Rust: Fix type inference for library parameters

hvitved · hvitved · commit 3aeb1b53631f · 2025-06-12T13:39:51.000+02:00
diff --git a/rust/ql/lib/codeql/rust/internal/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/TypeInference.qll
@@ -609,7 +609,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
       exists(Param p, int i, boolean inMethod |
         paramPos(this.getParamList(), p, i, inMethod) and
         dpos = TPositionalDeclarationPosition(i, inMethod) and
-        result = inferAnnotatedType(p.getPat(), path)
+        result = p.getTypeRepr().(TypeMention).resolveTypeAt(path)
       )
       or
       exists(SelfParam self |
@@ -1587,9 +1587,9 @@ private module Debug {
     result = inferType(n, path)
   }
 
-  Function debugResolveMethodCallExpr(MethodCallExpr mce) {
-    mce = getRelevantLocatable() and
-    result = resolveMethodCallTarget(mce)
+  Function debugResolveMethod(MethodCall mc) {
+    mc = getRelevantLocatable() and
+    result = resolveMethodCallTarget(mc)
   }
 
   pragma[nomagic]
diff --git a/rust/ql/test/library-tests/dataflow/modeled/inline-flow.expected b/rust/ql/test/library-tests/dataflow/modeled/inline-flow.expected
@@ -5,11 +5,14 @@ models
 | 4 | Summary: lang:core; <crate::option::Option>::unwrap; Argument[self].Field[crate::option::Option::Some(0)]; ReturnValue; value |
 | 5 | Summary: lang:core; <crate::option::Option>::zip; Argument[0].Field[crate::option::Option::Some(0)]; ReturnValue.Field[crate::option::Option::Some(0)].Field[1]; value |
 | 6 | Summary: lang:core; <crate::pin::Pin>::into_inner; Argument[0]; ReturnValue; value |
-| 7 | Summary: lang:core; <crate::pin::Pin>::new; Argument[0]; ReturnValue; value |
-| 8 | Summary: lang:core; <crate::result::Result>::unwrap; Argument[self].Field[crate::result::Result::Ok(0)]; ReturnValue; value |
-| 9 | Summary: lang:core; <i64 as crate::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
-| 10 | Summary: lang:core; crate::ptr::read; Argument[0].Reference; ReturnValue; value |
-| 11 | Summary: lang:core; crate::ptr::write; Argument[1]; Argument[0].Reference; value |
+| 7 | Summary: lang:core; <crate::pin::Pin>::into_inner_unchecked; Argument[0]; ReturnValue; value |
+| 8 | Summary: lang:core; <crate::pin::Pin>::new; Argument[0].Reference; ReturnValue; value |
+| 9 | Summary: lang:core; <crate::pin::Pin>::new; Argument[0]; ReturnValue; value |
+| 10 | Summary: lang:core; <crate::pin::Pin>::new_unchecked; Argument[0].Reference; ReturnValue; value |
+| 11 | Summary: lang:core; <crate::result::Result>::unwrap; Argument[self].Field[crate::result::Result::Ok(0)]; ReturnValue; value |
+| 12 | Summary: lang:core; <i64 as crate::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
+| 13 | Summary: lang:core; crate::ptr::read; Argument[0].Reference; ReturnValue; value |
+| 14 | Summary: lang:core; crate::ptr::write; Argument[1]; Argument[0].Reference; value |
 edges
 | main.rs:12:9:12:9 | a [Some] | main.rs:13:10:13:19 | a.unwrap() | provenance | MaD:4 |
