wip4

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -1238,7 +1238,8 @@ private module MethodCallResolution {
       derefChain = ""
       or
       exists(TypePath path0, Type t0, string derefChain0 |
-        t0 = this.getACandidateReceiverTypeAtNoMatch(path0, derefChain0)
+        this.noCandidateReceiverTypeAt(derefChain0) and
+        t0 = this.getACandidateReceiverTypeAtNoBorrow(path0, derefChain0)
       |
         path0.isCons(TRefTypeParameter(), path) and
         result = t0 and
@@ -1252,23 +1253,29 @@ private module MethodCallResolution {
       )
     }
 
+    /**
+     * Holds if the method inside `i` with matching name and arity can be ruled out
+     * as a candidate for the receiver type represented by `derefChainBorrow`.
+     */
     pragma[nomagic]
     private predicate isNotCandidate(ImplOrTraitItemNode i, string derefChainBorrow) {
       IsInstantiationOf<MethodCallCand, FunctionType, MethodCallIsInstantiationOfInput>::isNotInstantiationOf(MkMethodCallCand(this,
           derefChainBorrow), i, _)
       or
-      // not MethodCallIsInstantiationOfInput::potentialInstantiationOf(mcc, abs, constraint)
       exists(Type rootType, TypePath selfRootPath, Type selfRootType |
         rootType = this.getACandidateReceiverTypeAtSubstituteTraitBounds(derefChainBorrow) and
-        // mcc.isMethodCall(mc, selfPath, selfType, name, arity) and
         methodCallCandidate(this, i, _, rootType, selfRootPath, selfRootType) and
         selfRootType !=
           this.getACandidateReceiverTypeAtSubstituteTraitBounds(selfRootPath, derefChainBorrow)
       )
     }
 
+    /**
+     * Holds if the candidate receiver type represented by `derefChain` does not
+     * have a matching method target.
+     */
     pragma[nomagic]
-    private predicate getACandidateReceiverTypeAtNoBorrowNoMatch0(string derefChain) {
+    private predicate noCandidateReceiverTypeAtNoBorrow(string derefChain) {
       exists(Type rootType, string derefChainBorrow |
         derefChainBorrow = derefChain + ";" and
         not derefChain.matches("%.ref") and // no need to try a borrow if the last thing we did was a deref
@@ -1280,43 +1287,36 @@ private module MethodCallResolution {
       )
     }
 
-    pragma[nomagic]
-    private Type getACandidateReceiverTypeAtNoBorrowNoMatch(TypePath path, string derefChain) {
-      result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
-      this.getACandidateReceiverTypeAtNoBorrowNoMatch0(derefChain)
-    }
-
     pragma[nomagic]
     private predicate hasRefCandidate(ImplOrTraitItemNode i) {
       methodCallCandidate(this, i, _, TRefType(), _, _)
     }
 
+    /**
+     * Holds if the candidate receiver type represented by `derefChain;borrow` does not
+     * have a matching method target.
+     */
     pragma[nomagic]
-    private predicate getACandidateReceiverTypeAtNoMatch0(string derefChain) {
+    private predicate noCandidateReceiverTypeAt(string derefChain) {
       exists(string derefChainBorrow |
         derefChainBorrow = derefChain + ";borrow" and
-        this.getACandidateReceiverTypeAtNoBorrowNoMatch0(derefChain)
+        this.noCandidateReceiverTypeAtNoBorrow(derefChain)
       |
         forall(ImplOrTraitItemNode i | this.hasRefCandidate(i) |
           this.isNotCandidate(i, derefChainBorrow)
         )
       )
     }
 
