wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -467,7 +467,7 @@ pragma[nomagic]
 private Type inferStructExprType(AstNode n, TypePath path) {
   exists(StructExprMatchingInput::Access a, StructExprMatchingInput::AccessPosition apos |
     n = a.getNodeAt(apos) and
-    result = StructExprMatching::inferAccessType(a, apos, path)
+    result = StructExprMatching::inferAccessType(a, apos, path, _)
   )
 }
 
@@ -516,7 +516,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  abstract class Declaration extends AstNode {
+  abstract additional class Decl extends AstNode {
     abstract TypeParameter getTypeParameter(TypeParameterPosition ppos);
 
     pragma[nomagic]
@@ -532,7 +532,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  private class TupleStructDecl extends Declaration, Struct {
+  private class TupleStructDecl extends Decl, Struct {
     TupleStructDecl() { this.isTuple() }
 
     override TypeParameter getTypeParameter(TypeParameterPosition ppos) {
@@ -555,7 +555,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  private class TupleVariantDecl extends Declaration, Variant {
+  private class TupleVariantDecl extends Decl, Variant {
     TupleVariantDecl() { this.isTuple() }
 
     override TypeParameter getTypeParameter(TypeParameterPosition ppos) {
@@ -580,7 +580,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
-  private class FunctionDecl extends Declaration, Function {
+  private class FunctionDecl extends Decl, Function {
     override TypeParameter getTypeParameter(TypeParameterPosition ppos) {
       typeParamMatchPosition(this.getGenericParamList().getATypeParam(), result, ppos)
       or
@@ -632,6 +632,33 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
   }
 
+  additional newtype TDeclaration = additional MkDeclaration(Decl decl, Boolean isDeref)
+
+  class Declaration extends MkDeclaration {
+    private Decl decl;
+    private boolean isDeref;
+
+    Declaration() { this = MkDeclaration(decl, isDeref) }
+
+    Decl getDecl() { result = decl }
+
+    TypeParameter getTypeParameter(TypeParameterPosition ppos) {
+      result = this.getDecl().getTypeParameter(ppos)
+    }
+
+    Type getDeclaredType(DeclarationPosition dpos, TypePath path) {
+      result = this.getDecl().getDeclaredType(dpos, path)
+    }
+
+    Type getParameterType(DeclarationPosition dpos, TypePath path) {
+      result = this.getDecl().getParameterType(dpos, path)
+    }
+
+    string toString() { result = this.getDecl().toString() }
+
+    Location getLocation() { result = this.getDecl().getLocation() }
+  }
+
   private predicate argPos(CallExprBase call, Expr e, int pos, boolean isMethodCall) {
     exists(ArgList al |
       e = al.getArg(pos) and
@@ -706,9 +733,12 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
 
     override Declaration getTarget() {
-      result = CallExprImpl::getResolvedFunction(this)
+      result = MkDeclaration(CallExprImpl::getResolvedFunction(this), false)
       or
-      result = inferMethodCallTarget(this) // mutual recursion; resolving method calls requires resolving types and vice versa
+      exists(Function f, boolean isDeref |
+        f = inferMethodCallTarget(this, isDeref) and // mutual recursion; resolving method calls requires resolving types and vice versa
+        result = MkDeclaration(f, isDeref)
+      )
     }
   }
 
@@ -733,7 +763,10 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     }
 
     override Declaration getTarget() {
-      result = inferMethodCallTarget(this) // mutual recursion; resolving method calls requires resolving types and vice versa
+      exists(Function f, boolean isDeref |
+        f = inferMethodCallTarget(this, isDeref) and // mutual recursion; resolving method calls requires resolving types and vice versa
+        result = MkDeclaration(f, isDeref)
+      )
     }
   }
 
