wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -1238,6 +1238,22 @@ private Type substituteLookupTraits(Type t) {
   result = TTrait(getALookupTrait(t))
 }
 
+/**
+ * Gets the type qualifier of function call `ce`, if any.
+ *
+ * For example, the type qualifier of `Foo::<i32>::default()` is `Foo::<i32>`,
+ * but only when `Foo` is not a trait.
+ */
+pragma[nomagic]
+private Type getCallExprQualifierType(CallExpr ce, TypePath path) {
+  exists(PathExpr pe, TypeMention tm |
+    pe = ce.getFunction() and
+    tm = pe.getPath().getQualifier() and
+    result = tm.resolveTypeAt(path) and
+    not resolvePath(tm) instanceof Trait
+  )
+}
+
 /**
  * Provides logic for resolving method calls.
  *
@@ -1403,6 +1419,10 @@ private module MethodCallResolution {
     exists(string name, int arity |
       mc.(MethodCall).hasNameAndArity(name, arity) and
       methodTraitInfo(name, arity, trait)
+    |
+      not mc.(Call).hasTrait()
+      or
+      trait = mc.(Call).getTrait()
     )
   }
 
@@ -1492,9 +1512,15 @@ private module MethodCallResolution {
 
     abstract Expr getArgument(ArgumentPosition pos);
 
-    Expr getReceiver() { result = this.getArgument(any(ArgumentPosition pos | pos.isSelf())) }
+    abstract predicate supportsAutoDerefAndBorrow();
 
-    private Type getReceiverTypeAt(TypePath path) { result = inferType(this.getReceiver(), path) }
+    Type getArgumentTypeAt(ArgumentPosition pos, TypePath path) {
+      result = inferType(this.getArgument(pos), path)
+    }
+
+    private Type getReceiverTypeAt(TypePath path) {
+      result = this.getArgumentTypeAt(any(ArgumentPosition pos | pos.isSelf()), path)
+    }
 
     /**
      * Same as `getACandidateReceiverTypeAt`, but without borrows.
@@ -1541,7 +1567,7 @@ private module MethodCallResolution {
     }
 
     pragma[nomagic]
-    private Type getComplexstrippedType(TypePath strippedTypePath, string derefChainBorrow) {
+    private Type getComplexStrippedType(TypePath strippedTypePath, string derefChainBorrow) {
       result =
         this.getACandidateReceiverTypeAtSubstituteLookupTraits(strippedTypePath, derefChainBorrow) and
       isComplexRootStripped(strippedTypePath, result)
@@ -1553,10 +1579,11 @@ private module MethodCallResolution {
      */
     pragma[nomagic]
     private predicate hasNoCompatibleTargetNoBorrow(string derefChain) {
+      this.supportsAutoDerefAndBorrow() and
       exists(TypePath strippedTypePath, Type strippedType, string derefChainBorrow |
         derefChainBorrow = derefChain + ";" and
         not derefChain.matches("%.ref") and // no need to try a borrow if the last thing we did was a deref
-        strippedType = this.getComplexstrippedType(strippedTypePath, derefChainBorrow)
+        strippedType = this.getComplexStrippedType(strippedTypePath, derefChainBorrow)
       |
         // todo: also check that all blanket implementation candidates are incompatible
         forall(ImplOrTraitItemNode i |
@@ -1576,7 +1603,7 @@ private module MethodCallResolution {
       exists(TypePath strippedTypePath, Type strippedType, string derefChainBorrow |
         derefChainBorrow = derefChain + ";borrow" and
         this.hasNoCompatibleTargetNoBorrow(derefChain) and
-        strippedType = this.getComplexstrippedType(strippedTypePath, derefChainBorrow)
+        strippedType = this.getComplexStrippedType(strippedTypePath, derefChainBorrow)
       |
         // todo: also check that all blanket implementation candidates are incompatible
         forall(ImplOrTraitItemNode i |
@@ -1656,6 +1683,8 @@ private module MethodCallResolution {
       or
       result = super.getArgList().getArg(pos.asPosition())
     }
+
+    override predicate supportsAutoDerefAndBorrow() { any() }
   }
 
