm | result = tm.getTypeAt(path) |
@@ -925,17 +925,12 @@ private Type inferUnknownTypeFromAnnotationCand(AstNode n, TypePath path, TypePa
     tm = any(ClosureExpr ce | n = ce.getBody()).getRetType().getTypeRepr()
     or
     tm = getReturnTypeMention(any(Function f | n = f.getBody()))
-  ) and
-  prefix = path.getAPrefix()
-}
-
-private Type inferUnknownTypeFromAnnotation(AstNode n, TypePath path) {
-  exists(TypePath prefix |
-    result = inferUnknownTypeFromAnnotationCand(n, path, prefix) and
-    hasUnknownTypeAt(n, prefix)
   )
 }
 
+private predicate inferUnknownTypeFromAnnotation =
+  TopDownTyping<inferTypeFromAnnotationTopDown/2>::inferType/2;
+
 pragma[nomagic]
 private TupleType inferTupleRootType(AstNode n) {
   // `typeEquality` handles the non-root cases
@@ -2819,7 +2814,7 @@ private Type inferFunctionCallType0(
       call.hasUnknownTypeAt(derefChainBorrow, pos, path0) and
       result = TUnknownType()
       or
-      result = inferCallTypeOut(call, pos, n, derefChainBorrow, path0)
+      result = inferCallTypeOut(call, derefChainBorrow, pos, n, path0)
     )
   |
     if
@@ -3630,11 +3625,10 @@ private Type inferForLoopExprType(AstNode n, TypePath path) {
 }
 
 pragma[nomagic]
-private Type inferClosureExprBodyTypeCand(AstNode n, TypePath path, TypePath prefix) {
+private Type inferClosureExprBodyTypeTopDown(AstNode n, TypePath path) {
   exists(ClosureExpr ce |
     n = ce.getClosureBody() and
-    result = inferType(ce, closureReturnPath().appendInverse(path)) and
-    prefix = path.getAPrefix()
+    result = inferType(ce, closureReturnPath().appendInverse(path))
   )
 }
 
@@ -3661,10 +3655,7 @@ private Type inferClosureExprType(AstNode n, TypePath path) {
     )
   )
   or
-  exists(TypePath prefix |
-    result = inferClosureExprBodyTypeCand(n, path, prefix) and
-    hasUnknownTypeAt(n, prefix)
-  )
+  result = TopDownTyping<inferClosureExprBodyTypeTopDown/2>::inferType(n, path)
 }
 
 pragma[nomagic]

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -147,7 +147,7 @@ signature module InputSig1<LocationSig Location> {
 
   /**
    * A special pseudo type used to represent cases where the actual type needs
-   * to be inferred from the context. For example, in
+   * to be inferred from the context in a top-down manner. For example, in
    *
    * ```rust
    * let x = Vec::new();
@@ -2146,13 +2146,14 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
      */
     signature module InputSig3 {
       /**
-       * References to cached predicates that should be included to the cached
-       * stage of type inference. Such predicates should reference `CachedStage::ref`.
+       * A predicate used to reference cached predicates that should be included to the
+       * cached stage of type inference. Such predicates should themselves reference
+       * `CachedStage::ref`.
        */
       default predicate cachedStageRevRef() { none() }
 
       /**
-       * Point this predicate to the `inferType` predicate in the output of this module.
+       * Point this predicate to the `inferType` predicate from the output of this module.
        *
        * Needed to be able to refer to `inferType` in default signature implementations.
        */
@@ -2278,7 +2279,8 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
       }
 
       /**
-       * A position where a callable can have a declared type.
+       * A position where a callable can have a declared type and a call can have
+       * an inferred type.
        */
       class TypePosition {
         /** Holds if this position represents the return type of a callable. */
@@ -2288,7 +2290,14 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         string toString();
       }
 
-      /** A context needed to resolve calls. */
+      /**
+       * A context needed to resolve calls.
+       *
+       * For example, in Rust, we need an additional context to represent the
+       * candidate receiver type when resolving method calls.
+       *
+       * When not used, simply instantiate this class with `Unit`.
+       */
       bindingset[this]
       class CallResolutionContext {
         /** Gets a textual representation of this context. */
@@ -2298,11 +2307,18 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
       /** A callable. */
       class Callable {
+        /** Gets the type parameter at position `ppos` of this callable, if any. */
         TypeParameter getTypeParameter(TypeParameterPosition ppos);
 
+        /**
+         * Gets an additional type parameter constraint for the given type parameter,
+         * which applies to this callable. For example, in Rust, a function can apply
+         * additional constraints on type parameters belonging to the `impl` block
+         * that the function is defined in.
+         */
         TypeMention getAdditionalTypeParameterConstraint(TypeParameter tp);
 
-        /* Gets the declared type of this callable at `path` for position `pos`. */
+        /** Gets the declared type of this callable at `path` for position `pos`. */
         Type getDeclaredType(TypePosition pos, TypePath path);
 