@@ -816,13 +849,16 @@ pragma[nomagic]
 private Type inferCallExprBaseType(AstNode n, TypePath path) {
   exists(
     CallExprBaseMatchingInput::Access a, CallExprBaseMatchingInput::AccessPosition apos,
-    TypePath path0
+    TypePath path0, CallExprBaseMatchingInput::Decl decl, boolean isDeref
   |
     n = a.getNodeAt(apos) and
-    result = CallExprBaseMatching::inferAccessType(a, apos, path0)
+    result =
+      CallExprBaseMatching::inferAccessType(a, apos, path0,
+        CallExprBaseMatchingInput::MkDeclaration(decl, isDeref))
   |
     if apos.isSelf()
     then
+      isDeref = false and
       exists(Type receiverType | receiverType = inferType(n) |
         if receiverType = TRefType()
         then
@@ -960,7 +996,7 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
     FieldExprMatchingInput::Access a, FieldExprMatchingInput::AccessPosition apos, TypePath path0
   |
     n = a.getNodeAt(apos) and
-    result = FieldExprMatching::inferAccessType(a, apos, path0)
+    result = FieldExprMatching::inferAccessType(a, apos, path0, _)
   |
     if apos.isSelf()
     then
@@ -1115,7 +1151,7 @@ pragma[nomagic]
 private Type inferAwaitExprType(AstNode n, TypePath path) {
   exists(AwaitExprMatchingInput::Access a, AwaitExprMatchingInput::AccessPosition apos |
     n = a.getNodeAt(apos) and
-    result = AwaitExprMatching::inferAccessType(a, apos, path)
+    result = AwaitExprMatching::inferAccessType(a, apos, path, _)
   )
   or
   // This case is needed for `async` functions and blocks, where we assign
@@ -1141,7 +1177,7 @@ private module MethodCall {
     Trait getTrait() { none() }
 
     /** Gets the type of the receiver of the method call at `path`. */
-    abstract Type getTypeAt(TypePath path);
+    abstract Type getTypeAt(TypePath path, boolean isDeref);
   }
 
   final class MethodCall = MethodCallImpl;
@@ -1152,18 +1188,21 @@ private module MethodCall {
     override int getArity() { result = super.getArgList().getNumberOfArgs() }
 
     pragma[nomagic]
-    override Type getTypeAt(TypePath path) {
-      exists(TypePath path0, Type t0 |
+    override Type getTypeAt(TypePath path, boolean isDeref) {
+      exists(TypePath path0, Type t0, boolean isDeref0 |
         t0 = inferType(super.getReceiver(), path0) and
         (
-          path0.isCons(TRefTypeParameter(), path)
+          path0.isCons(TRefTypeParameter(), path) and
+          isDeref0 = true
           or
           not path0.isCons(TRefTypeParameter(), _) and
           not (path0.isEmpty() and result = TRefType()) and
-          path = path0
+          path = path0 and
+          isDeref0 = false
         )
       |
-        result = t0
+        result = t0 and
+        isDeref = isDeref0
         or
         // We do not yet model the `Deref` trait, so we hard-code the fact that
         // `String` dereferences to `str` here. This allows us e.g. to resolve
@@ -1173,7 +1212,8 @@ private module MethodCall {
         // See also https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.autoref-deref
         path.isEmpty() and
         t0.(StructType).asItemNode().(Struct).getCanonicalPath() = "alloc::string::String" and
-        result.(StructType).asItemNode() instanceof Builtins::Str
+        result.(StructType).asItemNode() instanceof Builtins::Str and
+        isDeref = true
       )
     }
   }
@@ -1202,7 +1242,10 @@ private module MethodCall {
     override Trait getTrait() { result = trait }
 
     pragma[nomagic]
-    override Type getTypeAt(TypePath path) { result = inferType(receiver, path) }
+    override Type getTypeAt(TypePath path, boolean isDeref) {
+      result = inferType(receiver, path) and
+      isDeref = false
+    }
   }
 
   private class OperationMethodCall extends MethodCallImpl instanceof Operation {
@@ -1218,10 +1261,13 @@ private module MethodCall {
     override Trait getTrait() { result = trait }
 
     pragma[nomagic]
-    override Type getTypeAt(TypePath path) {
-      result = inferType(this.(BinaryExpr).getLhs(), path)
-      or
-      result = inferType(this.(PrefixExpr).getExpr(), path)
+    override Type getTypeAt(TypePath path, boolean isDeref) {
+      (
+        result = inferType(this.(BinaryExpr).getLhs(), path)
+        or
+        result = inferType(this.(PrefixExpr).getExpr(), path)
+      ) and
+      isDeref = false
     }
   }
 }
@@ -1251,23 +1297,51 @@ private predicate methodCandidateTrait(Type type, Trait trait, string name, int
   methodCandidate(type, name, arity, impl)
 }
 