 | main.rs:12:9:12:9 | a [Some] | main.rs:14:13:14:13 | a [Some] | provenance |  |
@@ -18,18 +21,18 @@ edges
 | main.rs:14:9:14:9 | b [Some] | main.rs:15:10:15:19 | b.unwrap() | provenance | MaD:4 |
 | main.rs:14:13:14:13 | a [Some] | main.rs:14:13:14:21 | a.clone() [Some] | provenance | generated |
 | main.rs:14:13:14:21 | a.clone() [Some] | main.rs:14:9:14:9 | b [Some] | provenance |  |
-| main.rs:19:9:19:9 | a [Ok] | main.rs:20:10:20:19 | a.unwrap() | provenance | MaD:8 |
+| main.rs:19:9:19:9 | a [Ok] | main.rs:20:10:20:19 | a.unwrap() | provenance | MaD:11 |
 | main.rs:19:9:19:9 | a [Ok] | main.rs:21:13:21:13 | a [Ok] | provenance |  |
 | main.rs:19:31:19:44 | Ok(...) [Ok] | main.rs:19:9:19:9 | a [Ok] | provenance |  |
 | main.rs:19:34:19:43 | source(...) | main.rs:19:31:19:44 | Ok(...) [Ok] | provenance |  |
-| main.rs:21:9:21:9 | b [Ok] | main.rs:22:10:22:19 | b.unwrap() | provenance | MaD:8 |
+| main.rs:21:9:21:9 | b [Ok] | main.rs:22:10:22:19 | b.unwrap() | provenance | MaD:11 |
 | main.rs:21:13:21:13 | a [Ok] | main.rs:21:13:21:21 | a.clone() [Ok] | provenance | generated |
 | main.rs:21:13:21:21 | a.clone() [Ok] | main.rs:21:9:21:9 | b [Ok] | provenance |  |
 | main.rs:26:9:26:9 | a | main.rs:27:10:27:10 | a | provenance |  |
 | main.rs:26:9:26:9 | a | main.rs:28:13:28:13 | a | provenance |  |
 | main.rs:26:13:26:22 | source(...) | main.rs:26:9:26:9 | a | provenance |  |
 | main.rs:28:9:28:9 | b | main.rs:29:10:29:10 | b | provenance |  |
-| main.rs:28:13:28:13 | a | main.rs:28:13:28:21 | a.clone() | provenance | MaD:9 |
+| main.rs:28:13:28:13 | a | main.rs:28:13:28:21 | a.clone() | provenance | MaD:12 |
 | main.rs:28:13:28:13 | a | main.rs:28:13:28:21 | a.clone() | provenance | generated |
 | main.rs:28:13:28:21 | a.clone() | main.rs:28:9:28:9 | b | provenance |  |
 | main.rs:43:18:43:22 | SelfParam [Wrapper] | main.rs:44:26:44:29 | self [Wrapper] | provenance |  |
@@ -62,8 +65,8 @@ edges
 | main.rs:69:18:69:23 | TuplePat [tuple.1] | main.rs:69:22:69:22 | m | provenance |  |
 | main.rs:69:22:69:22 | m | main.rs:71:22:71:22 | m | provenance |  |
 | main.rs:92:29:92:29 | [post] y [&ref] | main.rs:93:33:93:33 | y [&ref] | provenance |  |
-| main.rs:92:32:92:41 | source(...) | main.rs:92:29:92:29 | [post] y [&ref] | provenance | MaD:11 |
-| main.rs:93:33:93:33 | y [&ref] | main.rs:93:18:93:34 | ...::read(...) | provenance | MaD:10 |
+| main.rs:92:32:92:41 | source(...) | main.rs:92:29:92:29 | [post] y [&ref] | provenance | MaD:14 |
+| main.rs:93:33:93:33 | y [&ref] | main.rs:93:18:93:34 | ...::read(...) | provenance | MaD:13 |
 | main.rs:108:13:108:17 | mut i | main.rs:109:34:109:34 | i | provenance |  |
 | main.rs:108:13:108:17 | mut i | main.rs:110:33:110:33 | i | provenance |  |
 | main.rs:108:13:108:17 | mut i | main.rs:111:47:111:47 | i | provenance |  |
@@ -72,7 +75,7 @@ edges
 | main.rs:109:13:109:20 | mut pin1 [&ref] | main.rs:114:15:114:18 | pin1 [&ref] | provenance |  |
 | main.rs:109:13:109:20 | mut pin1 [&ref] | main.rs:115:31:115:34 | pin1 [&ref] | provenance |  |
