wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -244,10 +244,12 @@ module Consistency {
   }
 }
 
+/** A method, that is, a function with a `self` parameter. */
 private class Method extends Function {
   Method() { this.hasSelfParam() }
 }
 
+/** A function without a `self` parameter. */
 private class AssocFunction extends Function {
   AssocFunction() { not this.hasSelfParam() }
 }
@@ -871,17 +873,133 @@ private module ArgIsInstantiationOf<
     }
   }
 
-  predicate argIsInstanceOf(Arg arg, ImplOrTraitItemNode i, FunctionType constraint) {
+  predicate argIsInstantiationOf(Arg arg, ImplOrTraitItemNode i, FunctionType constraint) {
     IsInstantiationOf<ArgSubst, FunctionType, IsInstantiationOfInput>::isInstantiationOf(arg, i,
       constraint)
   }
 
-  predicate argIsNotInstanceOf(Arg arg, ImplOrTraitItemNode i, FunctionType constraint) {
+  predicate argIsNotInstantiationOf(Arg arg, ImplOrTraitItemNode i, FunctionType constraint) {
     IsInstantiationOf<ArgSubst, FunctionType, IsInstantiationOfInput>::isNotInstantiationOf(arg, i,
       constraint)
   }
 }
 
+signature module ArgsAreInstantiationsOfInputSig {
+  predicate toCheck(ImplOrTraitItemNode i, Function f, FunctionTypePosition pos, FunctionType t);
+
+  class Call {
+    string toString();
+
+    Location getLocation();
+
+    Type getArgType(FunctionTypePosition pos, TypePath path);
+
+    predicate hasTargetCand(ImplOrTraitItemNode i, Function f);
+  }
+}
+
+/**
+ * A wrapper around `IsInstantiationOf` which ensures to substitute in lookup
+ * traits when checking whether argument types are instantiations of function
+ * types.
+ */
+private module ArgsAreInstantiationsOf<ArgsAreInstantiationsOfInputSig Input> {
+  pragma[nomagic]
+  private predicate toCheckRanked(
+    ImplOrTraitItemNode i, Function f, FunctionTypePosition pos, int rnk
+  ) {
+    Input::toCheck(i, f, pos, _) and
+    pos =
+      rank[rnk + 1](FunctionTypePosition pos0, int j |
+        Input::toCheck(i, f, pos0, _) and
+        (
+          j = pos0.asPositional()
+          or
+          pos0.isSelf() and j = -1
+          or
+          pos0.isReturn() and j = -2
+        )
+      |
+        pos0 order by j
+      )
+  }
+
+  private newtype TCallAndPos =
+    MkCallAndPos(Input::Call call, FunctionTypePosition pos) {
+      exists(call.getArgType(pos, _))
+      // exists(ImplOrTraitItemNode i, Function f |
+      //   Input::toCheck(i, f, pos, _) and
+      //   call.hasTargetCand(i, f)
+      // )
+    }
+
+  /** An associated function call tagged with a position. */
+  private class CallAndPos extends MkCallAndPos {
+    Input::Call call;
+    FunctionTypePosition pos;
+
+    CallAndPos() { this = MkCallAndPos(call, pos) }
+
+    Input::Call getCall() { result = call }
+
+    FunctionTypePosition getPos() { result = pos }
+
+    Location getLocation() { result = call.getLocation() }
+
+    Type getTypeAt(TypePath path) { result = call.getArgType(pos, path) }
+
+    string toString() { result = call.toString() + " [arg " + pos + "]" }
+  }
+
+  private module ArgIsIsInstantiationOfInput implements
+    IsInstantiationOfInputSig<CallAndPos, FunctionType>
+  {
+    pragma[nomagic]
+    private predicate potentialInstantiationOf0(
+      CallAndPos cp, Input::Call call, FunctionTypePosition pos, int rnk, Function f,
+      TypeAbstraction abs, FunctionType constraint
+    ) {
+      cp = MkCallAndPos(call, pos) and
+      call.hasTargetCand(abs, f) and
