wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -4,6 +4,7 @@
 
 private import rust
 private import codeql.rust.elements.internal.generated.ParentChild
+private import codeql.rust.elements.internal.CallExprImpl::Impl as CallExprImpl
 private import codeql.rust.internal.CachedStages
 private import codeql.rust.frameworks.stdlib.Builtins as Builtins
 private import codeql.util.Option
@@ -604,7 +605,13 @@ private class EnumItemNode extends TypeItemNode instanceof Enum {
   }
 }
 
-private class VariantItemNode extends ItemNode instanceof Variant {
+/** An item that can be called with arguments. */
+abstract class CallableItemNode extends ItemNode {
+  /** Gets the number of parameters of this item. */
+  abstract int getNumberOfParameters();
+}
+
+private class VariantItemNode extends CallableItemNode instanceof Variant {
   override string getName() { result = Variant.super.getName().getText() }
 
   override Namespace getNamespace() {
@@ -617,6 +624,10 @@ private class VariantItemNode extends ItemNode instanceof Variant {
 
   override Visibility getVisibility() { result = super.getEnum().getVisibility() }
 
+  override int getNumberOfParameters() {
+    result = super.getFieldList().(TupleFieldList).getNumberOfFields()
+  }
+
   override predicate hasCanonicalPath(Crate c) { this.hasCanonicalPathPrefix(c) }
 
   bindingset[c]
@@ -638,7 +649,7 @@ private class VariantItemNode extends ItemNode instanceof Variant {
   }
 }
 
-class FunctionItemNode extends AssocItemNode instanceof Function {
+class FunctionItemNode extends AssocItemNode, CallableItemNode instanceof Function {
   override string getName() { result = Function.super.getName().getText() }
 
   override predicate hasImplementation() { Function.super.hasImplementation() }
@@ -648,6 +659,13 @@ class FunctionItemNode extends AssocItemNode instanceof Function {
   override TypeParam getTypeParam(int i) { result = super.getGenericParamList().getTypeParam(i) }
 
   override Visibility getVisibility() { result = Function.super.getVisibility() }
+
+  override int getNumberOfParameters() {
+    exists(int arr |
+      arr = super.getNumberOfParams() and
+      if super.hasSelfParam() then result = arr + 1 else result = arr
+    )
+  }
 }
 
 abstract class ImplOrTraitItemNode extends ItemNode {
@@ -867,7 +885,7 @@ private class ImplItemNodeImpl extends ImplItemNode {
   TraitItemNode resolveTraitTyCand() { result = resolvePathCand(this.getTraitPath()) }
 }
 
-private class StructItemNode extends TypeItemNode instanceof Struct {
+private class StructItemNode extends TypeItemNode, CallableItemNode instanceof Struct {
   override string getName() { result = Struct.super.getName().getText() }
 
   override Namespace getNamespace() {
@@ -879,6 +897,10 @@ private class StructItemNode extends TypeItemNode instanceof Struct {
 
   override Visibility getVisibility() { result = Struct.super.getVisibility() }
 
+  override int getNumberOfParameters() {
+    result = super.getFieldList().(TupleFieldList).getNumberOfFields()
+  }
+
   override TypeParam getTypeParam(int i) { result = super.getGenericParamList().getTypeParam(i) }
 
   override predicate hasCanonicalPath(Crate c) { this.hasCanonicalPathPrefix(c) }
@@ -1719,6 +1741,14 @@ private ItemNode resolvePathCand(RelevantPath path) {
     or
     not pathUsesNamespace(path, _) and
     not path = any(MacroCall mc).getPath()
+  ) and
+  (
+    not path = CallExprImpl::getFunctionPath(_)
+    or
+    exists(CallExpr ce |
+      path = CallExprImpl::getFunctionPath(ce) and
+      result.(CallableItemNode).getNumberOfParameters() = ce.getNumberOfArgs()
+    )
   )
 }
 

