Swift: QL proto-type implementation of type inference

Author: hvitved

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -2282,11 +2282,13 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
        * A position where a callable can have a declared type and a call can have
        * an inferred type.
        */
+      bindingset[this]
       class TypePosition {
         /** Holds if this position represents the return type of a callable. */
         predicate isReturn();
 
         /** Gets a textual representation of this position. */
+        bindingset[this]
         string toString();
       }
 
@@ -2717,6 +2719,8 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
         class AccessPosition = DeclarationPosition;
 
+        bindingset[apos]
+        bindingset[dpos]
         predicate accessDeclarationPositionMatch(AccessPosition apos, DeclarationPosition dpos) {
           apos = dpos
         }

swift/ql/lib/codeql/swift/elements/internal/LocationImpl.qll

@@ -5,6 +5,75 @@ module Impl {
    * A location of a program element.
    */
   class Location extends Generated::Location {
+    /** Holds if this location starts before location `that`. */
+    pragma[inline]
+    predicate startsBefore(Location that) {
+      exists(string f, int sl1, int sc1, int sl2, int sc2 |
+        this.hasLocationInfo(f, sl1, sc1, _, _) and
+        that.hasLocationInfo(f, sl2, sc2, _, _)
+      |
+        sl1 < sl2
+        or
+        sl1 = sl2 and sc1 <= sc2
+      )
+    }
+
+    /** Holds if this location starts strictly before location `that`. */
+    pragma[inline]
+    predicate startsStrictlyBefore(Location that) {
+      exists(string f, int sl1, int sc1, int sl2, int sc2 |
+        this.hasLocationInfo(f, sl1, sc1, _, _) and
+        that.hasLocationInfo(f, sl2, sc2, _, _)
+      |
+        sl1 < sl2
+        or
+        sl1 = sl2 and sc1 < sc2
+      )
+    }
+
+    /** Holds if this location ends after location `that`. */
+    pragma[inline]
+    predicate endsAfter(Location that) {
+      exists(string f, int el1, int ec1, int el2, int ec2 |
+        this.hasLocationInfo(f, _, _, el1, ec1) and
+        that.hasLocationInfo(f, _, _, el2, ec2)
+      |
+        el1 > el2
+        or
+        el1 = el2 and ec1 >= ec2
+      )
+    }
+
+    /** Holds if this location ends strictly after location `that`. */
+    pragma[inline]
+    predicate endsStrictlyAfter(Location that) {
+      exists(string f, int el1, int ec1, int el2, int ec2 |
+        this.hasLocationInfo(f, _, _, el1, ec1) and
+        that.hasLocationInfo(f, _, _, el2, ec2)
+      |
+        el1 > el2
+        or
+        el1 = el2 and ec1 > ec2
+      )
+    }
+
+    /**
+     * Holds if this location contains location `that`, meaning that it starts
+     * before and ends after it.
+     */
+    bindingset[this, that]
+    pragma[inline_late]
+    predicate contains(Location that) { this.startsBefore(that) and this.endsAfter(that) }
+
+    /**
+     * Holds if this location strictlycontains location `that`, meaning that it starts
+     * strictly before and ends strictly after it.
+     */
+    pragma[inline]
+    predicate strictlyContains(Location that) {
+      this.startsStrictlyBefore(that) and this.endsStrictlyAfter(that)
+    }
+
     /**
      * Holds if this location is described by `path`, `startLine`, `startColumn`, `endLine` and `endColumn`.
      */