 | main.rs:109:24:109:35 | ...::new(...) [&ref] | main.rs:109:13:109:20 | mut pin1 [&ref] | provenance |  |
-| main.rs:109:33:109:34 | &i [&ref] | main.rs:109:24:109:35 | ...::new(...) [&ref] | provenance | MaD:7 |
+| main.rs:109:33:109:34 | &i [&ref] | main.rs:109:24:109:35 | ...::new(...) [&ref] | provenance | MaD:9 |
 | main.rs:109:34:109:34 | i | main.rs:109:33:109:34 | &i [&ref] | provenance |  |
 | main.rs:110:13:110:20 | mut pin2 [&ref] | main.rs:116:15:116:18 | pin2 [&ref] | provenance |  |
 | main.rs:110:24:110:34 | ...::pin(...) [&ref] | main.rs:110:13:110:20 | mut pin2 [&ref] | provenance |  |
@@ -86,10 +89,26 @@ edges
 | main.rs:115:31:115:34 | pin1 [&ref] | main.rs:115:15:115:35 | ...::into_inner(...) [&ref] | provenance | MaD:6 |
 | main.rs:116:15:116:18 | pin2 [&ref] | main.rs:116:14:116:18 | * ... | provenance |  |
 | main.rs:117:15:117:18 | pin3 [&ref] | main.rs:117:14:117:18 | * ... | provenance |  |
+| main.rs:122:13:122:18 | mut ms [MyStruct] | main.rs:123:34:123:35 | ms [MyStruct] | provenance |  |
 | main.rs:122:13:122:18 | mut ms [MyStruct] | main.rs:127:14:127:15 | ms [MyStruct] | provenance |  |
 | main.rs:122:22:122:49 | MyStruct {...} [MyStruct] | main.rs:122:13:122:18 | mut ms [MyStruct] | provenance |  |
 | main.rs:122:38:122:47 | source(...) | main.rs:122:22:122:49 | MyStruct {...} [MyStruct] | provenance |  |
+| main.rs:123:13:123:20 | mut pin1 [MyStruct] | main.rs:129:30:129:33 | pin1 [MyStruct] | provenance |  |
+| main.rs:123:24:123:36 | ...::new(...) [MyStruct] | main.rs:123:13:123:20 | mut pin1 [MyStruct] | provenance |  |
+| main.rs:123:33:123:35 | &ms [&ref, MyStruct] | main.rs:123:24:123:36 | ...::new(...) [MyStruct] | provenance | MaD:8 |
+| main.rs:123:34:123:35 | ms [MyStruct] | main.rs:123:33:123:35 | &ms [&ref, MyStruct] | provenance |  |
 | main.rs:127:14:127:15 | ms [MyStruct] | main.rs:127:14:127:19 | ms.val | provenance |  |
+| main.rs:129:14:129:34 | ...::into_inner(...) [MyStruct] | main.rs:129:14:129:38 | ... .val | provenance |  |
+| main.rs:129:30:129:33 | pin1 [MyStruct] | main.rs:129:14:129:34 | ...::into_inner(...) [MyStruct] | provenance | MaD:6 |
+| main.rs:136:13:136:18 | mut ms [MyStruct] | main.rs:137:44:137:45 | ms [MyStruct] | provenance |  |
+| main.rs:136:22:136:49 | MyStruct {...} [MyStruct] | main.rs:136:13:136:18 | mut ms [MyStruct] | provenance |  |
+| main.rs:136:38:136:47 | source(...) | main.rs:136:22:136:49 | MyStruct {...} [MyStruct] | provenance |  |
+| main.rs:137:13:137:20 | mut pin5 [MyStruct] | main.rs:139:40:139:43 | pin5 [MyStruct] | provenance |  |
+| main.rs:137:24:137:46 | ...::new_unchecked(...) [MyStruct] | main.rs:137:13:137:20 | mut pin5 [MyStruct] | provenance |  |
+| main.rs:137:43:137:45 | &ms [&ref, MyStruct] | main.rs:137:24:137:46 | ...::new_unchecked(...) [MyStruct] | provenance | MaD:10 |
+| main.rs:137:44:137:45 | ms [MyStruct] | main.rs:137:43:137:45 | &ms [&ref, MyStruct] | provenance |  |
+| main.rs:139:14:139:44 | ...::into_inner_unchecked(...) [MyStruct] | main.rs:139:14:139:48 | ... .val | provenance |  |