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -871,11 +871,6 @@ private module FunctionOverloading {
     Impl impl, TraitItemNode trait, Type rootType, TypeMention selfTy
   ) {
     trait = impl.(ImplItemNode).resolveTraitTy() and
-    // If `impl` has an expansion from a macro attribute, then it's been
-    // superseded by the output of the expansion (and usually the expansion
-    // contains the same `impl` block so considering both would give spurious
-    // siblings).
-    not exists(impl.getAttributeMacroExpansion()) and
     selfTy = impl.getSelfTy() and
     rootType = selfTy.resolveType()
   }
@@ -1380,8 +1375,8 @@ private module MethodCallResolution {
 
   /**
    * Holds if method `m` with the name `name` and the arity `arity` exists in
-   * [blanket implementation][1] `i` and the type of the `self` parameter is
-   * `selfType`.
+   * [blanket implementation][1] `impl` of `trait`, and the type of the `self`
+   * parameter is`selfType`.
    *
    * `blanketPath` points to the type `blanketTypeParam` inside `selfType`, which
    * is the type parameter used in the blanket implementation.
@@ -1390,11 +1385,13 @@ private module MethodCallResolution {
    */
   pragma[nomagic]
   predicate methodInfoBlanket(
-    Function m, string name, int arity, ImplItemNode i, FunctionType selfType, TypePath blanketPath,
-    TypeParam blanketTypeParam
+    Function m, string name, int arity, ImplItemNode impl, Trait trait, FunctionType selfType,
+    TypePath blanketPath, TypeParam blanketTypeParam
   ) {
-    methodInfoTypeParam(m, name, arity, i, selfType, blanketPath, blanketTypeParam) and
-    blanketTypeParam = i.getBlanketImplementationTypeParam()
+    methodInfo(m, name, arity, impl, selfType, _, _) and
+    TTypeParamTypeParameter(blanketTypeParam) = selfType.getTypeAt(blanketPath) and
+    blanketTypeParam = impl.getBlanketImplementationTypeParam() and
+    trait = impl.resolveTraitTy()
   }
 
   pragma[nomagic]
@@ -1479,7 +1476,7 @@ private module MethodCallResolution {
   ) {
     exists(string name, int arity |
       mc.hasNameAndArity(name, arity) and
-      methodInfoBlanket(m, name, arity, i, self, blanketPath, blanketTypeParam)
+      methodInfoBlanket(m, name, arity, i, _, self, blanketPath, blanketTypeParam)
     |
       methodCallVisibleImplTraitCandidate(mc, i)
       or
@@ -1702,7 +1699,7 @@ private module MethodCallResolution {
     }
 
     pragma[nomagic]
-    predicate hasInfo(
+    predicate hasSignature(
       MethodCall mc, TypePath strippedTypePath, Type strippedType, string name, int arity
     ) {
       strippedType = this.getTypeAt(strippedTypePath) and
@@ -1728,7 +1725,7 @@ private module MethodCallResolution {
     pragma[nomagic]
     predicate hasNoInherentTarget() {
       exists(TypePath strippedTypePath, Type strippedType, string name, int arity |
-        this.hasInfo(_, strippedTypePath, strippedType, name, arity) and
+        this.hasSignature(_, strippedTypePath, strippedType, name, arity) and
         forall(Impl i |
           methodInfoNonBlanket(_, name, arity, i, _, strippedTypePath, strippedType) and
           not i.hasTrait()
@@ -1800,7 +1797,7 @@ private module MethodCallResolution {
       MethodCallCand mcc, Function m, TypePath blanketPath, TypeParam blanketTypeParam
     ) {
       exists(MethodCall mc, string name, int arity |
-        mcc.hasInfo(mc, _, _, name, arity) and
+        mcc.hasSignature(mc, _, _, name, arity) and
         methodCallBlanketCandidate(mc, m, _, _, blanketPath, blanketTypeParam)
       )
     }
@@ -1821,7 +1818,7 @@ private module MethodCallResolution {
         MethodCall mc, Function m, string name, int arity, TypePath strippedTypePath,
         Type strippedType
       |
-        mcc.hasInfo(mc, strippedTypePath, strippedType, name, arity)
+        mcc.hasSignature(mc, strippedTypePath, strippedType, name, arity)
       |
         methodCallNonBlanketCandidate(mc, m, abs, constraint, strippedTypePath, strippedType)
         or
@@ -2035,7 +2032,21 @@ private Type inferMethodCallExprType(AstNode n, TypePath path) {
   )
 }
 
