WIP: Support non-universal impl blocks

Author: paldepind

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -27,10 +27,6 @@ newtype TType =
  * types, such as traits and implementation blocks.
  */
 abstract class Type extends TType {
-  /** Gets the method `name` belonging to this type, if any. */
-  pragma[nomagic]
-  abstract Function getMethod(string name);
-
   /** Gets the struct field `name` belonging to this type, if any. */
   pragma[nomagic]
   abstract StructField getStructField(string name);
@@ -45,25 +41,6 @@ abstract class Type extends TType {
   /** Gets a type parameter of this type. */
   final TypeParameter getATypeParameter() { result = this.getTypeParameter(_) }
 
-  /**
-   * Gets an AST node that mentions a base type of this type, if any.
-   *
-   * Although Rust doesn't have traditional OOP-style inheritance, we model trait
-   * bounds and `impl` blocks as base types. Example:
-   *
-   * ```rust
-   * trait T1 {}
-   *
-   * trait T2 {}
-   *
-   * trait T3 : T1, T2 {}
-   * //    ^^ `this`
-   * //         ^^ `result`
-   * //             ^^ `result`
-   * ```
-   */
-  abstract TypeMention getABaseTypeMention();
-
   /** Gets a textual representation of this type. */
   abstract string toString();
 
@@ -73,21 +50,6 @@ abstract class Type extends TType {
 
 abstract private class StructOrEnumType extends Type {
   abstract ItemNode asItemNode();
-
-  final override Function getMethod(string name) {
-    result = this.asItemNode().getASuccessor(name) and
-    exists(ImplOrTraitItemNode impl | result = impl.getAnAssocItem() |
-      impl instanceof Trait
-      or
-      impl.(ImplItemNode).isFullyParametric()
-    )
-  }
-
-  /** Gets all of the fully parametric `impl` blocks that target this type. */
-  final override ImplMention getABaseTypeMention() {
-    this.asItemNode() = result.resolveSelfTy() and
-    result.isFullyParametric()
-  }
 }
 
 /** A struct type. */
@@ -138,8 +100,6 @@ class TraitType extends Type, TTrait {
 
   TraitType() { this = TTrait(trait) }
 
-  override Function getMethod(string name) { result = trait.(ItemNode).getASuccessor(name) }
-
   override StructField getStructField(string name) { none() }
 
   override TupleField getTupleField(int i) { none() }
@@ -151,14 +111,6 @@ class TraitType extends Type, TTrait {
       any(AssociatedTypeTypeParameter param | param.getTrait() = trait and param.getIndex() = i)
   }
 
-  pragma[nomagic]
-  private TypeReprMention getABoundMention() {
-    result = trait.getTypeBoundList().getABound().getTypeRepr()
-  }
-
-  /** Gets any of the trait bounds of this trait. */
-  override TypeMention getABaseTypeMention() { result = this.getABoundMention() }
-
   override string toString() { result = trait.toString() }
 
   override Location getLocation() { result = trait.getLocation() }
@@ -220,8 +172,6 @@ class ImplType extends Type, TImpl {
 
   ImplType() { this = TImpl(impl) }
 
-  override Function getMethod(string name) { result = impl.(ItemNode).getASuccessor(name) }
-
   override StructField getStructField(string name) { none() }
 
   override TupleField getTupleField(int i) { none() }
@@ -230,9 +180,6 @@ class ImplType extends Type, TImpl {
     result = TTypeParamTypeParameter(impl.getGenericParamList().getTypeParam(i))
   }
 
-  /** Get the trait implemented by this `impl` block, if any. */
-  override TypeMention getABaseTypeMention() { result = impl.getTrait() }
-
   override string toString() { result = impl.toString() }
 
   override Location getLocation() { result = impl.getLocation() }
@@ -247,8 +194,6 @@ class ImplType extends Type, TImpl {
 class ArrayType extends Type, TArrayType {
   ArrayType() { this = TArrayType() }
 
-  override Function getMethod(string name) { none() }
-
   override StructField getStructField(string name) { none() }
 
   override TupleField getTupleField(int i) { none() }
@@ -257,8 +202,6 @@ class ArrayType extends Type, TArrayType {
     none() // todo
   }
 
-  override TypeMention getABaseTypeMention() { none() }
-
   override string toString() { result = "[]" }
 
   override Location getLocation() { result instanceof EmptyLocation }
@@ -273,8 +216,6 @@ class ArrayType extends Type, TArrayType {
 class RefType extends Type, TRefType {
   RefType() { this = TRefType() }
 
-  override Function getMethod(string name) { none() }
-
   override StructField getStructField(string name) { none() }
 
   override TupleField getTupleField(int i) { none() }
@@ -284,17 +225,13 @@ class RefType extends Type, TRefType {
     i = 0
   }
 