swift/ql/lib/codeql/swift/typeinference/Type.qll

@@ -0,0 +1,250 @@
+/** Provides classes representing types without type arguments. */
+
+import swift
+private import swift as Swift
+private import codeql.swift.generated.Raw
+private import codeql.swift.generated.Synth
+
+cached
+newtype TType =
+  TTypeDeclType(TypeDecl decl) {
+    not decl instanceof AssociatedTypeDecl and
+    // handled in `TSelfTypeParameter`
+    not decl = any(GenericTypeParamDecl g | decl.getName() = "Self")
+  } or
+  TTupleType(int arity) { arity = [0 .. any(Swift::TupleType tt).getNumberOfTypes()] } or
+  TAssociatedTypeTypeParameter(ProtocolDecl protocol, AssociatedTypeDecl associatedType) {
+    associatedType.getDeclaringDecl().(ProtocolDecl).getABaseTypeDecl*() = protocol
+  } or
+  TSelfTypeParameter(ProtocolDecl protocol) or
+  TTupleTypeTypeParameter(int arity, int index) {
+    arity = [0 .. any(Swift::TupleType tt).getNumberOfTypes()] and
+    index = [0 .. arity - 1]
+  } or
+  TUnknownType()
+
+/**
+ * A type without type arguments.
+ *
+ * Note that this type includes things that, strictly speaking, are not Rust
+ * types, such as traits and implementation blocks.
+ */
+abstract class Type extends TType {
+  /**
+   * Gets the `i`th positional type parameter of this type, if any.
+   *
+   * This excludes synthetic type parameters, such as associated types in traits.
+   */
+  abstract TypeParameter getPositionalTypeParameter(int i);
+
+  /** Gets the default type for the `i`th type parameter, if any. */
+  TypeRepr getTypeParameterDefault(int i) { none() }
+
+  /**
+   * Gets a type parameter of this type.
+   *
+   * This includes both positional type parameters and synthetic type parameters,
+   * such as associated types in traits.
+   */
+  TypeParameter getATypeParameter() { result = this.getPositionalTypeParameter(_) }
+
+  /** Gets a textual representation of this type. */
+  abstract string toString();
+
+  /** Gets the location of this type. */
+  abstract Location getLocation();
+}
+
+class TypeDeclType extends Type, TTypeDeclType {
+  TypeDecl decl;
+
+  TypeDeclType() { this = TTypeDeclType(decl) }
+
+  /** Gets the type item that this data type represents. */
+  TypeDecl getDecl() { result = decl }
+
+  override TypeParameter getPositionalTypeParameter(int i) {
+    result = TTypeDeclType(decl.(GenericTypeDecl).getGenericTypeParam(i))
+  }
+
+  override TypeParameter getATypeParameter() {
+    result = super.getATypeParameter()
+    or
+    result = TAssociatedTypeTypeParameter(decl, _)
+  }
+
+  override TypeRepr getTypeParameterDefault(int i) {
+    // todo: it appears Swift does support this
+    none()
+  }
+
+  override string toString() { result = decl.getName() }
+
+  override Location getLocation() { result = decl.getLocation() }
+}
+
+class StringType extends TypeDeclType {
+  StringType() { decl.getName() = "String" }
+}
+
+class IntType extends TypeDeclType {
+  IntType() { decl.getName() = "Int" }
+}
+
+class TupleType extends Type, TTupleType {
+  int arity;
+
+  TupleType() { this = TTupleType(arity) }
+
+  override TypeParameter getPositionalTypeParameter(int i) {
+    result = TTupleTypeTypeParameter(arity, i)
+  }
+
+  override string toString() { result = "(T_" + arity + ")" }
+
+  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
+}
+
+class VoidType extends TupleType {
+  VoidType() { arity = 0 }
+}
+
+/** A type parameter. */
+abstract class TypeParameter extends Type {
+  override TypeParameter getPositionalTypeParameter(int i) { none() }
+}
+
+class GenericTypeParamDeclTypeParameter extends TypeParameter, TypeDeclType {
+  override GenericTypeParamDecl decl;
+
+  override TypeParameter getPositionalTypeParameter(int i) {
+    result = TypeParameter.super.getPositionalTypeParameter(i)
+  }
+}
+
+/**
+ * A type parameter corresponding to an associated type in a protocol.
+ *
+ * We treat associated type declarations in protocols as type parameters. E.g., a
+ * protocol such as
+ *
+ * ```swift
+ * protocol Protocol {
+ *   associatedtype AssociatedType
+ *   // ...
+ * }
+ * ```
+ *
+ * is treated as if it was
+ *
+ * ```swift
+ * protocol Protocol<AssociatedType> {
+ *   // ...
+ * }
+ * ```
+ *
+ * Furthermore, associated types of a super protocol induce a corresponding type
+ * parameter in any subprotocols. E.g., if we have a protocol `SubProtocol: AProtocol` then
+ * `SubProtocol` also has a type parameter for the associated type