-/** Provides logic for resolving function calls. */
+/**
+ * Provides logic for resolving function calls.
+ *
+ * We distinguish between three cases:
+ *
+ * 1. The qualifier of the function call is _not_ a trait, and the function call
+ *    can be resolved using path resolution. In this case we use the resolved
+ *    function directly, we do not even check the receiver type in case the resolved
+ *    function is a method.
+ *
+ * 2. The qualifier of the function call _is_ a trait, and the function call can be
+ *    resolved using path resolution. In this case we use the resolved function
+ *  directly, we do not even check the receiver type in case the resolved
+ *    function is a method.
+ */
 private module FunctionCallResolution {
   private import FunctionOverloading
 
@@ -2068,7 +2079,11 @@ private module FunctionCallResolution {
 
   /** A function call, `f(x)`. */
   final class FunctionCall extends CallExpr {
-    private ItemNode getPathResolutionResolvedFunction() {
+    /**
+     * Gets the item that this function call resolves to using path resolution,
+     * if any.
+     */
+    ItemNode getPathResolutionResolvedFunction() {
       result = CallExprImpl::getResolvedFunction(this)
     }
 
@@ -2078,7 +2093,7 @@ private module FunctionCallResolution {
     }
 
     pragma[nomagic]
-    predicate hasInfo(
+    predicate hasSignature(
       TypePath strippedTypePath, Type strippedType, TraitItemNode trait, Function resolved
     ) {
       this.getTypeAt(strippedTypePath) = strippedType and
@@ -2089,9 +2104,8 @@ private module FunctionCallResolution {
 
     pragma[nomagic]
     private Function getATargetMethodCand() {
-      exists(TraitItemNode trait, ImplOrTraitItemNode i, FunctionType self |
-        FunctionMethodCallIsInstantiationOfInput::potentialInstantiationOf(this, trait, i, self,
-          result) and
+      exists(ImplOrTraitItemNode i, FunctionType self |
+        FunctionMethodCallIsInstantiationOfInput::potentialInstantiationOf(this, i, self, result) and
         IsInstantiationOf<FunctionCall, FunctionType, FunctionMethodCallIsInstantiationOfInput>::isInstantiationOf(this,
           i, self)
       )
@@ -2156,6 +2170,43 @@ private module FunctionCallResolution {
     }
   }
 
+  private module SatisfiesBlanketConstraintInput implements
+    MethodCallResolution::BlanketImplementation::SatisfiesBlanketConstraintInputSig<FunctionCall>
+  {
+    pragma[nomagic]
+    private predicate hasSignature(FunctionCall call, string name, int arity) {
+      name = CallExprImpl::getFunctionPath(call).getText() and
+      arity = call.getNumberOfArgs() - 1
+    }
+
+    pragma[nomagic]
+    private predicate hasBlanketCandidate(
+      FunctionCall call, Trait trait, Function m, TypePath blanketPath, TypeParam blanketTypeParam
+    ) {
+      not exists(call.getPathResolutionResolvedFunction()) and
+      exists(string name, int arity, ImplItemNode impl |
+        hasSignature(call, name, arity) and
+        MethodCallResolution::methodInfoBlanket(m, name, arity, impl, trait, _, blanketPath,
+          blanketTypeParam)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate functionCallTraitCandidate(Element mc, Trait trait) {
+      hasBlanketCandidate(mc, trait, _, _, _)
+    }
+
+    pragma[nomagic]
+    predicate hasBlanketCandidate(
+      FunctionCall call, Function m, TypePath blanketPath, TypeParam blanketTypeParam
+    ) {
+      exists(Trait trait |
+        hasBlanketCandidate(call, trait, m, blanketPath, blanketTypeParam) and
+        TraitIsVisible<functionCallTraitCandidate/2>::traitIsVisible(call, trait)
+      )
+    }
+  }
+
   /**
    * A configuration for matching the type of the first argument in a function call
    * against the type of a `self` parameter.
@@ -2195,15 +2246,21 @@ private module FunctionCallResolution {
 