-  override TypeMention getABaseTypeMention() { none() }
-
   override string toString() { result = "&" }
 
   override Location getLocation() { result instanceof EmptyLocation }
 }
 
 /** A type parameter. */
 abstract class TypeParameter extends Type {
-  override TypeMention getABaseTypeMention() { none() }
-
   override StructField getStructField(string name) { none() }
 
   override TupleField getTupleField(int i) { none() }
@@ -318,19 +255,9 @@ class TypeParamTypeParameter extends TypeParameter, TTypeParamTypeParameter {
 
   TypeParam getTypeParam() { result = typeParam }
 
-  override Function getMethod(string name) {
-    // NOTE: If the type parameter has trait bounds, then this finds methods
-    // on the bounding traits.
-    result = typeParam.(ItemNode).getASuccessor(name)
-  }
-
   override string toString() { result = typeParam.toString() }
 
   override Location getLocation() { result = typeParam.getLocation() }
-
-  final override TypeMention getABaseTypeMention() {
-    result = typeParam.getTypeBoundList().getABound().getTypeRepr()
-  }
 }
 
 /**
@@ -377,19 +304,13 @@ class AssociatedTypeTypeParameter extends TypeParameter, TAssociatedTypeTypePara
 
   int getIndex() { traitAliasIndex(_, result, typeAlias) }
 
-  override Function getMethod(string name) { none() }
-
   override string toString() { result = typeAlias.getName().getText() }
 
   override Location getLocation() { result = typeAlias.getLocation() }
-
-  override TypeMention getABaseTypeMention() { none() }
 }
 
 /** An implicit reference type parameter. */
 class RefTypeParameter extends TypeParameter, TRefTypeParameter {
-  override Function getMethod(string name) { none() }
-
   override string toString() { result = "&T" }
 
   override Location getLocation() { result instanceof EmptyLocation }
@@ -409,15 +330,36 @@ class SelfTypeParameter extends TypeParameter, TSelfTypeParameter {
 
   Trait getTrait() { result = trait }
 
-  override TypeMention getABaseTypeMention() { result = trait }
+  override string toString() { result = "Self [" + trait.toString() + "]" }
 
-  override Function getMethod(string name) {
-    // The `Self` type parameter is an implementation of the trait, so it has
-    // all the trait's methods.
-    result = trait.(ItemNode).getASuccessor(name)
+  override Location getLocation() { result = trait.getLocation() }
+}
+
+/** A type abstraction. */
+abstract class TypeAbstraction extends AstNode {
+  abstract TypeParameter getATypeParameter();
+}
+
+final class ImplTypeAbstraction extends TypeAbstraction, Impl {
+  override TypeParamTypeParameter getATypeParameter() {
+    result.getTypeParam() = this.getGenericParamList().getATypeParam()
   }
+}
 
-  override string toString() { result = "Self [" + trait.toString() + "]" }
+final class TraitTypeAbstraction extends TypeAbstraction, Trait {
+  override TypeParamTypeParameter getATypeParameter() {
+    result.getTypeParam() = this.getGenericParamList().getATypeParam()
+  }
+}
 
-  override Location getLocation() { result = trait.getLocation() }
+final class TypeBoundTypeAbstraction extends TypeAbstraction, TypeBound {
+  override TypeParamTypeParameter getATypeParameter() { none() }
+}
+
+final class SelfTypeBoundTypeAbstraction extends TypeAbstraction, Name {
+  Trait trait;
+
+  SelfTypeBoundTypeAbstraction() { trait.getName() = this }
+
+  override TypeParamTypeParameter getATypeParameter() { none() }
 }

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -18,6 +18,8 @@ private module Input1 implements InputSig1<Location> {
 
   class TypeParameter = T::TypeParameter;
 
+  class TypeAbstraction = T::TypeAbstraction;
+
   private newtype TTypeArgumentPosition =
     // method type parameters are matched by position instead of by type
     // parameter entity, to avoid extra recursion through method call resolution
@@ -107,7 +109,46 @@ private module Input2 implements InputSig2 {
 
   class TypeMention = TM::TypeMention;
 
