Rust: Rework call resolution and type inference for calls

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -12,7 +12,7 @@ private import codeql.rust.elements.internal.ExprImpl::Impl as ExprImpl
  * the canonical path `path` and the method name `method`, and if it borrows its
  * first `borrows` arguments.
  */
-private predicate isOverloaded(string op, int arity, string path, string method, int borrows) {
+predicate isOverloaded(string op, int arity, string path, string method, int borrows) {
   arity = 1 and
   (
     // Negation

rust/ql/lib/codeql/rust/frameworks/stdlib/Stdlib.qll

@@ -213,3 +213,83 @@ class StringStruct extends Struct {
   pragma[nomagic]
   StringStruct() { this.getCanonicalPath() = "alloc::string::String" }
 }
+
+/**
+ * The [`Deref` trait][1].
+ *
+ * [1]: https://doc.rust-lang.org/core/ops/trait.Deref.html
+ */
+class DerefTrait extends Trait {
+  pragma[nomagic]
+  DerefTrait() { this.getCanonicalPath() = "core::ops::deref::Deref" }
+
+  /** Gets the `deref` function. */
+  Function getDerefFunction() { result = this.(TraitItemNode).getAssocItem("deref") }
+
+  /** Gets the `Target` associated type. */
+  pragma[nomagic]
+  TypeAlias getTargetType() {
+    result = this.getAssocItemList().getAnAssocItem() and
+    result.getName().getText() = "Target"
+  }
+}
+
+/**
+ * The [`Index` trait][1].
+ *
+ * [1]: https://doc.rust-lang.org/std/ops/trait.Index.html
+ */
+class IndexTrait extends Trait {
+  pragma[nomagic]
+  IndexTrait() { this.getCanonicalPath() = "core::ops::index::Index" }
+
+  /** Gets the `index` function. */
+  Function getIndexFunction() { result = this.(TraitItemNode).getAssocItem("index") }
+
+  /** Gets the `Output` associated type. */
+  pragma[nomagic]
+  TypeAlias getOutputType() {
+    result = this.getAssocItemList().getAnAssocItem() and
+    result.getName().getText() = "Output"
+  }
+}
+
+/**
+ * The [`Box` struct][1].
+ *
+ * [1]: https://doc.rust-lang.org/std/boxed/struct.Box.html
+ */
+class BoxStruct extends Struct {
+  pragma[nomagic]
+  BoxStruct() { this.getCanonicalPath() = "alloc::boxed::Box" }
+}
+
+/**
+ * The [`Rc` struct][1].
+ *
+ * [1]: https://doc.rust-lang.org/std/rc/struct.Rc.html
+ */
+class RcStruct extends Struct {
+  pragma[nomagic]
+  RcStruct() { this.getCanonicalPath() = "alloc::rc::Rc" }
+}
+
+/**
+ * The [`Arc` struct][1].
+ *
+ * [1]: https://doc.rust-lang.org/std/sync/struct.Arc.html
+ */
+class ArcStruct extends Struct {
+  pragma[nomagic]
+  ArcStruct() { this.getCanonicalPath() = "alloc::sync::Arc" }
+}
+
+/**
+ * The [`Pin` struct][1].
+ *
+ * [1]: https://doc.rust-lang.org/std/pin/struct.Pin.html
+ */
+class PinStruct extends Struct {
+  pragma[nomagic]
+  PinStruct() { this.getCanonicalPath() = "core::pin::Pin" }
+}

