wip3

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -838,10 +838,13 @@ private predicate functionInfoBlanket(
   Function f, string name, int arity, ImplItemNode impl, Trait trait, FunctionTypePosition pos,
   FunctionType t, TypePath blanketPath, TypeParam blanketTypeParam
 ) {
-  functionInfo(f, name, arity, impl, pos, t) and
-  TTypeParamTypeParameter(blanketTypeParam) = t.getTypeAt(blanketPath) and
-  MethodResolution::isBlanketLike(impl, blanketTypeParam) and
-  trait = impl.resolveTraitTy()
+  exists(TypePath path0 |
+    functionInfo(f, name, arity, impl, pos, t) and
+    TTypeParamTypeParameter(blanketTypeParam) = t.getTypeAt(blanketPath) and
+    blanketPath = any(string s) + path0 and
+    BlanketImplementation::isBlanket(impl, path0, blanketTypeParam) and
+    trait = impl.resolveTraitTy()
+  )
 }
 
 /**
@@ -881,6 +884,30 @@ private module ArgIsInstantiationOf<
   }
 }
 
+/**
+ * Holds if `root` is a valid complex [`self` root type][1], with type
+ * parameter `tp`.
+ *
+ * [1]: https://doc.rust-lang.org/stable/reference/items/associated-items.html?highlight=self#r-items.associated.fn.method.self-ty
+ */
+pragma[nomagic]
+predicate complexSelfRoot(Type root, TypeParameter tp) {
+  tp = root.(RefType).getPositionalTypeParameter(_)
+  or
+  exists(Struct s |
+    root = TStruct(s) and
+    tp = root.getPositionalTypeParameter(0)
+  |
+    s instanceof BoxStruct
+    or
+    s instanceof RcStruct
+    or
+    s instanceof ArcStruct
+    or
+    s instanceof PinStruct
+  )
+}
+
 /**
  * Provides logic for resolving calls to methods.
  *
@@ -916,30 +943,6 @@ private module ArgIsInstantiationOf<
  * [1]: https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.candidate-receivers
  */
 private module MethodResolution {
-  /**
-   * Holds if `root` is a valid complex [`self` root type][1], with type
-   * parameter `tp`.
-   *
-   * [1]: https://doc.rust-lang.org/stable/reference/items/associated-items.html?highlight=self#r-items.associated.fn.method.self-ty
-   */
-  pragma[nomagic]
-  private predicate complexSelfRoot(Type root, TypeParameter tp) {
-    tp = root.(RefType).getPositionalTypeParameter(_)
-    or
-    exists(Struct s |
-      root = TStruct(s) and
-      tp = root.getPositionalTypeParameter(0)
-    |
-      s instanceof BoxStruct
-      or
-      s instanceof RcStruct
-      or
-      s instanceof ArcStruct
-      or
-      s instanceof PinStruct
-    )
-  }
-
   /**
    * Holds if the type path `path` pointing to `type` is stripped of any leading
    * complex root type allowed for `self` parameters, such as `&`, `Box`, `Rc`,
@@ -991,17 +994,6 @@ private module MethodResolution {
     methodInfo(m, name, arity, i, selfType, strippedTypePath, TTypeParamTypeParameter(tp))
   }
 
-  predicate isBlanketLike(ImplItemNode i, TypeParam tp) {
-    tp = i.getBlanketImplementationTypeParam()
-    // or
-    // exists(TypeMention tm, Type root, TypeParameter tp0 |
-    //   tm = i.(Impl).getSelfTy() and
-    //   complexSelfRoot(root, tp0) and
-    //   tm.resolveType() = root and
-    //   tm.resolveTypeAt(TypePath::singleton(tp0)) = TTypeParamTypeParameter(tp)
-    // )
-  }
-
   /**
    * Same as `methodInfo`, but restricted to non-blanket implementations, and
    * allowing for any `strippedType` when the corresponding type inside `m` is
@@ -1016,7 +1008,7 @@ private module MethodResolution {
       methodInfo(m, name, arity, i, selfType, strippedTypePath, strippedType) or
       methodInfoTypeParam(m, name, arity, i, selfType, strippedTypePath, _)
     ) and
-    not isBlanketLike(i, _)
+    not BlanketImplementation::isBlanket(i, _, _)
   }
 