-    pragma[nomagic]
-    private Type getACandidateReceiverTypeAtNoMatch(TypePath path, string derefChain) {
-      result = this.getACandidateReceiverTypeAtNoBorrowNoMatch(path, derefChain) and
-      this.getACandidateReceiverTypeAtNoMatch0(derefChain)
-    }
-
     /**
      * Gets a [candidate receiver type][1] of this method call at `path`.
      *
      * The type is obtained by repeatedly dereferencing the receiver expression's type,
      * as long as the method cannot be resolved in an earlier candidate type, and possibly
      * applying a borrow at the end.
      *
-     * The string `derefChainBorrow` encodes the above, separated by a semi-colon.
+     * The string `derefChainBorrow` encodes the sequences of dereferences and whether a
+     * borrow has been applied.
      *
      * [1]: https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.candidate-receivers
      */
@@ -1326,19 +1326,24 @@ private module MethodCallResolution {
         result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
         derefChainBorrow = derefChain + ";"
         or
-        exists(TypePath path0, Type t0 |
-          t0 = this.getACandidateReceiverTypeAtNoBorrowNoMatch(path0, derefChain) and
-          derefChainBorrow = derefChain + ";borrow"
-        |
+        this.noCandidateReceiverTypeAtNoBorrow(derefChain) and
+        derefChainBorrow = derefChain + ";borrow" and
+        (
           path.isEmpty() and
           result = TRefType()
           or
-          path = TypePath::cons(TRefTypeParameter(), path0) and
-          result = t0
+          exists(TypePath suffix |
+            result = this.getACandidateReceiverTypeAtNoBorrow(suffix, derefChain) and
+            path = TypePath::cons(TRefTypeParameter(), suffix)
+          )
         )
       )
     }
 
+    /**
+     * Same as `getACandidateReceiverTypeAt`, but with traits substituted in for types
+     * with trait bounds.
+     */
     pragma[nomagic]
     Type getACandidateReceiverTypeAtSubstituteTraitBounds(TypePath path, string derefChainBorrow) {
       result = substituteTraitBounds(this.getACandidateReceiverTypeAt(path, derefChainBorrow))
@@ -1427,19 +1432,16 @@ private module MethodCallResolution {
       mc.isMethodCall(name, arity)
     }
 
+    /**
+     * Holds if the inherent method inside `i` with matching name and arity can be
+     * ruled out as a candidate for this call.
+     */
     pragma[nomagic]
-    private predicate isNotInherentTarget(Impl impl) {
+    private predicate isNotInherentCandidate(Impl impl) {
       IsInstantiationOf<MethodCallCand, FunctionType, MethodCallIsNotInstantiationOfInput>::isNotInstantiationOf(this,
         impl, _)
     }
 
-    // pragma[nomagic]
-    // private predicate blah(
-    //   Type type, Impl i, FunctionType self, TypePath selfRootPath, Type selfRootType
-    // ) {
-    //   not i.hasTrait() and
-    //   mc_.blah(type, i, self, selfPath, selfType, derefChainBorrow)
-    // }
     /**
      * Holds if this method call has no inherent target, i.e., it does not
      * resolve to a method in an `impl` block for the type of the receiver.
@@ -1452,14 +1454,7 @@ private module MethodCallResolution {
           methodInfo(_, name, arity, i, self, rootType, selfRootPath, selfRootType) and
           not i.hasTrait()
         |
-          // this.blah(type, i, self, selfPath, selfType)
-          // or
-          this.isNotInherentTarget(i)
-          // forall(Impl impl |
-          //   methodInfo(type, name, arity, impl, _, _, _) and
-          //   not impl.hasTrait()
-          // |
-          //   this.isNotInherentTarget(impl)
+          this.isNotInherentCandidate(i)
         )
       )
     }
@@ -1518,6 +1513,10 @@ private module MethodCallResolution {
     Location getLocation() { result = mc_.getLocation() }
   }
 
+  /**
+   * A configuration for matching the type of a receiver against the type of
+   * a `self` parameter.
+   */
   private module MethodCallIsInstantiationOfInput implements
     IsInstantiationOfInputSig<MethodCallCand, FunctionType>
   {
@@ -1528,7 +1527,6 @@ private module MethodCallResolution {
       exists(MethodCall mc, string name, int arity, TypePath selfRootPath, Type selfRootType |
         mcc.isMethodCall(mc, selfRootPath, selfRootType, name, arity) and
         methodCallCandidate(mc, abs, constraint, _, selfRootPath, selfRootType)
-        // mc = Debug::getRelevantLocatable()
       )
     }
 