-private module IsInstantiationOfInput implements IsInstantiationOfInputSig<MethodCall> {
+private import codeql.util.Boolean
+
+private newtype TMethodCallDeref = MkMethodCallDeref(MethodCall mc, Boolean isDeref)
+
+private class MethodCallDeref extends MkMethodCallDeref {
+  MethodCall mc;
+  boolean isDeref;
+
+  MethodCallDeref() { this = MkMethodCallDeref(mc, isDeref) }
+
+  MethodCall getMethodCall() { result = mc }
+
+  boolean isImplicitDeref() { result = isDeref }
+
+  Type getTypeAt(TypePath path) { result = mc.getTypeAt(path, isDeref) }
+
+  string toString() {
+    if isDeref = true then result = "[implicit deref] " + mc.toString() else result = mc.toString()
+  }
+
+  Location getLocation() { result = mc.getLocation() }
+}
+
+private module IsInstantiationOfInput implements IsInstantiationOfInputSig<MethodCallDeref> {
   pragma[nomagic]
-  private predicate isMethodCall(MethodCall mc, Type rootType, string name, int arity) {
-    rootType = mc.getTypeAt(TypePath::nil()) and
-    name = mc.getMethodName() and
-    arity = mc.getArity()
+  private predicate isMethodCall(MethodCallDeref mc, Type rootType, string name, int arity) {
+    exists(MethodCall mc0, boolean isDeref |
+      mc = MkMethodCallDeref(mc0, isDeref) and
+      rootType = mc0.getTypeAt(TypePath::nil(), isDeref) and
+      name = mc0.getMethodName() and
+      arity = mc0.getArity()
+    )
   }
 
   pragma[nomagic]
-  predicate potentialInstantiationOf(MethodCall mc, TypeAbstraction impl, TypeMention constraint) {
+  predicate potentialInstantiationOf(
+    MethodCallDeref mc, TypeAbstraction impl, TypeMention constraint
+  ) {
     exists(Type rootType, string name, int arity |
       isMethodCall(mc, rootType, name, arity) and
       constraint = impl.(ImplTypeAbstraction).getSelfTy()
     |
-      methodCandidateTrait(rootType, mc.getTrait(), name, arity, impl)
+      methodCandidateTrait(rootType, mc.getMethodCall().getTrait(), name, arity, impl)
       or
-      not exists(mc.getTrait()) and
+      not exists(mc.getMethodCall().getTrait()) and
       methodCandidate(rootType, name, arity, impl)
     )
   }
@@ -1294,10 +1368,10 @@ private Function getTypeParameterMethod(TypeParameter tp, string name) {
 }
 
 /** Gets a method from an `impl` block that matches the method call `mc`. */
-private Function getMethodFromImpl(MethodCall mc) {
+private Function getMethodFromImpl(MethodCallDeref mc) {
   exists(Impl impl |
-    IsInstantiationOf<MethodCall, IsInstantiationOfInput>::isInstantiationOf(mc, impl, _) and
-    result = getMethodSuccessor(impl, mc.getMethodName())
+    IsInstantiationOf<MethodCallDeref, IsInstantiationOfInput>::isInstantiationOf(mc, impl, _) and
+    result = getMethodSuccessor(impl, mc.getMethodCall().getMethodName())
   )
 }
 
@@ -1311,16 +1385,16 @@ private Function getTraitMethod(ImplTraitReturnType trait, string name) {
  * Gets a method that the method call `mc` resolves to based on type inference,
  * if any.
  */
-private Function inferMethodCallTarget(MethodCall mc) {
+private Function inferMethodCallTarget(MethodCall mc, boolean isDeref) {
   // The method comes from an `impl` block targeting the type of the receiver.
-  result = getMethodFromImpl(mc)
+  result = getMethodFromImpl(MkMethodCallDeref(mc, isDeref))
   or
   // The type of the receiver is a type parameter and the method comes from a
   // trait bound on the type parameter.
-  result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
+  result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil(), isDeref), mc.getMethodName())
   or
   // The type of the receiver is an `impl Trait` type.
-  result = getTraitMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
+  result = getTraitMethod(mc.getTypeAt(TypePath::nil(), isDeref), mc.getMethodName())
 }
 
 cached
@@ -1334,7 +1408,7 @@ private module Cached {
       apos.isSelf() and
       receiver = a.getNodeAt(apos) and
       inferType(receiver) = TRefType() and
-      CallExprBaseMatching::inferAccessType(a, apos, TypePath::nil()) != TRefType()
+      CallExprBaseMatching::inferAccessType(a, apos, TypePath::nil(), _) != TRefType()
     )
   }
 
