Merge pull request #10111 from github/redsun82/swift-add-methodrefexpr

Swift: synthesize `MethodRefExpr`

Author: redsun82

swift/codegen/generators/qlgen.py

@@ -275,21 +275,25 @@ def generate(opts, renderer):
     non_final_ipa_types = []
     constructor_imports = []
     ipa_constructor_imports = []
+    stubs = {}
     for cls in sorted(data.classes.values(), key=lambda cls: (cls.dir, cls.name)):
         ipa_type = get_ql_ipa_class(cls)
         if ipa_type.is_final:
             final_ipa_types.append(ipa_type)
             if ipa_type.has_params:
                 stub_file = stub_out / cls.dir / f"{cls.name}Constructor.qll"
                 if not stub_file.is_file() or _is_generated_stub(stub_file):
-                    renderer.render(ql.Synth.ConstructorStub(ipa_type), stub_file)
+                    # stub rendering must be postponed as we might not have yet all subtracted ipa types in `ipa_type`
+                    stubs[stub_file] = ql.Synth.ConstructorStub(ipa_type)
                 constructor_import = get_import(stub_file, opts.swift_dir)
                 constructor_imports.append(constructor_import)
                 if ipa_type.is_ipa:
                     ipa_constructor_imports.append(constructor_import)
         else:
             non_final_ipa_types.append(ipa_type)
 
+    for stub_file, data in stubs.items():
+        renderer.render(data, stub_file)
     renderer.render(ql.Synth.Types(schema.root_class_name, final_ipa_types, non_final_ipa_types), out / "Synth.qll")
     renderer.render(ql.ImportList(constructor_imports), out / "SynthConstructors.qll")
     renderer.render(ql.ImportList(ipa_constructor_imports), out / "PureSynthConstructors.qll")

swift/codegen/schema.yml

@@ -419,7 +419,7 @@ DotSyntaxBaseIgnoredExpr:
 DynamicTypeExpr:
   _extends: Expr
   _children:
-    base_expr: Expr
+    base: Expr
 
 EditorPlaceholderExpr:
   _extends: Expr
@@ -492,7 +492,7 @@ LiteralExpr:
 LookupExpr:
   _extends: Expr
   _children:
-    base_expr: Expr
+    base: Expr
   member: Decl?
 
 MakeTemporarilyEscapableExpr:
@@ -835,7 +835,7 @@ PrefixUnaryExpr:
 SelfApplyExpr:
   _extends: ApplyExpr
   _children:
-    base_expr: Expr
+    base: Expr
 
 ArrayExpr:
   _extends: CollectionExpr
@@ -990,6 +990,11 @@ MemberRefExpr:
   has_direct_to_implementation_semantics: predicate
   has_ordinary_semantics: predicate
 
+MethodRefExpr:
+  _extends: LookupExpr
+  _synth:
+    from: DotSyntaxCallExpr
+
 SubscriptExpr:
   _extends:
     - LookupExpr

swift/ql/lib/codeql/swift/controlflow/internal/ControlFlowGraphImpl.qll

@@ -1206,13 +1206,13 @@ module Exprs {
     override SubscriptExpr ast;
 
     final override predicate propagatesAbnormal(ControlFlowElement child) {
-      child.asAstNode() = ast.getBaseExpr().getFullyConverted()
+      child.asAstNode() = ast.getBase().getFullyConverted()
       or
       child.asAstNode() = ast.getAnArgument().getExpr().getFullyConverted()
     }
 
     final override predicate first(ControlFlowElement first) {
-      astFirst(ast.getBaseExpr().getFullyConverted(), first)
+      astFirst(ast.getBase().getFullyConverted(), first)
     }
 
     final override predicate last(ControlFlowElement last, Completion c) {
@@ -1230,7 +1230,7 @@ module Exprs {
     }
 
     override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-      astLast(ast.getBaseExpr().getFullyConverted(), pred, c) and
+      astLast(ast.getBase().getFullyConverted(), pred, c) and
       c instanceof NormalCompletion and
       astFirst(ast.getFirstArgument().getExpr().getFullyConverted(), succ)
       or
@@ -1296,7 +1296,7 @@ module Exprs {
     override DynamicTypeExpr ast;
 
     final override ControlFlowElement getChildElement(int i) {
-      result.asAstNode() = ast.getBaseExpr().getFullyConverted() and i = 0
+      result.asAstNode() = ast.getBase().getFullyConverted() and i = 0
     }
   }
 