rust/ql/lib/codeql/rust/internal/FunctionType.qll

@@ -0,0 +1,243 @@
+private import rust
+private import TypeInference
+private import PathResolution
+private import Type
+private import TypeMention
+private import codeql.rust.elements.Call
+
+private newtype TFunctionTypePosition =
+  TArgumentFunctionTypePosition(ArgumentPosition pos) or
+  TReturnFunctionTypePosition()
+
+/**
+ * A position of a type related to a function.
+ *
+ * Either `self`, `return`, or a positional parameter index.
+ */
+class FunctionTypePosition extends TFunctionTypePosition {
+  predicate isSelf() { this.asArgumentPosition().isSelf() }
+
+  int asPositional() { result = this.asArgumentPosition().asPosition() }
+
+  predicate isPositional() { exists(this.asPositional()) }
+
+  ArgumentPosition asArgumentPosition() { this = TArgumentFunctionTypePosition(result) }
+
+  predicate isReturn() { this = TReturnFunctionTypePosition() }
+
+  /** Gets the corresponding position when `f` is invoked via a function call. */
+  bindingset[f]
+  FunctionTypePosition getFunctionCallAdjusted(Function f) {
+    this.isReturn() and
+    result = this
+    or
+    if f.hasSelfParam()
+    then
+      this.isSelf() and result.asPositional() = 0
+      or
+      result.asPositional() = this.asPositional() + 1
+    else result = this
+  }
+
+  TypeMention getTypeMention(Function f) {
+    this.isSelf() and
+    result = getSelfParamTypeMention(f.getSelfParam())
+    or
+    result = f.getParam(this.asPositional()).getTypeRepr()
+    or
+    this.isReturn() and
+    result = f.getRetType().getTypeRepr()
+  }
+
+  string toString() {
+    result = this.asArgumentPosition().toString()
+    or
+    this.isReturn() and
+    result = "(return)"
+  }
+}
+
+pragma[nomagic]
+predicate functionTypeAtPath(Function f, FunctionTypePosition pos, TypePath path, Type type) {
+  type = pos.getTypeMention(f).resolveTypeAt(path)
+}
+
+/**
+ * A helper module for implementing `Matching(WithEnvironment)InputSig` with
+ * `DeclarationPosition = AccessPosition = FunctionTypePosition`.
+ */
+module FunctionTypePositionMatchingInput {
+  class DeclarationPosition = FunctionTypePosition;
+
+  class AccessPosition = DeclarationPosition;
+
+  predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
+    apos = dpos
+  }
+}
+
+private newtype TFunctionType =
+  MkFunctionType(Function f, FunctionTypePosition pos, ImplOrTraitItemNode i) {
+    f = i.getAnAssocItem() and
+    exists(pos.getTypeMention(f))
+  } or
+  MkInheritedFunctionType(
+    Function f, FunctionTypePosition pos, ImplOrTraitItemNode parent, ImplOrTraitItemNode i
+  ) {
+    exists(FunctionType inherited |
+      inherited.appliesTo(f, pos, parent) and
+      f = i.getASuccessor(_)
+    |
+      parent = i.(ImplItemNode).resolveTraitTy()
+      or
+      parent = i.(TraitItemNode).resolveABound()
+    )
+  }
+
+/**
+ * The type of a function at a given position, when viewed as a member of a given
+ * trait or `impl` block.
+ *
+ * Example:
+ *
+ * ```rust
+ * trait T1 {
+ *   fn m1(self);              // self1
+ *
+ *   fn m2(self) { ... }       // self2
+ * }
+ *
+ * trait T2 : T1 {
+ *   fn m3(self);              // self3
+ * }
+ *
+ * impl T2 for X {
+ *   fn m1(self) { ... }       // self4
+ *
+ *   fn m3(self) { ... }       // self5
+ * }
+ * ```
+ *
+ * param   | `impl` or trait | type
+ * ------- | --------------- | ----
+ * `self1` | `trait T1`      | `T1`
+ * `self1` | `trait T2`      | `T2`
+ * `self2` | `trait T1`      | `T1`
+ * `self2` | `trait T2`      | `T2`
+ * `self2` | `impl T2 for X` | `X`
+ * `self3` | `trait T2`      | `T2`
+ * `self4` | `impl T2 for X` | `X`
+ * `self5` | `impl T2 for X` | `X`
+ */
+class FunctionType extends TFunctionType {
+  private predicate isFunctionType(Function f, FunctionTypePosition pos, ImplOrTraitItemNode i) {
+    this = MkFunctionType(f, pos, i)
+  }
+
+  private predicate isInheritedFunctionType(
+    Function f, FunctionTypePosition pos, ImplOrTraitItemNode parent, ImplOrTraitItemNode i
+  ) {