+ * `AssociatedType`.
+ */
+class AssociatedTypeTypeParameter extends TypeParameter, TAssociatedTypeTypeParameter {
+  ProtocolDecl protocol;
+  AssociatedTypeDecl associatedType;
+
+  AssociatedTypeTypeParameter() { this = TAssociatedTypeTypeParameter(protocol, associatedType) }
+
+  AssociatedTypeDecl getAssociatedType() { result = associatedType }
+
+  /** Gets the protocol that contains this associated type declaration. */
+  ProtocolDecl getProtocol() { result = protocol }
+
+  /**
+   * Holds if this associated type type parameter corresponds directly its
+   * protocol, that is, it is not inherited from a superprotocol.
+   */
+  predicate isDirect() { protocol = associatedType.getDeclaringDecl() }
+
+  override string toString() {
+    exists(string fromString, ProtocolDecl protocol2 |
+      result = associatedType.getName() + "[" + protocol.getName() + fromString + "]" and
+      protocol2 = associatedType.getDeclaringDecl() and
+      if protocol = protocol2
+      then fromString = ""
+      else fromString = " (inherited from " + protocol2.getName() + ")"
+    )
+  }
+
+  override Location getLocation() { result = associatedType.getLocation() }
+
+  override TypeParameter getPositionalTypeParameter(int i) {
+    // todo: it appears that associated types can also have type parameters
+    result = TypeParameter.super.getPositionalTypeParameter(i)
+  }
+}
+
+/**
+ * The implicit `Self` type parameter of a protocol, that refers to the
+ * implementing type of the protocol.
+ */
+class SelfTypeParameter extends TypeParameter, TSelfTypeParameter {
+  private ProtocolDecl protocol;
+
+  SelfTypeParameter() { this = TSelfTypeParameter(protocol) }
+
+  ProtocolDecl getProtocol() { result = protocol }
+
+  override string toString() { result = "Self [" + protocol.getName() + "]" }
+
+  override Location getLocation() { result = protocol.getLocation() }
+}
+
+class TupleTypeTypeParameter extends TypeParameter, TTupleTypeTypeParameter {
+  int arity;
+  int index;
+
+  TupleTypeTypeParameter() { this = TTupleTypeTypeParameter(arity, index) }
+
+  override string toString() { result = "element " + index + " of tuple of arity " + arity }
+
+  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
+}
+
+/**
+ * A special pseudo type used to indicate that the actual type may have to be
+ * inferred by propagating type information back into call arguments.
+ *
+ * For example, in
+ *
+ * ```rust
+ * let x = Default::default();
+ * foo(x);
+ * ```
+ *
+ * `Default::default()` is assigned this type, which allows us to infer the actual
+ * type from the type of `foo`'s first parameter.
+ *
+ * Unknown types are not restricted to root types, for example in a call like
+ * `Vec::new()` we assign this type at the type path corresponding to the type
+ * parameter of `Vec`.
+ *
+ * Unknown types are used to restrict when type information is allowed to flow
+ * into call arguments (including method call receivers), in order to avoid
+ * combinatorial explosions.
+ */
+class UnknownType extends Type, TUnknownType {
+  override TypeParameter getPositionalTypeParameter(int i) { none() }
+
+  override string toString() { result = "(context typed)" }
+
+  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
+}
+
+private class RawTypeParameter =
+  @generic_type_param_decl or @associated_type_decl or @protocol_decl;
+
+private predicate id(RawTypeParameter x, RawTypeParameter y) { x = y }
+
+private predicate idOfRaw(RawTypeParameter x, int y) = equivalenceRelation(id/2)(x, y)
+
+int idOfTypeParameterAstNode(AstNode node) { idOfRaw(Synth::convertAstNodeToRaw(node), result) }

swift/ql/lib/codeql/swift/typeinference/TypeAbstraction.qll

@@ -0,0 +1,25 @@
+private import Type
+
+/**
+ * A type abstraction. I.e., a place in the program where type variables may
+ * be introduced.
+ *
+ * Example:
+ * ```rust
+ * impl<A, B> Foo<A, B> { }
+ * //  ^^^^^^ a type abstraction
+ * ```
+ */
+abstract class TypeAbstraction extends AstNode {
+  abstract TypeParameter getATypeParameter();
+}
+
+final class GenericContextTypeAbstraction extends TypeAbstraction, GenericContext {
+  override TypeParameter getATypeParameter() {
+    result.(GenericTypeParamDeclTypeParameter).getDecl() = this.getAGenericTypeParam()
+    or
+    result.(SelfTypeParameter).getProtocol() = this
+    or
+    result.(AssociatedTypeTypeParameter).getProtocol() = this
+  }
+}