wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -1858,6 +1858,275 @@ private module AssocFunctionResolution {
   }
 }
 
+/**
+ * A matching configuration for resolving types of function call expressions
+ * like `foo.bar(baz)` and `Foo::bar(baz)`.
+ */
+private module FunctionCallMatchingInput implements MatchingWithEnvironmentInputSig {
+  import FunctionPositionMatchingInput
+
+  private newtype TDeclaration =
+    TFunctionDeclaration(ImplOrTraitItemNodeOption i, FunctionDeclaration f) { f.isFor(i) }
+
+  final class Declaration extends TFunctionDeclaration {
+    ImplOrTraitItemNodeOption i;
+    FunctionDeclaration f;
+
+    Declaration() { this = TFunctionDeclaration(i, f) }
+
+    FunctionDeclaration getFunction() { result = f }
+
+    predicate isAssocFunction(ImplOrTraitItemNode i_, Function f_) {
+      i_ = i.asSome() and
+      f_ = f
+    }
+
+    TypeParameter getTypeParameter(TypeParameterPosition ppos) {
+      result = f.getTypeParameter(i, ppos)
+    }
+
+    Type getDeclaredType(FunctionPosition pos, TypePath path) {
+      result = f.getParameterType(i, pos, path)
+      or
+      pos.isReturn() and
+      result = f.getReturnType(i, path)
+    }
+
+    string toString() {
+      i.isNone() and result = f.toString()
+      or
+      result = f.toStringExt(i.asSome())
+    }
+
+    Location getLocation() { result = f.getLocation() }
+  }
+
+  pragma[nomagic]
+  private TypeMention getAdditionalTypeParameterConstraint(TypeParameter tp, Declaration decl) {
+    result =
+      tp.(TypeParamTypeParameter)
+          .getTypeParam()
+          .getAdditionalTypeBound(decl.getFunction(), _)
+          .getTypeRepr()
+  }
+
+  bindingset[decl]
+  TypeMention getATypeParameterConstraint(TypeParameter tp, Declaration decl) {
+    result = Input2::getATypeParameterConstraint(tp) and
+    exists(decl)
+    or
+    result = getAdditionalTypeParameterConstraint(tp, decl)
+  }
+
+  class AccessEnvironment = string;
+
+  bindingset[derefChain, borrow]
+  private AccessEnvironment encodeDerefChainBorrow(DerefChain derefChain, BorrowKind borrow) {
+    result = derefChain + ";" + borrow
+  }
+
+  bindingset[derefChainBorrow]
+  additional predicate decodeDerefChainBorrow(
+    string derefChainBorrow, DerefChain derefChain, BorrowKind borrow
+  ) {
+    exists(int i |
+      i = derefChainBorrow.indexOf(";") and
+      derefChain = derefChainBorrow.prefix(i) and
+      borrow.toString() = derefChainBorrow.suffix(i + 1)
+    )
+  }
+
+  private string noDerefChainBorrow() {
+    exists(DerefChain derefChain, BorrowKind borrow |
+      derefChain.isEmpty() and
+      borrow.isNoBorrow() and
+      result = encodeDerefChainBorrow(derefChain, borrow)
+    )
+  }
+
+  abstract class Access extends ContextTyping::ContextTypedCallCand {
+    abstract AstNode getNodeAt(FunctionPosition pos);
+
+    bindingset[derefChainBorrow]
+    abstract Type getInferredType(string derefChainBorrow, FunctionPosition pos, TypePath path);
+
+    abstract Declaration getTarget(string derefChainBorrow);
+
+    /**
+     * Holds if the return type of this call at `path` may have to be inferred
+     * from the context.
+     */
+    abstract predicate hasUnknownTypeAt(string derefChainBorrow, FunctionPosition pos, TypePath path);
+  }
+
+  private class AssocFunctionCallAccess extends Access instanceof AssocFunctionResolution::AssocFunctionCall
+  {
+    AssocFunctionCallAccess() {
+      // handled in the `OperationMatchingInput` module
+      not this instanceof Operation
+    }
+
+    pragma[nomagic]
+    override Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
+      result =
+        this.(MethodCallExpr)
+            .getGenericArgList()
+            .getTypeArg(apos.asMethodTypeArgumentPosition())
+            .(TypeMention)
+            .getTypeAt(path)
+      or
+      result = getCallExprTypeArgument(this, apos, path)
+    }
+
+    override AstNode getNodeAt(FunctionPosition pos) {
+      result = AssocFunctionResolution::AssocFunctionCall.super.getNodeAt(pos)
+    }
+
+    pragma[nomagic]
+    private Type getInferredSelfType(FunctionPosition pos, string derefChainBorrow, TypePath path) {
+      exists(DerefChain derefChain, BorrowKind borrow |
+        result = super.getSelfTypeAt(pos, derefChain, borrow, path) and
+        derefChainBorrow = encodeDerefChainBorrow(derefChain, borrow) and
+        super.hasReceiverAtPos(pos)
+      )
+    }
+
+    pragma[nomagic]
+    private Type getInferredNonSelfType(FunctionPosition pos, TypePath path) {
+      if
+        // index expression `x[i]` desugars to `*x.index(i)`, so we must account for
+        // the implicit deref
+        pos.isReturn() and