   /**
@@ -1242,7 +1234,7 @@ private module MethodResolution {
         forall(ImplOrTraitItemNode i |
           methodCallNonBlanketCandidate(this, _, i, _, strippedTypePath, strippedType)
           or
-          CallExprImpl::getResolvedFunction(this) = i.(ImplItemNode).getASuccessor(_)
+          this.(MethodCallCallExpr).hasTypeQualifiedCandidate(i)
         |
           this.hasIncompatibleTarget(i, derefChainBorrow)
         )
@@ -1265,7 +1257,7 @@ private module MethodResolution {
         forall(ImplOrTraitItemNode i |
           methodCallNonBlanketCandidate(this, _, i, _, strippedTypePath, strippedType)
           or
-          CallExprImpl::getResolvedFunction(this) = i.(ImplItemNode).getASuccessor(_)
+          this.(MethodCallCallExpr).hasTypeQualifiedCandidate(i)
         |
           this.hasIncompatibleTarget(i, derefChainBorrow)
         )
@@ -1371,6 +1363,20 @@ private module MethodResolution {
       forall(ItemNode i | i = CallExprImpl::getResolvedFunction(this) | i instanceof Method)
     }
 
+    /**
+     * Holds if this call has a type qualifier, and we are able to resolve,
+     * using path resolution, the function to a member of `impl`.
+     *
+     * When this is the case, we still want to check that the type qualifier
+     * is an instance of the type being implemented, which is done in
+     * `MethodCallCallExprIsInstantiationOfInput`.
+     */
+    pragma[nomagic]
+    predicate hasTypeQualifiedCandidate(ImplItemNode impl) {
+      exists(getCallExprTypeQualifier(this, _)) and
+      CallExprImpl::getResolvedFunction(this) = impl.getASuccessor(_)
+    }
+
     pragma[nomagic]
     override predicate hasNameAndArity(string name, int arity) {
       name = CallExprImpl::getFunctionPath(this).getText() and
@@ -1492,14 +1498,19 @@ private module MethodResolution {
       )
     }
 
+    pragma[nomagic]
+    private predicate argIsInstanceOf(ImplOrTraitItemNode i) {
+      IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, MethodCallCallExprIsInstantiationOfInput>::isInstantiationOf(mc_,
+        i, _)
+    }
+
     pragma[nomagic]
     private predicate argIsInstanceOf(ImplOrTraitItemNode i, string name, int arity) {
       (
         ArgIsInstantiationOf<MethodCallCand, MethodCallReceiverIsInstantiationOfInput>::argIsInstanceOf(this,
           i, _)
         or
-        IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, MethodCallCallExprIsInstantiationOfInput>::isInstantiationOf(mc_,
-          i, _)
+        this.argIsInstanceOf(i)
       ) and
       mc_.hasNameAndArity(name, arity)
     }
@@ -1553,11 +1564,11 @@ private module MethodResolution {
   {
     pragma[nomagic]
     predicate hasBlanketCandidate(
-      MethodCallCand mcc, Function m, TypePath blanketPath, TypeParam blanketTypeParam
+      MethodCallCand mcc, ImplItemNode impl, TypePath blanketPath, TypeParam blanketTypeParam
     ) {
       exists(MethodCall mc, string name, int arity |
         mcc.hasSignature(mc, _, _, name, arity) and
-        methodCallBlanketCandidate(mc, m, _, _, blanketPath, blanketTypeParam) and
+        methodCallBlanketCandidate(mc, _, impl, _, blanketPath, blanketTypeParam) and
         // Only apply blanket implementations when no other implementations are possible;
         // this is to account for codebases that use the (unstable) specialization feature
         // (https://rust-lang.github.io/rfcs/1210-impl-specialization.html)
@@ -1587,7 +1598,7 @@ private module MethodResolution {
         or
         methodCallBlanketCandidate(mc, m, i, selfType, _, _) and
         BlanketImplementation::SatisfiesBlanketConstraint<MethodCallCand, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(mcc,
-          m)
+          i)
       )
     }
 
@@ -1620,8 +1631,7 @@ private module MethodResolution {
     private predicate potentialInstantiationOf0(
       MethodCallCallExpr ce, ImplItemNode impl, TypeMentionTypeTree constraint
     ) {
-      exists(getCallExprTypeQualifier(ce, _)) and
-      CallExprImpl::getResolvedFunction(ce) = impl.getASuccessor(_) and
+      ce.hasTypeQualifiedCandidate(impl) and
       constraint = impl.getSelfPath()
     }
 
@@ -1634,7 +1644,7 @@ private module MethodResolution {
       then
         // inherent methods take precedence over trait methods, so only allow
         // trait methods when there are no matching inherent methods
-        MkMethodCallCand(ce, "").(MethodCallCand).hasNoInherentTarget()
+        MkMethodCallCand(ce, _).(MethodCallCand).hasNoInherentTarget()
       else any()
     }
 