@@ -1427,6 +1427,14 @@ module Exprs {
     }
   }
 
+  class MethodRefExprTree extends AstStandardPreOrderTree {
+    override MethodRefExpr ast;
+
+    override ControlFlowElement getChildElement(int i) {
+      i = 0 and result.asAstNode() = ast.getBase().getFullyConverted()
+    }
+  }
+
   module MemberRefs {
     /**
      * The control-flow of a member reference expression.
@@ -1439,11 +1447,11 @@ module Exprs {
       override MemberRefExpr ast;
 
       final override predicate propagatesAbnormal(ControlFlowElement child) {
-        child.asAstNode() = ast.getBaseExpr().getFullyConverted()
+        child.asAstNode() = ast.getBase().getFullyConverted()
       }
 
       final override predicate first(ControlFlowElement first) {
-        astFirst(ast.getBaseExpr().getFullyConverted(), first)
+        astFirst(ast.getBase().getFullyConverted(), first)
       }
     }
 
@@ -1459,7 +1467,7 @@ module Exprs {
       }
 
       override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-        astLast(ast.getBaseExpr().getFullyConverted(), pred, c) and
+        astLast(ast.getBase().getFullyConverted(), pred, c) and
         c instanceof NormalCompletion and
         succ.asAstNode() = ast
       }
@@ -1489,7 +1497,7 @@ module Exprs {
       }
 
       override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-        astLast(ast.getBaseExpr().getFullyConverted(), pred, c) and
+        astLast(ast.getBase().getFullyConverted(), pred, c) and
         c instanceof NormalCompletion and
         succ.asAstNode() = ast
       }
@@ -1510,7 +1518,7 @@ module Exprs {
       }
 
       override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-        astLast(ast.getBaseExpr().getFullyConverted(), pred, c) and
+        astLast(ast.getBase().getFullyConverted(), pred, c) and
         c instanceof NormalCompletion and
         isPropertyGetterElement(succ, accessor, ast)
       }

swift/ql/lib/codeql/swift/dataflow/Ssa.qll

@@ -86,11 +86,11 @@ module Ssa {
     predicate isInoutDef(ExprCfgNode argument) {
       // TODO: This should probably not be only `ExprCfgNode`s.
       exists(
-        ApplyExpr c, BasicBlock bb, int blockIndex, int argIndex, VarDecl v, InOutExpr argExpr // TODO: use CFG node for assignment expr
+        ApplyExpr c, BasicBlock bb, int blockIndex, VarDecl v, InOutExpr argExpr // TODO: use CFG node for assignment expr
       |
         this.definesAt(v, bb, blockIndex) and
         bb.getNode(blockIndex).getNode().asAstNode() = c and
-        c.getArgument(argIndex).getExpr() = argExpr and
+        [c.getAnArgument().getExpr(), c.getQualifier()] = argExpr and
         argExpr = argument.getNode().asAstNode() and
         argExpr.getSubExpr() = v.getAnAccess() // TODO: fields?
       )

swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -154,9 +154,7 @@ class InterpretNode extends TInterpretNode {
   DataFlowCallable asCallable() { result.getUnderlyingCallable() = this.asElement() }
 
   /** Gets the target of this call, if any. */
-  AbstractFunctionDecl getCallTarget() {
-    result = this.asCall().asCall().getFunction().(ApplyExpr).getStaticTarget()
-  }
+  AbstractFunctionDecl getCallTarget() { result = this.asCall().asCall().getStaticTarget() }
 
   /** Gets a textual representation of this node. */
   string toString() {

swift/ql/lib/codeql/swift/dataflow/internal/SsaImplSpecific.qll

@@ -29,9 +29,9 @@ predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain)
     certain = true
   )
   or
-  exists(ApplyExpr call, Argument arg |
-    arg.getExpr().(InOutExpr).getSubExpr() = v.getAnAccess() and
-    call.getAnArgument() = arg and
+  exists(ApplyExpr call, InOutExpr expr |
+    expr = [call.getAnArgument().getExpr(), call.getQualifier()] and
+    expr.getSubExpr() = v.getAnAccess() and
     bb.getNode(i).getNode().asAstNode() = call and
     certain = false
   )

swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll

@@ -28,11 +28,10 @@ private module Cached {
     // appendInterpolation(&$interpolated, n)
     // appendLiteral(&$interpolated, " years old.")
     // ```
-    exists(ApplyExpr apply1, ApplyExpr apply2, ExprCfgNode e |
-      nodeFrom.asExpr() = [apply1, apply2].getAnArgument().getExpr() and
-      apply1.getFunction() = apply2 and
-      apply2.getStaticTarget().getName() = ["appendLiteral(_:)", "appendInterpolation(_:)"] and
-      e.getExpr() = apply2.getAnArgument().getExpr() and
+    exists(ApplyExpr apply, ExprCfgNode e |
+      nodeFrom.asExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
+      apply.getStaticTarget().getName() = ["appendLiteral(_:)", "appendInterpolation(_:)"] and
+      e.getExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
       nodeTo.asDefinition().(Ssa::WriteDefinition).isInoutDef(e)
     )
     or