   private class MethodCallIndexExpr extends MethodCall, IndexExpr {
@@ -1672,6 +1701,29 @@ private module MethodCallResolution {
       pos.asPosition() = 0 and
       result = this.getIndex()
     }
+
+    override predicate supportsAutoDerefAndBorrow() { any() }
+  }
+
+  private class MethodCallCallExpr extends MethodCall, CallExpr {
+    MethodCallCallExpr() { CallExprImpl::getResolvedFunction(this).(Function).hasSelfParam() }
+
+    pragma[nomagic]
+    override predicate hasNameAndArity(string name, int arity) {
+      name = CallExprImpl::getFunctionPath(this).getText() and
+      arity = this.getArgList().getNumberOfArgs() - 1
+    }
+
+    override Expr getArgument(ArgumentPosition pos) {
+      pos.isSelf() and
+      result = this.getArg(0)
+      or
+      result = this.getArgList().getArg(pos.asPosition() + 1)
+    }
+
+    Type getTypeAt(TypePath path) { result = getCallExprQualifierType(this, path) }
+
+    override predicate supportsAutoDerefAndBorrow() { none() }
   }
 
   private newtype TMethodCallCand =
@@ -1733,7 +1785,11 @@ private module MethodCallResolution {
     private Function resolveCallTargetCand(ImplOrTraitItemNode i) {
       exists(string name |
         IsInstantiationOf<MethodCallCand, FunctionType, MethodCallReceiverIsInstantiationOfInput>::isInstantiationOf(this,
-          i, _) and
+          i, _)
+        or
+        IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, MethodCallCallExprIsInstantiationOfInput>::isInstantiationOf(mc_,
+          i, _)
+      |
         mc_.hasNameAndArity(name, _) and
         result = getMethodSuccessor(i, name, _) and
         if i.(Impl).hasTrait()
@@ -1827,6 +1883,28 @@ private module MethodCallResolution {
     }
   }
 
+  /**
+   * A configuration for matching the type of a receiver against the type of
+   * a `self` parameter.
+   */
+  private module MethodCallCallExprIsInstantiationOfInput implements
+    IsInstantiationOfInputSig<MethodCallCallExpr, TypeMentionTypeTree>
+  {
+    pragma[nomagic]
+    predicate potentialInstantiationOf(
+      MethodCallCallExpr ce, TypeAbstraction abs, TypeMentionTypeTree constraint
+    ) {
+      abs =
+        any(ImplItemNode impl |
+          CallExprImpl::getResolvedFunction(ce) = impl.getASuccessor(_) and
+          constraint = impl.getSelfPath()
+        )
+    }
+    // predicate relevantTypeMention(FunctionType constraint) {
+    //   methodInfo(_, _, _, _, constraint, _, _)
+    // }
+  }
+
   /**
    * A configuration for anti-matching the type of a receiver against the type of
    * a `self` parameter in an inherent method.
@@ -2073,6 +2151,8 @@ private module FunctionCallResolution {
 
   /** A function call, `f(x)`. */
   final class FunctionCall extends CallExpr {
+    FunctionCall() { not this instanceof MethodCallResolution::MethodCall }
+
     /**
      * Gets the item that this function call resolves to using path resolution,
      * if any.
@@ -2412,26 +2492,10 @@ private module FunctionCallMatchingInput implements MatchingInputSig {
       result = this and apos.isReturn()
     }
 
-    /**
-     * Gets the type qualifier of this function call, if any.
-     *
-     * For example, the type qualifier of `Foo::<i32>::default()` is `Foo::<i32>`,
-     * but only when `Foo` is not a trait.
-     */
-    pragma[nomagic]
-    private Type getQualifierType(TypePath path) {
-      exists(PathExpr pe, TypeMention tm |
-        pe = this.getFunction() and
-        tm = pe.getPath().getQualifier() and
-        result = tm.resolveTypeAt(path) and
-        not resolvePath(tm) instanceof Trait
-      )
-    }
-
     pragma[nomagic]
     Type getInferredType(AccessPosition apos, TypePath path) {
       apos.asArgumentPosition().isSelf() and
-      result = this.getQualifierType(path)
+      result = getCallExprQualifierType(this, path)
       or
       result = inferType(this.getNodeAt(apos), path)
     }