+      toCheckRanked(abs, f, pos, rnk) and
+      Input::toCheck(abs, f, pos, constraint)
+    }
+
+    pragma[nomagic]
+    predicate potentialInstantiationOf(CallAndPos cp, TypeAbstraction abs, FunctionType constraint) {
+      exists(Input::Call call, FunctionTypePosition pos, int rnk, Function f |
+        potentialInstantiationOf0(cp, call, pos, rnk, f, abs, constraint)
+      |
+        rnk = 0
+        or
+        argsAreInstantiationsOfFromIndex(call, abs, f, rnk - 1)
+      )
+    }
+
+    predicate relevantTypeMention(FunctionType constraint) { Input::toCheck(_, _, _, constraint) }
+  }
+
+  pragma[nomagic]
+  private predicate argsAreInstantiationsOfFromIndex(
+    Input::Call call, ImplOrTraitItemNode i, Function f, int rnk
+  ) {
+    exists(FunctionTypePosition pos |
+      ArgIsInstantiationOf<CallAndPos, ArgIsIsInstantiationOfInput>::argIsInstantiationOf(MkCallAndPos(call,
+          pos), i, _) and
+      call.hasTargetCand(i, f) and
+      toCheckRanked(i, f, pos, rnk)
+    )
+  }
+
+  pragma[nomagic]
+  predicate argsAreInstantiationsOf(Input::Call call, ImplOrTraitItemNode i, Function f) {
+    exists(int rnk |
+      argsAreInstantiationsOfFromIndex(call, i, f, rnk) and
+      rnk = max(int r | toCheckRanked(i, f, _, r))
+    )
+  }
+}
+
 /**
  * Holds if the type path `path` pointing to `type` is stripped of any leading
  * complex root type allowed for `self` parameters, such as `&`, `Box`, `Rc`,
@@ -1167,7 +1285,7 @@ private module MethodResolution {
      */
     pragma[nomagic]
     private predicate hasIncompatibleTarget(ImplOrTraitItemNode i, string derefChainBorrow) {
-      ArgIsInstantiationOf<MethodCallCand, ReceiverIsInstanceOfSelfParamInput>::argIsNotInstanceOf(MkMethodCallCand(this,
+      ArgIsInstantiationOf<MethodCallCand, ReceiverIsInstanceOfSelfParamInput>::argIsNotInstantiationOf(MkMethodCallCand(this,
           derefChainBorrow), i, _)
       or
       IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, TypeQualifierIsInstanceOfImplSelfInput>::isNotInstantiationOf(this,
@@ -1455,7 +1573,7 @@ private module MethodResolution {
      */
     pragma[nomagic]
     private predicate hasIncompatibleInherentTarget(Impl impl) {
-      ArgIsInstantiationOf<MethodCallCand, ReceiverIsNotInstanceOfInherentSelfParamInput>::argIsNotInstanceOf(this,
+      ArgIsInstantiationOf<MethodCallCand, ReceiverIsNotInstanceOfInherentSelfParamInput>::argIsNotInstantiationOf(this,
         impl, _)
     }
 
@@ -1483,9 +1601,9 @@ private module MethodResolution {
     }
 
     pragma[nomagic]
-    private predicate argIsInstanceOf(ImplOrTraitItemNode i, string name, int arity) {
+    private predicate argIsInstantiationOf(ImplOrTraitItemNode i, string name, int arity) {
       (
-        ArgIsInstantiationOf<MethodCallCand, ReceiverIsInstanceOfSelfParamInput>::argIsInstanceOf(this,
+        ArgIsInstantiationOf<MethodCallCand, ReceiverIsInstanceOfSelfParamInput>::argIsInstantiationOf(this,
           i, _)
         or
         this.typeQualifierIsInstanceOf(i)
@@ -1494,27 +1612,13 @@ private module MethodResolution {
     }
 
     pragma[nomagic]
-    private Method resolveCallTargetCand(ImplOrTraitItemNode i) {
+    Method resolveCallTargetCand(ImplOrTraitItemNode i) {
       exists(string name, int arity |
-        this.argIsInstanceOf(i, name, arity) and
+        this.argIsInstantiationOf(i, name, arity) and
         result = getMethodSuccessor(i, name, arity)
       )
     }
 