+    this = MkInheritedFunctionType(f, pos, parent, i)
+  }
+
+  /**
+   * Holds if this function type applies to the function `f` at position `pos`,
+   * when viewed as a member of the `impl` or trait item `i`.
+   */
+  predicate appliesTo(Function f, FunctionTypePosition pos, ImplOrTraitItemNode i) {
+    this.isFunctionType(f, pos, i)
+    or
+    this.isInheritedFunctionType(f, pos, _, i)
+  }
+
+  pragma[nomagic]
+  private Type getTypeAt0(TypePath path) {
+    exists(Function f, FunctionTypePosition pos |
+      this.isFunctionType(f, pos, _) and
+      functionTypeAtPath(f, pos, path, result)
+    )
+    or
+    exists(
+      Function f, FunctionTypePosition pos, FunctionType parentType, ImplOrTraitItemNode parent,
+      ImplOrTraitItemNode i
+    |
+      this.isInheritedFunctionType(f, pos, parent, i) and
+      parentType.appliesTo(f, pos, parent)
+    |
+      result = parentType.getTypeAt0(path) and
+      not result instanceof TSelfTypeParameter
+      or
+      exists(TypePath prefix, TypePath suffix |
+        parentType.hasSelfTypeParameterAt(prefix) and
+        result = resolveImplOrTraitType(i, suffix) and
+        path = prefix.append(suffix)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSelfTypeParameterAt(TypePath path) {
+    this.getTypeAt0(path) = TSelfTypeParameter(_)
+  }
+
+  /**
+   * Gets the type of this function at the given position and path.
+   *
+   * For functions belonging to a `trait`, we use the type of the trait itself instead
+   * of the implicit `Self` type parameter, as otherwise any type will match.
+   *
+   * Calls should use `substituteLookupTraits` to map receiver types to the relevant
+   * traits when matching.
+   */
+  Type getTypeAt(TypePath path) {
+    exists(Type t | t = this.getTypeAt0(path) |
+      not t instanceof SelfTypeParameter and
+      result = t
+      or
+      result = TTrait(t.(SelfTypeParameter).getTrait())
+    )
+  }
+
+  private AstNode getReportingNode() {
+    exists(Function f, FunctionTypePosition pos | this.appliesTo(f, pos, _) |
+      pos.isSelf() and
+      exists(SelfParam self | self = f.getSelfParam() |
+        result = self.getTypeRepr()
+        or
+        not self.hasTypeRepr() and
+        result = self
+      )
+      or
+      result = f.getParam(pos.asPositional()).getTypeRepr()
+      or
+      pos.isReturn() and
+      result = f.getRetType().getTypeRepr()
+    )
+  }
+
+  string toString() { result = this.getReportingNode().toString() }
+
+  Location getLocation() { result = this.getReportingNode().getLocation() }
+}
+
+private Trait getALookupTrait(Type t) {
+  result = t.(TypeParamTypeParameter).getTypeParam().(TypeParamItemNode).resolveABound()
+  or
+  result = t.(SelfTypeParameter).getTrait()
+  or
+  result = t.(ImplTraitType).getImplTraitTypeRepr().(ImplTraitTypeReprItemNode).resolveABound()
+  or
+  result = t.(DynTraitType).getTrait()
+}
+
+/**
+ * Gets the type obtained by substituting in relevant traits in which to do function
+ * lookup, or `t` itself when no such trait exist.
+ */
+bindingset[t]
+Type substituteLookupTraits(Type t) {
+  not exists(getALookupTrait(t)) and
+  result = t
+  or
+  result = TTrait(getALookupTrait(t))
+}

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -810,7 +810,7 @@ final class ImplItemNode extends ImplOrTraitItemNode instanceof Impl {
   }
 }
 
-final private class ImplTraitTypeReprItemNode extends TypeItemNode instanceof ImplTraitTypeRepr {
+final class ImplTraitTypeReprItemNode extends TypeItemNode instanceof ImplTraitTypeRepr {
   pragma[nomagic]
   Path getABoundPath() {
     result = super.getTypeBoundList().getABound().getTypeRepr().(PathTypeRepr).getPath()
@@ -1914,7 +1914,7 @@ private predicate builtin(string name, ItemNode i) {
 
 /** Provides predicates for debugging the path resolution implementation. */
 private module Debug {
-  private Locatable getRelevantLocatable() {
+  Locatable getRelevantLocatable() {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
       filepath.matches("%/main.rs") and