@@ -1914,10 +1924,10 @@ private module AssocFunctionResolution {
 
   pragma[nomagic]
   private predicate functionCallBlanketCandidate(
-    AssocFunctionCall fc, AssocFunction f, FunctionTypePosition pos, TypePath blanketPath,
-    TypeParam blanketTypeParam
+    AssocFunctionCall fc, AssocFunction f, ImplItemNode impl, FunctionTypePosition pos,
+    TypePath blanketPath, TypeParam blanketTypeParam
   ) {
-    exists(string name, int arity, ImplItemNode impl, Trait trait, FunctionType t |
+    exists(string name, int arity, Trait trait, FunctionType t |
       fc.hasNameAndArity(name, arity) and
       exists(getTypeAt(fc, pos, blanketPath)) and
       functionInfoBlanketRelevantPos(f, name, arity, impl, trait, pos, t, blanketPath,
@@ -1928,7 +1938,7 @@ private module AssocFunctionResolution {
 
   private newtype TAssocFunctionCallAndPos =
     MkAssocFunctionCallAndPos(AssocFunctionCall fc, FunctionTypePosition pos) {
-      functionCallBlanketCandidate(fc, _, pos, _, _)
+      functionCallBlanketCandidate(fc, _, _, pos, _, _)
     }
 
   class AssocFunctionCallAndPos extends MkAssocFunctionCallAndPos {
@@ -1949,11 +1959,12 @@ private module AssocFunctionResolution {
   {
     pragma[nomagic]
     predicate hasBlanketCandidate(
-      AssocFunctionCallAndPos fcp, Function f, TypePath blanketPath, TypeParam blanketTypeParam
+      AssocFunctionCallAndPos fcp, ImplItemNode impl, TypePath blanketPath,
+      TypeParam blanketTypeParam
     ) {
       exists(AssocFunctionCall fc, FunctionTypePosition pos |
         fcp = MkAssocFunctionCallAndPos(fc, pos) and
-        functionCallBlanketCandidate(fc, f, pos, blanketPath, blanketTypeParam)
+        functionCallBlanketCandidate(fc, _, impl, pos, blanketPath, blanketTypeParam)
       )
     }
   }
@@ -1969,11 +1980,11 @@ private module AssocFunctionResolution {
     predicate potentialInstantiationOf(
       AssocFunctionCallAndPos fcp, TypeAbstraction abs, FunctionType constraint
     ) {
-      exists(Function f, FunctionTypePosition pos |
+      exists(FunctionTypePosition pos |
         BlanketImplementation::SatisfiesBlanketConstraint<AssocFunctionCallAndPos, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(fcp,
-          f) and
+          abs) and
         fcp = MkAssocFunctionCallAndPos(_, pos) and
-        functionInfoBlanketRelevantPos(f, _, _, abs, _, pos, constraint, _, _)
+        functionInfoBlanketRelevantPos(_, _, _, abs, _, pos, constraint, _, _)
       )
     }
 
@@ -3079,8 +3090,8 @@ module Debug {
   Locatable getRelevantLocatable() {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
-      filepath.matches("%/sqlx.rs") and
-      startline = 246
+      filepath.matches("%/test_futures_io.rs") and
+      startline = 45
     )
   }
 

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -8,8 +8,28 @@
 private import rust
 private import codeql.rust.internal.PathResolution
 private import codeql.rust.internal.Type
+private import codeql.rust.internal.TypeMention
 private import codeql.rust.internal.TypeInference
 
+pragma[nomagic]
+private predicate isBlanketLike(ImplItemNode i, TypePath path, TypeParam tp) {
+  exists(TypeMention tm, Type root, TypeParameter tp0 |
+    tm = i.(Impl).getSelfTy() and
+    complexSelfRoot(root, tp0) and
+    tm.resolveType() = root and
+    tm.resolveTypeAt(path) = TTypeParamTypeParameter(tp) and
+    path = TypePath::singleton(tp0) and
+    hasFirstNonTrivialTraitBound(tp, _)
+  )
+}
+
+predicate isBlanket(ImplItemNode i, TypePath path, TypeParam tp) {
+  tp = i.getBlanketImplementationTypeParam() and
+  path.isEmpty()
+  or
+  isBlanketLike(i, path, tp)
+}
+
 /**
  * Holds if `tp` is the type parameter of a blanket implementation and
  * `traitBound` is the first non-trivial trait bound of `tp`.
@@ -33,24 +53,30 @@ private predicate hasFirstNonTrivialTraitBound(TypeParamItemNode tp, Trait trait
 