@@ -1344,7 +1418,7 @@ private module Cached {
     exists(CallExprBaseMatchingInput::Access a, CallExprBaseMatchingInput::AccessPosition apos |
       apos.isSelf() and
       receiver = a.getNodeAt(apos) and
-      CallExprBaseMatching::inferAccessType(a, apos, TypePath::nil()) = TRefType() and
+      CallExprBaseMatching::inferAccessType(a, apos, TypePath::nil(), _) = TRefType() and
       inferType(receiver) != TRefType()
     )
   }
@@ -1357,25 +1431,25 @@ private module Cached {
     f = any(Impl impl | impl.hasTrait()).(ImplItemNode).getAnAssocItem()
   }
 
-  private Function resolveMethodCallTargetFrom(MethodCall mc, boolean fromSource) {
-    result = inferMethodCallTarget(mc) and
+  private Function resolveMethodCallTargetFrom(MethodCall mc, boolean fromSource, boolean isDeref) {
+    result = inferMethodCallTarget(mc, isDeref) and
     (if result.fromSource() then fromSource = true else fromSource = false) and
     (
       // prioritize inherent implementation methods first
       isInherentImplFunction(result)
       or
-      not isInherentImplFunction(inferMethodCallTarget(mc)) and
+      not isInherentImplFunction(inferMethodCallTarget(mc, _)) and
       (
         // then trait implementation methods
         isTraitImplFunction(result)
         or
-        not isTraitImplFunction(inferMethodCallTarget(mc)) and
+        not isTraitImplFunction(inferMethodCallTarget(mc, _)) and
         (
           // then trait methods with default implementations
           result.hasBody()
           or
           // and finally trait methods without default implementations
-          not inferMethodCallTarget(mc).hasBody()
+          not inferMethodCallTarget(mc, _).hasBody()
         )
       )
     )
@@ -1386,10 +1460,10 @@ private module Cached {
   Function resolveMethodCallTarget(MethodCall mc) {
     // Functions in source code also gets extracted as library code, due to
     // this duplication we prioritize functions from source code.
-    result = resolveMethodCallTargetFrom(mc, true)
+    result = resolveMethodCallTargetFrom(mc, true, _)
     or
-    not exists(resolveMethodCallTargetFrom(mc, true)) and
-    result = resolveMethodCallTargetFrom(mc, false)
+    not exists(resolveMethodCallTargetFrom(mc, true, _)) and
+    result = resolveMethodCallTargetFrom(mc, false, _)
   }
 
   pragma[inline]

rust/ql/test/library-tests/type-inference/type-inference.expected

@@ -1390,14 +1390,11 @@ inferType
 | main.rs:1109:26:1109:27 | x7 | T | file://:0:0:0:0 | & |
 | main.rs:1109:26:1109:27 | x7 | T.&T | main.rs:1060:5:1061:14 | S2 |
 | main.rs:1111:13:1111:14 | x9 |  | {EXTERNAL LOCATION} | String |
-| main.rs:1111:13:1111:14 | x9 |  | {EXTERNAL LOCATION} | str |
 | main.rs:1111:27:1111:33 | "Hello" |  | {EXTERNAL LOCATION} | str |
 | main.rs:1111:27:1111:45 | "Hello".to_string() |  | {EXTERNAL LOCATION} | String |
-| main.rs:1111:27:1111:45 | "Hello".to_string() |  | {EXTERNAL LOCATION} | str |
 | main.rs:1114:13:1114:13 | u |  | {EXTERNAL LOCATION} | Result |
 | main.rs:1114:13:1114:13 | u | T | {EXTERNAL LOCATION} | u32 |
 | main.rs:1114:17:1114:18 | x9 |  | {EXTERNAL LOCATION} | String |
-| main.rs:1114:17:1114:18 | x9 |  | {EXTERNAL LOCATION} | str |
 | main.rs:1114:17:1114:33 | x9.parse() |  | {EXTERNAL LOCATION} | Result |
 | main.rs:1114:17:1114:33 | x9.parse() | T | {EXTERNAL LOCATION} | u32 |
 | main.rs:1121:16:1121:20 | SelfParam |  | file://:0:0:0:0 | & |