wip

hvitved · hvitved · commit bd8665ae46a1 · 2025-11-04T16:39:36.000+01:00
diff --git a/rust/ql/lib/codeql/rust/internal/PathResolution.qll b/rust/ql/lib/codeql/rust/internal/PathResolution.qll
@@ -2137,7 +2137,7 @@ private module Debug {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
       filepath.matches("%/main.rs") and
-      startline = 52
+      startline = 2909
     )
   }
 
diff --git a/rust/ql/lib/codeql/rust/internal/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/TypeInference.qll
@@ -263,8 +263,11 @@ pragma[nomagic]
 private TypeMention getCallExprTypeArgument(CallExpr ce, TypeArgumentPosition apos) {
   exists(Path p, int i |
     p = CallExprImpl::getFunctionPath(ce) and
-    result = p.getSegment().getGenericArgList().getTypeArg(pragma[only_bind_into](i)) and
     apos.asTypeParam() = resolvePath(p).getTypeParam(pragma[only_bind_into](i))
+  |
+    result = p.getSegment().getGenericArgList().getTypeArg(pragma[only_bind_into](i))
+    or
+    result = p.(NonAliasPathTypeMention).getPathPositionalTypeArgument(pragma[only_bind_into](i))
   )
 }
 
@@ -748,6 +751,8 @@ private Type inferTypeEquality(AstNode n, TypePath path) {
 /**
  * A matching configuration for resolving types of struct expressions
  * like `Foo { bar = baz }`.
+ *
+ * This also includes nullary struct expressions like `None`.
  */
 private module StructExprMatchingInput implements MatchingInputSig {
   private newtype TPos =
@@ -830,26 +835,86 @@ private module StructExprMatchingInput implements MatchingInputSig {
 
   class AccessPosition = DeclarationPosition;
 
-  class Access extends StructExpr {
+  abstract class Access extends AstNode {
+    pragma[nomagic]
+    abstract AstNode getNodeAt(AccessPosition apos);
+
+    pragma[nomagic]
+    Type getInferredType(AccessPosition apos, TypePath path) {
+      result = inferType(this.getNodeAt(apos), path)
+    }
+
+    pragma[nomagic]
+    abstract Path getStructPath();
+
+    pragma[nomagic]
+    Declaration getTarget() { result = resolvePath(this.getStructPath()) }
+
+    pragma[nomagic]
     Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
+      exists(TypeMention tm, TypePath path0 |
+        tm = this.getStructPath() and
+        result = tm.resolveTypeAt(path0) and
+        path0.isCons(TTypeParamTypeParameter(apos.asTypeParam()), path)
+      )
+    }
+
+    /**
+     * Holds if the return type of this call at `path` may have to be inferred
+     * from the context.
+     */
+    pragma[nomagic]
+    predicate isContextTypedAt(DeclarationPosition pos, TypePath path) {
+      // Struct declarations, such as `Foo::Bar{field = ...}`, may also be context typed
+      exists(Declaration td, TypeParameter tp |
+        td = this.getTarget() and
+        pos.isStructPos() and
+        tp = td.getDeclaredType(pos, path) and
+        not exists(DeclarationPosition paramDpos |
+          not paramDpos.isStructPos() and
+          tp = td.getDeclaredType(paramDpos, _)
+        ) and
+        // check that no explicit type arguments have been supplied for `tp`
+        not exists(TypeArgumentPosition tapos |
+          exists(this.getTypeArgument(tapos, _)) and
+          TTypeParamTypeParameter(tapos.asTypeParam()) = tp
+        )
+      )
+    }
+  }
+
+  private class StructExprAccess extends Access, StructExpr {
+    override Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
+      result = super.getTypeArgument(apos, path)
+      or
       exists(TypePath suffix |
         suffix.isCons(TTypeParamTypeParameter(apos.asTypeParam()), path) and
         result = CertainTypeInference::inferCertainType(this, suffix)
       )
     }
 
-    AstNode getNodeAt(AccessPosition apos) {
+    override AstNode getNodeAt(AccessPosition apos) {
       result = this.getFieldExpr(apos.asFieldPos()).getExpr()
       or
       result = this and
       apos.isStructPos()
     }
 