     pragma[nomagic]
     additional predicate potentialInstantiationOf(
-      FunctionCall call, TraitItemNode trait, ImplOrTraitItemNode i, FunctionType selfType,
-      Function f
+      FunctionCall call, ImplOrTraitItemNode i, FunctionType selfType, Function f
     ) {
-      exists(Function resolved, TypePath strippedTypePath, Type strippedType |
-        call.hasInfo(strippedTypePath, strippedType, trait, resolved)
-      |
-        methodInfo(strippedTypePath, strippedType, trait, f, resolved)
+      (
+        exists(
+          TraitItemNode trait, Function resolved, TypePath strippedTypePath, Type strippedType
+        |
+          call.hasSignature(strippedTypePath, strippedType, trait, resolved)
+        |
+          methodInfo(strippedTypePath, strippedType, trait, f, resolved)
+          or
+          methodInfoTypeParam(strippedTypePath, trait, f, resolved)
+        )
         or
-        methodInfoTypeParam(strippedTypePath, trait, f, resolved)
+        MethodCallResolution::BlanketImplementation::SatisfiesBlanketConstraint<FunctionCall, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(call,
+          f)
       ) and
       MethodCallResolution::methodInfo(f, _, _, i, selfType, _, _)
     }
@@ -2212,7 +2269,7 @@ private module FunctionCallResolution {
     predicate potentialInstantiationOf(
       FunctionCall call, TypeAbstraction abs, FunctionType constraint
     ) {
-      potentialInstantiationOf(call, _, abs, constraint, _)
+      potentialInstantiationOf(call, abs, constraint, _)
     }
 
     predicate relevantTypeMention(FunctionType constraint) {
@@ -2423,7 +2480,7 @@ private module OperationResolution {
     Type getTypeAt(TypePath path) { result = substituteLookupTraits(this.getTypeAt0(path)) }
 
     pragma[nomagic]
-    predicate hasInfo(
+    predicate hasSignature(
       TypePath strippedTypePath, Type strippedType, Trait trait, string name, int arity
     ) {
       name = this.(Call).getMethodName() and
@@ -2461,18 +2518,31 @@ private module OperationResolution {
     }
   }
 
+  private module SatisfiesBlanketConstraintInput implements
+    MethodCallResolution::BlanketImplementation::SatisfiesBlanketConstraintInputSig<Op>
+  {
+    pragma[nomagic]
+    predicate hasBlanketCandidate(
+      Op op, Function m, TypePath blanketPath, TypeParam blanketTypeParam
+    ) {
+      exists(Trait trait, string name, int arity, ImplItemNode impl |
+        op.hasSignature(_, _, trait, name, arity) and
+        MethodCallResolution::methodInfoBlanket(m, name, arity, impl, trait, _, blanketPath,
+          blanketTypeParam)
+      )
+    }
+  }
+
   private module OperationIsInstantiationOfInput implements
     IsInstantiationOfInputSig<Op, FunctionType>
   {
-    // todo
     bindingset[strippedTypePath]
     private predicate methodInfoNonBlanket(
       TypeAbstraction abs, FunctionType constraint, Trait trait, string name, int arity,
       TypePath strippedTypePath, Type strippedType
     ) {
       MethodCallResolution::methodInfoNonBlanket(_, name, arity, abs, constraint, strippedTypePath,
         strippedType) and
-      not abs.(ImplItemNode).isBlanketImplementation() and
       (
         trait = abs.(ImplItemNode).resolveTraitTy()
         or
@@ -2483,9 +2553,15 @@ private module OperationResolution {
     pragma[nomagic]
     predicate potentialInstantiationOf(Op op, TypeAbstraction abs, FunctionType constraint) {
       exists(Trait trait, string name, int arity, TypePath strippedTypePath, Type strippedType |
-        op.hasInfo(strippedTypePath, strippedType, trait, name, arity) and
+        op.hasSignature(strippedTypePath, strippedType, trait, name, arity) and
         methodInfoNonBlanket(abs, constraint, trait, name, arity, strippedTypePath, strippedType)
       )
+      or
+      exists(Function m |
+        MethodCallResolution::methodInfoBlanket(m, _, _, abs, _, constraint, _, _) and
+        MethodCallResolution::BlanketImplementation::SatisfiesBlanketConstraint<Op, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(op,
+          m)
+      )
     }
 
     predicate relevantTypeMention(FunctionType constraint) {