+| main.rs:139:40:139:43 | pin5 [MyStruct] | main.rs:139:14:139:44 | ...::into_inner_unchecked(...) [MyStruct] | provenance | MaD:7 |
 nodes
 | main.rs:12:9:12:9 | a [Some] | semmle.label | a [Some] |
 | main.rs:12:13:12:28 | Some(...) [Some] | semmle.label | Some(...) [Some] |
@@ -174,11 +193,29 @@ nodes
 | main.rs:122:13:122:18 | mut ms [MyStruct] | semmle.label | mut ms [MyStruct] |
 | main.rs:122:22:122:49 | MyStruct {...} [MyStruct] | semmle.label | MyStruct {...} [MyStruct] |
 | main.rs:122:38:122:47 | source(...) | semmle.label | source(...) |
+| main.rs:123:13:123:20 | mut pin1 [MyStruct] | semmle.label | mut pin1 [MyStruct] |
+| main.rs:123:24:123:36 | ...::new(...) [MyStruct] | semmle.label | ...::new(...) [MyStruct] |
+| main.rs:123:33:123:35 | &ms [&ref, MyStruct] | semmle.label | &ms [&ref, MyStruct] |
+| main.rs:123:34:123:35 | ms [MyStruct] | semmle.label | ms [MyStruct] |
 | main.rs:127:14:127:15 | ms [MyStruct] | semmle.label | ms [MyStruct] |
 | main.rs:127:14:127:19 | ms.val | semmle.label | ms.val |
+| main.rs:129:14:129:34 | ...::into_inner(...) [MyStruct] | semmle.label | ...::into_inner(...) [MyStruct] |
+| main.rs:129:14:129:38 | ... .val | semmle.label | ... .val |
+| main.rs:129:30:129:33 | pin1 [MyStruct] | semmle.label | pin1 [MyStruct] |
+| main.rs:136:13:136:18 | mut ms [MyStruct] | semmle.label | mut ms [MyStruct] |
+| main.rs:136:22:136:49 | MyStruct {...} [MyStruct] | semmle.label | MyStruct {...} [MyStruct] |
+| main.rs:136:38:136:47 | source(...) | semmle.label | source(...) |
+| main.rs:137:13:137:20 | mut pin5 [MyStruct] | semmle.label | mut pin5 [MyStruct] |
+| main.rs:137:24:137:46 | ...::new_unchecked(...) [MyStruct] | semmle.label | ...::new_unchecked(...) [MyStruct] |
+| main.rs:137:43:137:45 | &ms [&ref, MyStruct] | semmle.label | &ms [&ref, MyStruct] |
+| main.rs:137:44:137:45 | ms [MyStruct] | semmle.label | ms [MyStruct] |
+| main.rs:139:14:139:44 | ...::into_inner_unchecked(...) [MyStruct] | semmle.label | ...::into_inner_unchecked(...) [MyStruct] |
+| main.rs:139:14:139:48 | ... .val | semmle.label | ... .val |
+| main.rs:139:40:139:43 | pin5 [MyStruct] | semmle.label | pin5 [MyStruct] |
 subpaths
 | main.rs:50:15:50:15 | w [Wrapper] | main.rs:43:18:43:22 | SelfParam [Wrapper] | main.rs:43:33:45:9 | { ... } [Wrapper] | main.rs:53:17:53:25 | w.clone() [Wrapper] |
 testFailures
+| main.rs:129:14:129:38 | ... .val | Fixed missing result: hasValueFlow=41 |
 #select
 | main.rs:13:10:13:19 | a.unwrap() | main.rs:12:18:12:27 | source(...) | main.rs:13:10:13:19 | a.unwrap() | $@ | main.rs:12:18:12:27 | source(...) | source(...) |
 | main.rs:15:10:15:19 | b.unwrap() | main.rs:12:18:12:27 | source(...) | main.rs:15:10:15:19 | b.unwrap() | $@ | main.rs:12:18:12:27 | source(...) | source(...) |
@@ -196,3 +233,5 @@ testFailures
 | main.rs:116:14:116:18 | * ... | main.rs:108:21:108:30 | source(...) | main.rs:116:14:116:18 | * ... | $@ | main.rs:108:21:108:30 | source(...) | source(...) |