-    pragma[nomagic]
-    private Type inferPositionalArgumentType(FunctionTypePosition pos, TypePath path) {
-      pos.isPositional() and
-      result = substituteLookupTraits(inferType(mc_.getArgument(pos.asArgumentPosition()), path))
-    }
-
-    pragma[nomagic]
-    private Method resolveAmbigousCallTargetCand(FunctionTypePosition pos, TypePath path, Type type) {
-      exists(ImplOrTraitItemNode i |
-        result = this.resolveCallTargetCand(i) and
-        FunctionOverloading::functionResolutionDependsOnArgument(i, result, pos, path, type)
-      )
-    }
-
     /** Gets a method that matches this method call. */
     pragma[nomagic]
     Method resolveCallTarget() {
@@ -1526,10 +1630,7 @@ private module MethodResolution {
         )
       )
       or
-      exists(FunctionTypePosition pos, TypePath path, Type type |
-        result = this.resolveAmbigousCallTargetCand(pos, path, type) and
-        type = this.inferPositionalArgumentType(pos, path)
-      )
+      ArgsAreInstantiationsOf<ArgsAreInstantiationsOfInput>::argsAreInstantiationsOf(this, _, result)
     }
 
     string toString() { result = mc_.toString() + " [" + derefChainBorrow + "]" }
@@ -1650,6 +1751,27 @@ private module MethodResolution {
       methodInfo(_, _, _, _, constraint, _, _)
     }
   }
+
+  private module ArgsAreInstantiationsOfInput implements ArgsAreInstantiationsOfInputSig {
+    predicate toCheck(ImplOrTraitItemNode i, Function f, FunctionTypePosition pos, FunctionType t) {
+      exists(TypePath path, Type t0 |
+        pos.isPositional() and
+        FunctionOverloading::functionResolutionDependsOnArgument(i, f, pos, path, t0) and
+        t.appliesTo(f, pos, i) and
+        not t0 instanceof TypeParameter
+      )
+    }
+
+    class Call extends MethodCallCand {
+      Type getArgType(FunctionTypePosition pos, TypePath path) {
+        result = inferType(mc_.getNodeAt(pos), path)
+      }
+
+      predicate hasTargetCand(ImplOrTraitItemNode i, Function f) {
+        f = this.resolveCallTargetCand(i)
+      }
+    }
+  }
 }
 
 /**
@@ -1949,7 +2071,7 @@ private module AssocFunctionResolution {
    * A configuration for matching the type of an argument against the type of
    * a parameter that mentions a satisfied blanket type parameter.
    */
-  private module ArgIsInstanceOfBlanketParamInput implements
+  private module ArgIsInstantiationOfBlanketParamInput implements
     IsInstantiationOfInputSig<AssocFunctionCallAndPos, FunctionType>
   {
     pragma[nomagic]
@@ -1977,6 +2099,7 @@ private module AssocFunctionResolution {
       forall(Function f | f = CallExprImpl::getResolvedFunction(this) | f instanceof AssocFunction)
     }
 
+    pragma[nomagic]
     predicate hasNameAndArity(string name, int arity) {
       name = CallExprImpl::getFunctionPath(this).getText() and
       arity = this.getArgList().getNumberOfArgs()
@@ -1987,32 +2110,31 @@ private module AssocFunctionResolution {
      * if any.
      */
     private ItemNode getPathResolutionResolved() {
-      result = CallExprImpl::getResolvedFunction(this) and
-      not result.(Function).hasSelfParam()
+      result = CallExprImpl::getResolvedFunction(this)
     }
 