 signature module SatisfiesBlanketConstraintInputSig<HasTypeTreeSig ArgumentType> {
   /**
-   * Holds if a call with argument type `at` may potentially target `f`, which
-   * is defined in a blanket implementation with type parameter `blanketTypeParam`.
+   * Holds if a call with argument type `at` may potentially target a function belonging
+   * to blanket implementation `impl` with type parameter `blanketTypeParam`.
    *
-   * `blanketPath` points to the type `blanketTypeParam` inside the type of
-   * `f`'s parameter at the matching position.
+   * `blanketPath` points to the type `blanketTypeParam` inside the type of the parameter
+   * at the matching position.
    */
   predicate hasBlanketCandidate(
-    ArgumentType at, Function f, TypePath blanketPath, TypeParam blanketTypeParam
+    ArgumentType at, ImplItemNode impl, TypePath blanketPath, TypeParam blanketTypeParam
   );
 }
 
 module SatisfiesBlanketConstraint<
   HasTypeTreeSig ArgumentType, SatisfiesBlanketConstraintInputSig<ArgumentType> Input>
 {
+  private predicate hasBlanketCandidate(
+    ArgumentType at, ImplItemNode impl, TypePath blanketPath, TypeParam blanketTypeParam
+  ) {
+    Input::hasBlanketCandidate(at, impl, blanketPath, blanketTypeParam) and
+    exists(at.getTypeAt(blanketPath))
+  }
+
   private newtype TArgumentTypeAndBlanketOffset =
     MkArgumentTypeAndBlanketOffset(ArgumentType at, TypePath blanketPath) {
-      Input::hasBlanketCandidate(at, _, blanketPath, _) and
-      exists(at.getTypeAt(blanketPath))
+      hasBlanketCandidate(at, _, blanketPath, _)
     }
 
   private class ArgumentTypeAndBlanketOffset extends MkArgumentTypeAndBlanketOffset {
@@ -71,11 +97,11 @@ module SatisfiesBlanketConstraint<
   {
     pragma[nomagic]
     additional predicate relevantConstraint(
-      ArgumentTypeAndBlanketOffset ato, Function f, Trait traitBound
+      ArgumentTypeAndBlanketOffset ato, ImplItemNode impl, Trait traitBound
     ) {
       exists(ArgumentType at, TypePath blanketPath, TypeParam blanketTypeParam |
         ato = MkArgumentTypeAndBlanketOffset(at, blanketPath) and
-        Input::hasBlanketCandidate(at, f, blanketPath, blanketTypeParam) and
+        hasBlanketCandidate(at, impl, blanketPath, blanketTypeParam) and
         hasFirstNonTrivialTraitBound(blanketTypeParam, traitBound)
       )
     }
@@ -90,21 +116,21 @@ module SatisfiesBlanketConstraint<
 
   /**
    * Holds if the argument type `at` satisfies the first non-trivial blanket
-   * constraint of the function `f`, if such a constraint exists.
+   * constraint of `impl`, if such a constraint exists.
    */
   pragma[nomagic]
-  predicate satisfiesBlanketConstraint(ArgumentType at, Function f) {
+  predicate satisfiesBlanketConstraint(ArgumentType at, ImplItemNode impl) {
     exists(ArgumentTypeAndBlanketOffset ato, Trait traitBound |
       ato = MkArgumentTypeAndBlanketOffset(at, _) and
-      SatisfiesBlanketConstraintInput::relevantConstraint(ato, f, traitBound) and
+      SatisfiesBlanketConstraintInput::relevantConstraint(ato, impl, traitBound) and
       SatisfiesConstraint<ArgumentTypeAndBlanketOffset, SatisfiesBlanketConstraintInput>::satisfiesConstraintType(ato,
         TTrait(traitBound), _, _)
     )
-    or
-    exists(TypePath blanketPath, TypeParam blanketTypeParam |
-      Input::hasBlanketCandidate(at, f, blanketPath, blanketTypeParam) and
-      exists(at.getTypeAt(blanketPath)) and
-      not hasFirstNonTrivialTraitBound(blanketTypeParam, _)
-    )
+    // or
+    // exists(TypePath blanketPath, TypeParam blanketTypeParam |
+    //   isBlanketLike(impl, _, blanketTypeParam) and
+    //   hasBlanketCandidate(at, impl, blanketPath, blanketTypeParam) and
+    //   not hasFirstNonTrivialTraitBound(blanketTypeParam, _)
+    // )
   }
 }

rust/ql/test/library-tests/dataflow/models/CONSISTENCY/PathResolutionConsistency.expected

@@ -1,4 +1,2 @@
 multipleCallTargets
-| main.rs:349:14:349:33 | ... .cmp(...) |
-| main.rs:361:9:361:28 | ... .cmp(...) |
 | main.rs:389:14:389:30 | ... .lt(...) |