         /** Gets a textual representation of this callable. */
@@ -2312,19 +2328,31 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         Location getLocation();
       }
 
+      /** A call expression. */
       class Call extends Expr {
+        /** Gets the explicit type argument at position `apos` and `path` for this call, if any. */
         Type getTypeArgument(TypeArgumentPosition apos, TypePath path);
 
+        /** Gets the AST node corresponding to the position `pos` of this call. */
         AstNode getNodeAt(TypePosition pos);
 
-        /** Gets the target of this call. */
+        /**
+         * Gets the target of this call, to be used when inferring certain types.
+         */
         Callable getTargetCertain();
 
-        /** Gets the target of this call. */
+        /** Gets the target of this call in the given context. */
         Callable getTarget(CallResolutionContext ctx);
       }
 
-      /** Gets the inferred type `call` at `path` for position `pos` in context `ctx`. */
+      /**
+       * Gets the inferred type of `call` at `path` and position `pos` in context `ctx`.
+       *
+       * By default, this is the inferred type of the node at the given position, but
+       * in for example Rust, the inferred type of the receiver of a method call needs
+       * to take the call context into account, in order to use the correct candidate
+       * receiver type.
+       */
       bindingset[ctx]
       default Type inferCallTypeIn(
         Call call, CallResolutionContext ctx, TypePosition pos, TypePath path
@@ -2556,9 +2584,9 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         path1.isEmpty() and
         path2.isEmpty() and
         (
-          exists(Assignment a |
-            a.getLeftOperand() = n1 and
-            a.getRightOperand() = n2
+          exists(AssignExpr ae |
+            ae.getLeftOperand() = n1 and
+            ae.getRightOperand() = n2
           )
           or
           exists(LetDeclaration let |
@@ -2621,22 +2649,16 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
       }
 
       pragma[nomagic]
-      private Type inferTypeFromReverseLubStepCand(AstNode n, TypePath path, TypePath prefix) {
+      private Type inferTypeFromLubStepTopDown(AstNode n, TypePath path) {
         exists(TypePath prefix1, AstNode n2, TypePath prefix2, TypePath suffix |
           result = inferType(n2, prefix2.appendInverse(suffix)) and
           path = prefix1.append(suffix) and
-          lubStep(n, prefix1, n2, prefix2) and
-          prefix = path.getAPrefix()
+          lubStep(n, prefix1, n2, prefix2)
         )
       }
 
-      pragma[nomagic]
-      private Type inferTypeFromReverseLub(AstNode n, TypePath path) {
-        exists(TypePath prefix |
-          result = inferTypeFromReverseLubStepCand(n, path, prefix) and
-          hasUnknownTypeAt(n, prefix)
-        )
-      }
+      private predicate inferTypeFromReverseLub =
+        TopDownTyping<inferTypeFromLubStepTopDown/2>::inferType/2;
 
       /**
        * Gets the inferred type of `n` at `path`.
@@ -2705,22 +2727,46 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
       private module CallMatching = MatchingWithEnvironment<CallMatchingInput>;
 
-      pragma[nomagic]
       Type inferCallTypeOut(
-        Call call, TypePosition pos, AstNode n, CallResolutionContext ctx, TypePath path
+        Call call, CallResolutionContext ctx, TypePosition pos, AstNode n, TypePath path
       ) {
         n = call.getNodeAt(pos) and
         result = CallMatching::inferAccessType(call, ctx, pos, path)
       }
 
       pragma[nomagic]
-      predicate hasUnknownTypeAt(AstNode n, TypePath path) {
+      private predicate hasUnknownTypeAt(AstNode n, TypePath path) {
         inferType(n, path) instanceof UnknownType
       }
 
       pragma[nomagic]
       private predicate hasUnknownType(AstNode n) { hasUnknownTypeAt(n, _) }
 
+      signature Type inferTypeTopDownSig(AstNode n, TypePath path);
+
+      /**
+       * Given a predicate `inferTypeTopDown` for inferring the type of an AST node `n`
+       * top-down from a context, this module exposes the predicate `inferType`, which
+       * restricts type information to only flow top-down into `n` when `n` has an
+       * explicit unknown type.
+       */
+      module TopDownTyping<inferTypeTopDownSig/2 inferTypeTopDown> {
+        pragma[nomagic]
+        private Type inferTypeTopDown(AstNode n, TypePath prefix, TypePath path) {
+          result = inferTypeTopDown(n, path) and
+          hasUnknownType(n) and
+          prefix = path.getAPrefix()
+        }
+
+        pragma[nomagic]
+        Type inferType(AstNode n, TypePath path) {
+          exists(TypePath prefix |
+            result = inferTypeTopDown(n, prefix, path) and
+            hasUnknownTypeAt(n, prefix)
+          )
+        }
+      }
+
       signature Type inferCallTypeSig(AstNode n, TypePosition pos, TypePath path);
 
       /**