 | main.rs:117:14:117:18 | * ... | main.rs:108:21:108:30 | source(...) | main.rs:117:14:117:18 | * ... | $@ | main.rs:108:21:108:30 | source(...) | source(...) |
 | main.rs:127:14:127:19 | ms.val | main.rs:122:38:122:47 | source(...) | main.rs:127:14:127:19 | ms.val | $@ | main.rs:122:38:122:47 | source(...) | source(...) |
+| main.rs:129:14:129:38 | ... .val | main.rs:122:38:122:47 | source(...) | main.rs:129:14:129:38 | ... .val | $@ | main.rs:122:38:122:47 | source(...) | source(...) |
+| main.rs:139:14:139:48 | ... .val | main.rs:136:38:136:47 | source(...) | main.rs:139:14:139:48 | ... .val | $@ | main.rs:136:38:136:47 | source(...) | source(...) |
diff --git a/rust/ql/test/library-tests/dataflow/modeled/main.rs b/rust/ql/test/library-tests/dataflow/modeled/main.rs
@@ -95,8 +95,8 @@ mod ptr {
     }
 }
 
-use std::pin::Pin;
 use std::pin::pin;
+use std::pin::Pin;
 
 #[derive(Clone)]
 struct MyStruct {
@@ -136,7 +136,7 @@ fn test_pin() {
         let mut ms = MyStruct { val: source(42) };
         let mut pin5 = Pin::new_unchecked(&ms);
         sink(pin5.val); // $ MISSING: hasValueFlow=42
-        sink(Pin::into_inner_unchecked(pin5).val); // $ MISSING: hasValueFlow=42
+        sink(Pin::into_inner_unchecked(pin5).val); // $ hasValueFlow=42
     }
 
     {
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected

Original file line number	Diff line number	Diff line change
`@@ -609,7 +609,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {`
`609`	`609`	`exists(Param p, int i, boolean inMethod \|`
`610`	`610`	`paramPos(this.getParamList(), p, i, inMethod) and`
`611`	`611`	`dpos = TPositionalDeclarationPosition(i, inMethod) and`
`612`		`- result = inferAnnotatedType(p.getPat(), path)`
	`612`	`+ result = p.getTypeRepr().(TypeMention).resolveTypeAt(path)`
`613`	`613`	`)`
`614`	`614`	`or`
`615`	`615`	`exists(SelfParam self \|`
`@@ -1587,9 +1587,9 @@ private module Debug {`
`1587`	`1587`	`result = inferType(n, path)`
`1588`	`1588`	`}`
`1589`	`1589`
`1590`		`- Function debugResolveMethodCallExpr(MethodCallExpr mce) {`
`1591`		`- mce = getRelevantLocatable() and`
`1592`		`- result = resolveMethodCallTarget(mce)`
	`1590`	`+ Function debugResolveMethod(MethodCall mc) {`
	`1591`	`+ mc = getRelevantLocatable() and`
	`1592`	`+ result = resolveMethodCallTarget(mc)`
`1593`	`1593`	`}`
`1594`	`1594`
`1595`	`1595`	`pragma[nomagic]`
Original file line number	Diff line number	Diff line change
`@@ -95,8 +95,8 @@ mod ptr {`
`95`	`95`	`}`
`96`	`96`	`}`
`97`	`97`
`98`		`-use std::pin::Pin;`
`99`	`98`	`use std::pin::pin;`
	`99`	`+use std::pin::Pin;`
`100`	`100`
`101`	`101`	`#[derive(Clone)]`
`102`	`102`	`struct MyStruct {`
`@@ -136,7 +136,7 @@ fn test_pin() {`
`136`	`136`	`let mut ms = MyStruct { val: source(42) };`
`137`	`137`	`let mut pin5 = Pin::new_unchecked(&ms);`
`138`	`138`	`sink(pin5.val); // $ MISSING: hasValueFlow=42`
`139`		`- sink(Pin::into_inner_unchecked(pin5).val); // $ MISSING: hasValueFlow=42`
	`139`	`+ sink(Pin::into_inner_unchecked(pin5).val); // $ hasValueFlow=42`
`140`	`140`	`}`
`141`	`141`
`142`	`142`	`{`