-    Type getInferredType(AccessPosition apos, TypePath path) {
-      result = inferType(this.getNodeAt(apos), path)
+    override Path getStructPath() { result = this.getPath() }
+  }
+
+  /**
+   * A potential nullary struct/variant construction such as `None`.
+   */
+  private class PathExprAccess extends Access, PathExpr {
+    PathExprAccess() { not exists(CallExpr ce | this = ce.getFunction()) }
+
+    override AstNode getNodeAt(AccessPosition apos) {
+      result = this and
+      apos.isStructPos()
     }
 
-    Declaration getTarget() { result = resolvePath(this.getPath()) }
+    override Path getStructPath() { result = this.getPath() }
   }
 
   predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
@@ -859,36 +924,32 @@ private module StructExprMatchingInput implements MatchingInputSig {
 
 private module StructExprMatching = Matching<StructExprMatchingInput>;
 
-/**
- * Gets the type of `n` at `path`, where `n` is either a struct expression or
- * a field expression of a struct expression.
- */
 pragma[nomagic]
-private Type inferStructExprType(AstNode n, TypePath path) {
+private Type inferStructExprType0(AstNode n, boolean isReturn, TypePath path) {
   exists(StructExprMatchingInput::Access a, StructExprMatchingInput::AccessPosition apos |
     n = a.getNodeAt(apos) and
+    if apos.isStructPos() then isReturn = true else isReturn = false
+  |
     result = StructExprMatching::inferAccessType(a, apos, path)
+    or
+    a.isContextTypedAt(apos, path) and
+    result = TContextType()
   )
 }
 
+/**
+ * Gets the type of `n` at `path`, where `n` is either a struct expression or
+ * a field expression of a struct expression.
+ */
+private predicate inferStructExprType =
+  ContextTyping::CheckContextTyping<inferStructExprType0/3>::check/2;
+
 pragma[nomagic]
 private Type inferTupleRootType(AstNode n) {
   // `typeEquality` handles the non-root cases
   result = TTuple([n.(TupleExpr).getNumberOfFields(), n.(TuplePat).getTupleArity()])
 }
 
-pragma[nomagic]
-private Type inferPathExprType(PathExpr pe, TypePath path) {
-  // nullary struct/variant constructors
-  not exists(CallExpr ce | pe = ce.getFunction()) and
-  path.isEmpty() and
-  exists(ItemNode i | i = resolvePath(pe.getPath()) |
-    result = TEnum(i.(Variant).getEnum())
-    or
-    result = TStruct(i)
-  )
-}
-
 pragma[nomagic]
 private Path getCallExprPathQualifier(CallExpr ce) {
   result = CallExprImpl::getFunctionPath(ce).getQualifier()
@@ -982,7 +1043,7 @@ private module ContextTyping {
   pragma[nomagic]
   private predicate isContextTyped(AstNode n) { isContextTyped(n, _) }
 
-  signature Type inferCallTypeSig(AstNode n, FunctionPosition pos, TypePath path);
+  signature Type inferCallTypeSig(AstNode n, boolean isReturn, TypePath path);
 
   /**
    * Given a predicate `inferCallType` for inferring the type of a call at a given
@@ -992,30 +1053,24 @@ private module ContextTyping {
    */
   module CheckContextTyping<inferCallTypeSig/3 inferCallType> {
     pragma[nomagic]
-    private Type inferCallTypeFromContextCand(
-      AstNode n, FunctionPosition pos, TypePath path, TypePath prefix
-    ) {
-      result = inferCallType(n, pos, path) and
-      not pos.isReturn() and
+    private Type inferCallTypeFromContextCand(AstNode n, TypePath path, TypePath prefix) {
+      result = inferCallType(n, false, path) and
       isContextTyped(n) and
       prefix = path
       or
       exists(TypePath mid |
-        result = inferCallTypeFromContextCand(n, pos, path, mid) and
+        result = inferCallTypeFromContextCand(n, path, mid) and
         mid.isSnoc(prefix, _)
       )
     }
 