+        this instanceof IndexExpr
+      then
+        path.isEmpty() and
+        result instanceof RefType
+        or
+        exists(TypePath suffix |
+          result = super.getTypeAt(pos, suffix) and
+          path = TypePath::cons(getRefTypeParameter(_), suffix)
+        )
+      else (
+        not super.hasReceiverAtPos(pos) and
+        result = super.getTypeAt(pos, path)
+      )
+    }
+
+    bindingset[derefChainBorrow]
+    override Type getInferredType(string derefChainBorrow, FunctionPosition pos, TypePath path) {
+      result = this.getInferredSelfType(pos, derefChainBorrow, path)
+      or
+      result = this.getInferredNonSelfType(pos, path)
+    }
+
+    private AssocFunctionDeclaration getTarget(ImplOrTraitItemNode i, string derefChainBorrow) {
+      exists(DerefChain derefChain, BorrowKind borrow |
+        derefChainBorrow = encodeDerefChainBorrow(derefChain, borrow) and
+        result = super.resolveCallTarget(i, _, derefChain, borrow) // mutual recursion; resolving method calls requires resolving types and vice versa
+      )
+    }
+
+    override Declaration getTarget(string derefChainBorrow) {
+      exists(ImplOrTraitItemNode i | result.isAssocFunction(i, this.getTarget(i, derefChainBorrow)))
+    }
+
+    pragma[nomagic]
+    override predicate hasUnknownTypeAt(string derefChainBorrow, FunctionPosition pos, TypePath path) {
+      exists(ImplOrTraitItemNode i |
+        this.hasUnknownTypeAt(i, this.getTarget(i, derefChainBorrow), pos, path)
+      )
+      or
+      derefChainBorrow = noDerefChainBorrow() and
+      forex(ImplOrTraitItemNode i, Function f |
+        f = CallExprImpl::getResolvedFunction(this) and
+        f = i.getAnAssocItem()
+      |
+        this.hasUnknownTypeAt(i, f, pos, path)
+      )
+    }
+  }
+
+  private class NonAssocFunctionCallAccess extends Access instanceof NonAssocCallExpr,
+    CallExprImpl::CallExprCall
+  {
+    pragma[nomagic]
+    override Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
+      result = NonAssocCallExpr.super.getTypeArgument(apos, path)
+    }
+
+    override AstNode getNodeAt(FunctionPosition pos) {
+      result = NonAssocCallExpr.super.getNodeAt(pos)
+    }
+
+    pragma[nomagic]
+    private Type getInferredType(FunctionPosition pos, TypePath path) {
+      result = super.getInferredType(pos, path)
+    }
+
+    bindingset[derefChainBorrow]
+    override Type getInferredType(string derefChainBorrow, FunctionPosition pos, TypePath path) {
+      exists(derefChainBorrow) and
+      result = this.getInferredType(pos, path)
+    }
+
+    pragma[nomagic]
+    private Declaration getTarget() {
+      result =
+        TFunctionDeclaration(ImplOrTraitItemNodeOption::none_(),
+          super.resolveCallTargetViaPathResolution())
+    }
+
+    override Declaration getTarget(string derefChainBorrow) {
+      result = this.getTarget() and
+      derefChainBorrow = noDerefChainBorrow()
+    }
+
+    pragma[nomagic]
+    override predicate hasUnknownTypeAt(string derefChainBorrow, FunctionPosition pos, TypePath path) {
+      derefChainBorrow = noDerefChainBorrow() and
+      exists(FunctionDeclaration f, TypeParameter tp |
+        f = super.resolveCallTargetViaPathResolution() and
+        pos.isReturn() and
+        tp = f.getReturnType(_, path) and
+        not tp = f.getParameterType(_, _, _) and
+        // check that no explicit type arguments have been supplied for `tp`
+        not exists(TypeArgumentPosition tapos |
+          this.hasTypeArgument(tapos) and
+          TTypeParamTypeParameter(tapos.asTypeParam()) = tp
+        )
+      )
+    }
+  }
+}
+
+private module FunctionCallMatching = MatchingWithEnvironment<FunctionCallMatchingInput>;
+
+pragma[nomagic]
+private Type inferFunctionCallType0(
+  FunctionCallMatchingInput::Access call, FunctionPosition pos, AstNode n, DerefChain derefChain,
+  BorrowKind borrow, TypePath path
+) {
+  exists(TypePath path0 |
+    n = call.getNodeAt(pos) and
+    exists(string derefChainBorrow |
+      FunctionCallMatchingInput::decodeDerefChainBorrow(derefChainBorrow, derefChain, borrow)
+    |
+      result = FunctionCallMatching::inferAccessType(call, derefChainBorrow, pos, path0)
+      or
+      call.hasUnknownTypeAt(derefChainBorrow, pos, path0) and
+      result = TUnknownType()
+    )
+  |
+    if
+      // index expression `x[i]` desugars to `*x.index(i)`, so we must account for
+      // the implicit deref
+      pos.isReturn() and
+      call instanceof IndexExpr
+    then path0.isCons(getRefTypeParameter(_), path)
+    else path = path0
+  )
+}
+
 pragma[nomagic]
 private Type getFieldExprLookupType(FieldExpr fe, string name, DerefChain derefChain) {
   exists(TypePath path |