-  TypeMention getABaseTypeMention(Type t) { result = t.getABaseTypeMention() }
+  TypeMention getABaseTypeMention(Type t) {
+    // Rust does not have subtyping.
+    none()
+  }
+
+  TypeMention getTypeParameterConstraint(TypeParameter tp) {
+    result = tp.(TypeParamTypeParameter).getTypeParam().getTypeBoundList().getABound().getTypeRepr()
+    or
+    result = tp.(SelfTypeParameter).getTrait()
+  }
+
+  predicate typeSatisfiesConstraint(TypeAbstraction abs, TypeMention sub, TypeMention sup) {
+    // `impl` blocks implementing traits
+    exists(Impl impl |
+      abs = impl and
+      sub = impl.getSelfTy() and
+      sup = impl.getTrait()
+    )
+    or
+    // supertraits
+    exists(Trait trait |
+      abs = trait and
+      sub = trait and
+      sup = trait.getTypeBoundList().getABound().getTypeRepr()
+    )
+    or
+    // trait bounds on type parameters
+    exists(TypeParam param |
+      abs = param.getTypeBoundList().getABound() and
+      sub = param and
+      sup = param.getTypeBoundList().getABound().getTypeRepr()
+    )
+    or
+    // the implicit `Self` type parameter satisfies the trait
+    exists(SelfTypeParameterMention self |
+      abs = self and
+      sub = self and
+      sup = self.getTrait()
+    )
+  }
 }
 
 private module M2 = Make2<Input2>;
@@ -226,7 +267,7 @@ private Type getRefAdjustImplicitSelfType(SelfParam self, TypePath suffix, Type
 }
 
 pragma[nomagic]
-private Type inferImplSelfType(Impl i, TypePath path) {
+private Type resolveImplSelfType(Impl i, TypePath path) {
   result = i.getSelfTy().(TypeReprMention).resolveTypeAt(path)
 }
 
@@ -238,7 +279,7 @@ private Type inferImplicitSelfType(SelfParam self, TypePath path) {
     self = f.getParamList().getSelfParam() and
     result = getRefAdjustImplicitSelfType(self, suffix, t, path)
   |
-    t = inferImplSelfType(i, suffix)
+    t = resolveImplSelfType(i, suffix)
     or
     t = TSelfTypeParameter(i) and suffix.isEmpty()
   )
@@ -896,34 +937,65 @@ private module Cached {
   private import codeql.rust.internal.CachedStages
 
   pragma[inline]
-  private Type getLookupType(AstNode n) {
+  private Type inferTypeDeref(AstNode n, TypePath path) {
     exists(Type t |
       t = inferType(n) and
       if t = TRefType()
       then
         // for reference types, lookup members in the type being referenced
-        result = inferType(n, TypePath::singleton(TRefTypeParameter()))
-      else result = t
+        result = inferType(n, TypePath::cons(TRefTypeParameter(), path))
+      else result = inferType(n, path)
     )
   }
 
-  pragma[nomagic]
-  private Type getMethodCallExprLookupType(MethodCallExpr mce, string name) {
-    result = getLookupType(mce.getReceiver()) and
-    name = mce.getIdentifier().getText()
+  private class ReceiverExpr extends Expr {
+    ReceiverExpr() { any(MethodCallExpr mce).getReceiver() = this }
+
+    Type resolveTypeAt(TypePath path) { result = inferTypeDeref(this, path) }
+  }
+
+  bindingset[tp, name]
+  private Function getTypeParameterMethod(TypeParameter tp, string name) {
+    result = tp.(TypeParamTypeParameter).getTypeParam().(ItemNode).getASuccessor(name)
+    or
+    result = tp.(SelfTypeParameter).getTrait().(ItemNode).getASuccessor(name)
+  }
+
+  /**
+   * Gets an `impl` block with an implementing type that matches the type of
+   * `mce`'s receiver.
+   */
+  private predicate methodCallMatchingImpl(ReceiverExpr receiver, string name, Function function) {
+    exists(MethodCallExpr mce, Impl impl |
+      mce.getReceiver() = receiver and
+      mce.getIdentifier().getText() = name and
+      TypeTreeUtils<ReceiverExpr, TypeMention>::isInstantiationOf(impl, receiver,
+        impl.getSelfTy().(TypeReprMention)) and
+      function = impl.(ImplItemNode).getASuccessor(name)
+    )
   }
 
   /**
    * Gets a method that the method call `mce` resolves to, if any.
    */
   cached
   Function resolveMethodCallExpr(MethodCallExpr mce) {
-    exists(string name | result = getMethodCallExprLookupType(mce, name).getMethod(name))
+    exists(ReceiverExpr receiver, string name |
+      mce.getReceiver() = receiver and
+      mce.getIdentifier().getText() = name
+    |
+      // The method comes from an `impl` block targeting the type of `receiver`.
+      methodCallMatchingImpl(receiver, name, result)
+      or
+      // The type of `receiver` is a type parameter and the method comes from a
+      // trait bound on the type parameter.
+      result = getTypeParameterMethod(inferTypeDeref(receiver, TypePath::nil()), name)
+    )
   }
 
   pragma[nomagic]
   private Type getFieldExprLookupType(FieldExpr fe, string name) {
-    result = getLookupType(fe.getContainer()) and
+    result = inferTypeDeref(fe.getContainer(), TypePath::nil()) and
     name = fe.getIdentifier().getText()
   }