     pragma[nomagic]
     Type check(AstNode n, TypePath path) {
-      exists(FunctionPosition pos |
-        result = inferCallType(n, pos, path) and
-        pos.isReturn()
-        or
-        exists(TypePath prefix |
-          result = inferCallTypeFromContextCand(n, pos, path, prefix) and
-          isContextTyped(n, prefix)
-        )
+      result = inferCallType(n, true, path)
+      or
+      exists(TypePath prefix |
+        result = inferCallTypeFromContextCand(n, path, prefix) and
+        isContextTyped(n, prefix)
       )
     }
   }
@@ -2131,11 +2186,13 @@ private Type inferMethodCallType0(
 }
 
 pragma[nomagic]
-private Type inferMethodCallType1(
-  AstNode n, MethodCallMatchingInput::AccessPosition apos, TypePath path
-) {
-  exists(MethodCallMatchingInput::Access a, string derefChainBorrow, TypePath path0 |
-    result = inferMethodCallType0(a, apos, n, derefChainBorrow, path0)
+private Type inferMethodCallType1(AstNode n, boolean isReturn, TypePath path) {
+  exists(
+    MethodCallMatchingInput::Access a, MethodCallMatchingInput::AccessPosition apos,
+    string derefChainBorrow, TypePath path0
+  |
+    result = inferMethodCallType0(a, apos, n, derefChainBorrow, path0) and
+    if apos.isReturn() then isReturn = true else isReturn = false
   |
     (
       not apos.isSelf()
@@ -2460,6 +2517,9 @@ private module NonMethodResolution {
 /**
  * A matching configuration for resolving types of calls like
  * `foo::bar(baz)` where the target is not a method.
+ *
+ * This also includes "calls" to tuple variants and tuple structs such
+ * as `Result::Ok(42)`.
  */
 private module NonMethodCallMatchingInput implements MatchingInputSig {
   import FunctionPositionMatchingInput
@@ -2581,6 +2641,12 @@ private module NonMethodCallMatchingInput implements MatchingInputSig {
     pragma[nomagic]
     override Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
       result = getCallExprTypeArgument(this, apos).resolveTypeAt(path)
+      // todo: enum variants like `Self(...)`
+    }
+
+    pragma[nomagic]
+    AstNode getNodeAt(FunctionPosition pos) {
+      result = NonMethodResolution::NonMethodCall.super.getNodeAt(pos)
     }
 
     pragma[nomagic]
@@ -2591,26 +2657,23 @@ private module NonMethodCallMatchingInput implements MatchingInputSig {
       result = inferType(this.getNodeAt(apos), path)
     }
 
+    pragma[nomagic]
     Declaration getTarget() {
-      result = this.resolveCallTarget() // potential mutual recursion; resolving some associated function calls requires resolving types
+      result = super.resolveCallTarget() // potential mutual recursion; resolving some associated function calls requires resolving types
     }
 
-    /**
-     * Holds if the return type of this call at `path` may have to be inferred
-     * from the context.
-     */
     pragma[nomagic]
     predicate isContextTypedAt(FunctionPosition pos, TypePath path) {
       exists(ImplOrTraitItemNode i |
         this.isContextTypedAt(i,
           [
-            this.resolveCallTargetViaPathResolution().(NonMethodFunction),
-            this.resolveCallTargetViaTypeInference(i),
-            this.resolveTraitFunctionViaPathResolution(i)
+            super.resolveCallTargetViaPathResolution().(NonMethodFunction),
+            super.resolveCallTargetViaTypeInference(i),
+            super.resolveTraitFunctionViaPathResolution(i)
           ], pos, path)
       )
       or
-      // Tuple declarations, such as `None`, may also be context typed
+      // Tuple declarations, such as `Result::Ok(...)`, may also be context typed
       exists(TupleDeclaration td, TypeParameter tp |
         td = this.resolveCallTargetViaPathResolution() and
         pos.isReturn() and
@@ -2629,10 +2692,11 @@ private module NonMethodCallMatchingInput implements MatchingInputSig {
 private module NonMethodCallMatching = Matching<NonMethodCallMatchingInput>;
 