     /**
-     * Gets the blanket function that this call resolves to, if any.
+     * Gets the blanket function that this call may resolve to, if any.
      */
     pragma[nomagic]
-    private ItemNode resolveCallTargetCand() {
-      not this.(Call).hasTrait() and
-      result = this.getPathResolutionResolved()
-      or
-      exists(ImplItemNode impl, string name |
-        this.hasNameAndArity(name, _) and
-        ArgIsInstantiationOf<AssocFunctionCallAndPos, ArgIsInstanceOfBlanketParamInput>::argIsInstanceOf(MkAssocFunctionCallAndPos(this,
+    private AssocFunction resolveCallTargetBlanketCand(ImplItemNode impl) {
+      exists(string name |
+        this.hasNameAndArity(pragma[only_bind_into](name), _) and
+        ArgIsInstantiationOf<AssocFunctionCallAndPos, ArgIsInstantiationOfBlanketParamInput>::argIsInstantiationOf(MkAssocFunctionCallAndPos(this,
             _), impl, _) and
-        result = impl.getASuccessor(name)
+        result = impl.getASuccessor(pragma[only_bind_into](name))
       )
     }
 
     pragma[nomagic]
-    private AssocFunction resolveAmbigousCallTargetCand(
-      FunctionTypePosition pos, TypePath path, Type type
-    ) {
-      result = this.resolveCallTargetCand() and
-      functionResolutionDependsOnArgument(_, result, pos, path, type)
+    AssocFunction foo(ImplItemNode impl) {
+      (
+        not this.(Call).hasTrait() and
+        result = this.getPathResolutionResolved() and
+        result = impl.getASuccessor(_)
+        or
+        result = this.resolveCallTargetBlanketCand(impl)
+      )
     }
 
     AstNode getNodeAt(FunctionTypePosition pos) {
@@ -2030,7 +2152,7 @@ private module AssocFunctionResolution {
     }
 
     pragma[nomagic]
-    private predicate hasTraitResolved(
+    predicate hasTraitResolved(
       TraitItemNode trait, AssocFunction resolved, FunctionTypePosition pos, TypePath path,
       Type type
     ) {
@@ -2041,19 +2163,48 @@ private module AssocFunctionResolution {
 
     pragma[nomagic]
     ItemNode resolveCallTarget() {
-      result = this.resolveCallTargetCand() and
+      (
+        not this.(Call).hasTrait() and
+        result = this.getPathResolutionResolved()
+        or
+        result = this.resolveCallTargetBlanketCand(_)
+      ) and
       not functionResolutionDependsOnArgument(_, result, _, _, _)
       or
-      exists(FunctionTypePosition pos, TypePath path, Type type |
-        result = this.resolveAmbigousCallTargetCand(pos, path, type) and
-        type = this.inferArgumentType(pos, path)
+      ArgsAreInstantiationsOf<ArgsAreInstantiationsOfInput>::argsAreInstantiationsOf(this, _, result)
+    }
+  }
+
+  private module ArgsAreInstantiationsOfInput implements ArgsAreInstantiationsOfInputSig {
+    predicate toCheck(ImplOrTraitItemNode i, Function f, FunctionTypePosition pos, FunctionType t) {
+      // FunctionOverloading::functionResolutionDependsOnArgument(i, f, pos, _, _) and
+      // t.appliesTo(f, pos, i)
+      exists(Type t0 |
+        FunctionOverloading::functionResolutionDependsOnArgument(i, f, pos, _, t0) and
+        t.appliesTo(f, pos, i) and
+        not t0 instanceof TypeParameter
+      )
+      or
+      traitFunctionDependsOnArgument(_, _, pos, f, _, _) and
+      t.appliesTo(f, pos, i)
+    }
+
+    class Call extends AssocFunctionCall {
+      Type getArgType(FunctionTypePosition pos, TypePath path) {
+        result = inferType(this.getNodeAt(pos), path)
+      }
+
+      predicate hasTargetCand(ImplOrTraitItemNode i, Function f) {
+        f = this.foo(i)
         or
-        // E.g. `Default::default()`
-        exists(TraitItemNode trait, AssocFunction resolved |
-          this.hasTraitResolved(trait, resolved, pos, path, type) and
-          traitFunctionDependsOnArgument(trait, resolved, pos, result, path, type)
+        exists(FunctionTypePosition pos |
+          exists(TraitItemNode trait, AssocFunction resolved |
+            this.hasTraitResolved(trait, resolved, pos, _, _) and
+            traitFunctionDependsOnArgument(trait, resolved, pos, f, _, _) and
+            f = i.getASuccessor(_)
+          )
         )
-      )
+      }
     }
   }
 }