swift/ql/lib/codeql/swift/elements.qll

@@ -137,6 +137,7 @@ import codeql.swift.elements.expr.MagicIdentifierLiteralExpr
 import codeql.swift.elements.expr.MakeTemporarilyEscapableExpr
 import codeql.swift.elements.expr.MemberRefExpr
 import codeql.swift.elements.expr.MetatypeConversionExpr
+import codeql.swift.elements.expr.MethodRefExpr
 import codeql.swift.elements.expr.NilLiteralExpr
 import codeql.swift.elements.expr.NumberLiteralExpr
 import codeql.swift.elements.expr.ObjCSelectorExpr

swift/ql/lib/codeql/swift/elements/expr/ApplyExpr.qll

@@ -1,9 +1,23 @@
 private import codeql.swift.generated.expr.ApplyExpr
 private import codeql.swift.elements.decl.AbstractFunctionDecl
 private import codeql.swift.elements.expr.DeclRefExpr
+private import codeql.swift.elements.expr.MethodRefExpr
+private import codeql.swift.elements.expr.ConstructorRefCallExpr
 
 class ApplyExpr extends ApplyExprBase {
-  AbstractFunctionDecl getStaticTarget() { result = this.getFunction().(DeclRefExpr).getDecl() }
+  AbstractFunctionDecl getStaticTarget() {
+    exists(Expr f |
+      f = this.getFunction() and
+      (
+        result = f.(DeclRefExpr).getDecl()
+        or
+        result = f.(ConstructorRefCallExpr).getFunction().(DeclRefExpr).getDecl()
+      )
+    )
+  }
+
+  /** Gets the method qualifier, if this is applying a method */
+  Expr getQualifier() { none() }
 
   override string toString() {
     result = "call to " + this.getStaticTarget().toString()
@@ -12,3 +26,13 @@ class ApplyExpr extends ApplyExprBase {
     result = "call to ..."
   }
 }
+
+class MethodApplyExpr extends ApplyExpr {
+  private MethodRefExpr method;
+
+  MethodApplyExpr() { method = this.getFunction() }
+
+  override AbstractFunctionDecl getStaticTarget() { result = method.getMethod() }
+
+  override Expr getQualifier() { result = method.getBase() }
+}

swift/ql/lib/codeql/swift/elements/expr/ArithmeticOperation.qll

@@ -48,7 +48,7 @@ class BinaryArithmeticOperation extends BinaryExpr {
  * ```
  */
 class AddExpr extends BinaryExpr {
-  AddExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "+(_:_:)" }
+  AddExpr() { this.getStaticTarget().getName() = "+(_:_:)" }
 }
 
 /**
@@ -58,7 +58,7 @@ class AddExpr extends BinaryExpr {
  * ```
  */
 class SubExpr extends BinaryExpr {
-  SubExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "-(_:_:)" }
+  SubExpr() { this.getStaticTarget().getName() = "-(_:_:)" }
 }
 
 /**
@@ -68,7 +68,7 @@ class SubExpr extends BinaryExpr {
  * ```
  */
 class MulExpr extends BinaryExpr {
-  MulExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "*(_:_:)" }
+  MulExpr() { this.getStaticTarget().getName() = "*(_:_:)" }
 }
 
 /**
@@ -78,7 +78,7 @@ class MulExpr extends BinaryExpr {
  * ```
  */
 class DivExpr extends BinaryExpr {
-  DivExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "/(_:_:)" }
+  DivExpr() { this.getStaticTarget().getName() = "/(_:_:)" }
 }
 
 /**
@@ -88,7 +88,7 @@ class DivExpr extends BinaryExpr {
  * ```
  */
 class RemExpr extends BinaryExpr {
-  RemExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "%(_:_:)" }
+  RemExpr() { this.getStaticTarget().getName() = "%(_:_:)" }
 }
 
 /**
@@ -108,5 +108,5 @@ class UnaryArithmeticOperation extends PrefixUnaryExpr {
  * ```
  */
 class UnaryMinusExpr extends PrefixUnaryExpr {
-  UnaryMinusExpr() { this.getFunction().(DotSyntaxCallExpr).getStaticTarget().getName() = "-(_:)" }
+  UnaryMinusExpr() { this.getStaticTarget().getName() = "-(_:)" }
 }