@@ -1537,6 +1535,10 @@ private module MethodCallResolution {
     }
   }
 
+  /**
+   * A configuration for anti-matching the type of a receiver against the type of
+   * a `self` parameter in an inherent method.
+   */
   private module MethodCallIsNotInstantiationOfInput implements
     IsInstantiationOfInputSig<MethodCallCand, FunctionType>
   {
@@ -1548,7 +1550,6 @@ private module MethodCallResolution {
       exists(MethodCall mc, string name, int arity, Type rootType |
         mcc.isMethodCall(mc, TypePath::nil(), rootType, name, arity) and
         methodCallCandidate(mc, abs, constraint, rootType, _, _)
-        // mc = Debug::getRelevantLocatable()
       )
     }
 
@@ -1772,7 +1773,7 @@ private module FunctionCallResolution {
       result = CallExprImpl::getResolvedFunction(this)
     }
 
-    private ItemNode getPathResolutionResolvedFunctionOrImplementation(ItemNode resolved) {
+    ItemNode getPathResolutionResolvedFunctionOrImplementation(ItemNode resolved) {
       resolved = this.getPathResolutionResolvedFunction() and
       (
         result = resolved
@@ -1781,43 +1782,21 @@ private module FunctionCallResolution {
       )
     }
 
-    // The `Self` type is supplied explicitly as a type qualifier, e.g. `Foo::<Bar>::baz()`
-    pragma[nomagic]
-    Type getQualifierType(TypePath path) {
-      exists(PathExpr pe, TypeMention tm |
-        pe = this.getFunction() and
-        tm = pe.getPath().getQualifier() and
-        result = tm.resolveTypeAt(path) and
-        not resolvePath(tm) instanceof Trait
-      )
-    }
-
     pragma[nomagic]
     Type getTypeAt(TypePath path) {
       result = substituteTraitBounds(inferType(this.getArg(0), path))
     }
 
     pragma[nomagic]
-    Function getATraitCandidateMethod0(
-      TraitItemNode trait, ImplOrTraitItemNode i, FunctionType self, Function resolved
-    ) {
-      exists(TypePath selfRootPath, Type selfRootType |
-        result = this.getPathResolutionResolvedFunctionOrImplementation(resolved) and
-        trait = this.(Call).getTrait() and
-        MethodCallResolution::methodInfo(result, _, _, i, self, _, selfRootPath, selfRootType) and
-        this.getTypeAt(selfRootPath) = selfRootType
+    private Function getACandidateTraitMethod() {
+      exists(TraitItemNode trait, ImplOrTraitItemNode i, FunctionType self, Function resolved |
+        FunctionMethodCallIsInstantiationOfInput::potentialInstantiationOf(this, trait, i, self,
+          resolved, result) and
+        IsInstantiationOf<FunctionCall, FunctionType, FunctionMethodCallIsInstantiationOfInput>::isInstantiationOf(this,
+          i, self)
       )
     }
 