 pragma[nomagic]
-private Type inferNonMethodCallType0(
-  AstNode n, NonMethodCallMatchingInput::AccessPosition apos, TypePath path
-) {
-  exists(NonMethodCallMatchingInput::Access a | n = a.getNodeAt(apos) |
+private Type inferNonMethodCallType0(AstNode n, boolean isReturn, TypePath path) {
+  exists(NonMethodCallMatchingInput::Access a, NonMethodCallMatchingInput::AccessPosition apos |
+    n = a.getNodeAt(apos) and
+    if apos.isReturn() then isReturn = true else isReturn = false
+  |
     result = NonMethodCallMatching::inferAccessType(a, apos, path)
     or
     a.isContextTypedAt(apos, path) and
@@ -2715,12 +2779,11 @@ private module OperationMatchingInput implements MatchingInputSig {
 private module OperationMatching = Matching<OperationMatchingInput>;
 
 pragma[nomagic]
-private Type inferOperationType0(
-  AstNode n, OperationMatchingInput::AccessPosition apos, TypePath path
-) {
-  exists(OperationMatchingInput::Access a |
+private Type inferOperationType0(AstNode n, boolean isReturn, TypePath path) {
+  exists(OperationMatchingInput::Access a, OperationMatchingInput::AccessPosition apos |
     n = a.getNodeAt(apos) and
-    result = OperationMatching::inferAccessType(a, apos, path)
+    result = OperationMatching::inferAccessType(a, apos, path) and
+    if apos.isReturn() then isReturn = true else isReturn = false
   )
 }
 
@@ -3488,8 +3551,6 @@ private module Cached {
       or
       result = inferStructExprType(n, path)
       or
-      result = inferPathExprType(n, path)
-      or
       result = inferMethodCallType(n, path)
       or
       result = inferNonMethodCallType(n, path)
diff --git a/rust/ql/lib/codeql/rust/internal/TypeMention.qll b/rust/ql/lib/codeql/rust/internal/TypeMention.qll
@@ -147,7 +147,7 @@ class NonAliasPathTypeMention extends PathTypeMention {
    * Gets the positional type argument at index `i` that occurs in this path, if
    * any.
    */
-  private TypeMention getPathPositionalTypeArgument(int i) {
+  TypeMention getPathPositionalTypeArgument(int i) {
     result = this.getSegment().getGenericArgList().getTypeArg(i)
     or
     // `Option::<i32>::Some` is valid in addition to `Option::Some::<i32>`
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
@@ -2908,12 +2908,12 @@ mod context_typed {
     pub fn f() {
         let x = None; // $ type=x:T.i32
         let x: Option<i32> = x;
-        let x = Option::<i32>::None; // $ MISSING: type=x:T.i32
-        let x = Option::None::<i32>; // $ MISSING: type=x:T.i32
+        let x = Option::<i32>::None; // $ type=x:T.i32
+        let x = Option::None::<i32>; // $ type=x:T.i32
 
         fn pin_option<T>(opt: Option<T>, x: T) {}
 
-        let x = None; // $ MISSING: type=x:T.i32
+        let x = None; // $ type=x:T.i32
         pin_option(x, 0); // $ target=pin_option
 
         enum MyEither<T1, T2> {
@@ -2932,7 +2932,7 @@ mod context_typed {
         fn pin_my_either<T>(e: MyEither<T, String>, x: T) {}
 
         #[rustfmt::skip]
-        let x = MyEither::B {  // $ type=x:T2.String $ MISSING: type=x:T1.i32
+        let x = MyEither::B {  // $ type=x:T1.i32 type=x:T2.String
             right: String::new(), // $ target=new
         };
         pin_my_either(x, 0); // $ target=pin_my_either
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected

Original file line number	Diff line number	Diff line change
`@@ -2137,7 +2137,7 @@ private module Debug {`
`2137`	`2137`	`exists(string filepath, int startline, int startcolumn, int endline, int endcolumn \|`
`2138`	`2138`	`result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and`
`2139`	`2139`	`filepath.matches("%/main.rs") and`
`2140`		`- startline = 52`
	`2140`	`+ startline = 2909`
`2141`	`2141`	`)`
`2142`	`2142`	`}`
`2143`	`2143`