-    pragma[nomagic]
-    private Function getATraitCandidateMethod(
-      TraitItemNode trait, ImplOrTraitItemNode i, FunctionType self, Function resolved
-    ) {
-      result = this.getATraitCandidateMethod0(trait, i, self, resolved) and
-      IsInstantiationOf<FunctionCall, FunctionType, FunctionMethodCallIsInstantiationOfInput>::isInstantiationOf(this,
-        i, self)
-    }
-
     pragma[nomagic]
     private Function getAnAmbigousCandidate(FunctionTypePosition pos, TypePath path, Type type) {
       exists(TraitItemNode trait, Function resolved |
@@ -1827,7 +1806,7 @@ private module FunctionCallResolution {
       )
       or
       (
-        result = this.getATraitCandidateMethod(_, _, _, _)
+        result = this.getACandidateTraitMethod()
         or
         not this.(Call).hasTrait() and
         result = this.getPathResolutionResolvedFunction()
@@ -1857,20 +1836,17 @@ private module FunctionCallResolution {
     /**
      * Gets the target of this call, where resolution does not rely on type inference.
      */
-    // inline to reduce non-linear recursion
-    pragma[inline]
+    pragma[nomagic]
     private ItemNode resolveUnambigousFunctionCallTarget() {
       (
-        result = this.getATraitCandidateMethod(_, _, _, _)
+        result = this.getACandidateTraitMethod()
         or
         not this.(Call).hasTrait() and
         result = this.getPathResolutionResolvedFunction()
       ) and
       not functionResolutionDependsOnArgument(_, result, _, _, _)
     }
 
-    // inline to reduce non-linear recursion
-    pragma[inline]
     ItemNode resolveCallTarget() {
       result = this.resolveUnambigousFunctionCallTarget()
       or
@@ -1881,11 +1857,24 @@ private module FunctionCallResolution {
   private module FunctionMethodCallIsInstantiationOfInput implements
     IsInstantiationOfInputSig<FunctionCall, FunctionType>
   {
+    pragma[nomagic]
+    additional predicate potentialInstantiationOf(
+      FunctionCall call, TraitItemNode trait, ImplOrTraitItemNode i, FunctionType self,
+      Function resolved, Function f
+    ) {
+      exists(TypePath selfRootPath, Type selfRootType |
+        f = call.getPathResolutionResolvedFunctionOrImplementation(resolved) and
+        trait = call.(Call).getTrait() and
+        MethodCallResolution::methodInfo(f, _, _, i, self, _, selfRootPath, selfRootType) and
+        call.getTypeAt(selfRootPath) = selfRootType
+      )
+    }
+
     pragma[nomagic]
     predicate potentialInstantiationOf(
       FunctionCall call, TypeAbstraction abs, FunctionType constraint
     ) {
-      exists(call.getATraitCandidateMethod0(_, abs, constraint, _))
+      potentialInstantiationOf(call, _, abs, constraint, _, _)
     }
 
     predicate relevantTypeMention(FunctionType constraint) {
@@ -2069,6 +2058,22 @@ private module FunctionCallMatchingInput implements MatchingInputSig {
       result = this and apos.isReturn()
     }
 
+    /**
+     * Gets the type qualifier of this function call, if any.
+     *
+     * For example, the type qualifier of `Foo::<Bar>::baz()` is `Foo::<Bar>`,
+     * but only when `Foo` is not a trait.
+     */
+    pragma[nomagic]
+    private Type getQualifierType(TypePath path) {
+      exists(PathExpr pe, TypeMention tm |
+        pe = this.getFunction() and
+        tm = pe.getPath().getQualifier() and
+        result = tm.resolveTypeAt(path) and
+        not resolvePath(tm) instanceof Trait
+      )
+    }
+
     pragma[nomagic]
     Type getInferredType(AccessPosition apos, TypePath path) {
       apos.asArgumentPosition().isSelf() and
@@ -2101,7 +2106,6 @@ private Type inferCallExprType(AstNode n, TypePath path) {
 private module OperationResolution {
   /** An operation, `x + y`. */
   final class Op extends Operation {
-    // Op() { none() }
     pragma[nomagic]
     private Type getTypeAt0(TypePath path) {
       if this.(Call).implicitBorrowAt(any(ArgumentPosition pos | pos.isSelf()), true)
@@ -2162,7 +2166,7 @@ private module OperationResolution {
       TypePath selfRootPath, Type selfRootType
     ) {
       MethodCallResolution::methodInfo(_, name, arity, abs, constraint, _, selfRootPath,
-        selfRootType) and //and
+        selfRootType) and
       (
         trait = abs.(ImplItemNode).resolveTraitTy()
         or