wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -882,7 +882,7 @@ private module ArgIsInstantiationOf<
 }
 
 /**
- * Provides logic for resolving method calls.
+ * Provides logic for resolving calls to methods.
  *
  * When resolving a method call, a list of [candidate receiver types][1] is constructed
  *
@@ -915,7 +915,7 @@ private module ArgIsInstantiationOf<
  *
  * [1]: https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.candidate-receivers
  */
-private module MethodCallResolution {
+private module MethodResolution {
   /**
    * Holds if `root` is a valid complex [`self` root type][1], with type
    * parameter `tp`.
@@ -1169,7 +1169,7 @@ private module MethodCallResolution {
       derefChain = ""
       or
       exists(TypePath path0, Type t0, string derefChain0 |
-        this.hasNoCompatibleTarget(derefChain0) and
+        this.hasNoCompatibleTarget(derefChain0, _) and
         t0 = this.getACandidateReceiverTypeAtNoBorrow(path0, derefChain0)
       |
         path0.isCons(TRefTypeParameter(), path) and
@@ -1212,13 +1212,13 @@ private module MethodCallResolution {
     }
 
     /**
-     * Holds if the candidate receiver type represented by `derefChain` does not
-     * have a matching method target.
+     * Holds if the candidate receiver type represented by
+     * `derefChainBorrow = derefChain;` does not have a matching method target.
      */
     pragma[nomagic]
-    private predicate hasNoCompatibleTargetNoBorrow(string derefChain) {
-      this.supportsAutoDerefAndBorrow() and
-      exists(TypePath strippedTypePath, Type strippedType, string derefChainBorrow |
+    predicate hasNoCompatibleTargetNoBorrow(string derefChain, string derefChainBorrow) {
+      (this.supportsAutoDerefAndBorrow() or derefChain = "") and
+      exists(TypePath strippedTypePath, Type strippedType |
         derefChainBorrow = derefChain + ";" and
         not derefChain.matches("%.ref") and // no need to try a borrow if the last thing we did was a deref
         strippedType = this.getComplexStrippedType(strippedTypePath, derefChainBorrow)
@@ -1233,14 +1233,15 @@ private module MethodCallResolution {
     }
 
     /**
-     * Holds if the candidate receiver type represented by `derefChain;borrow` does not
-     * have a matching method target.
+     * Holds if the candidate receiver type represented by
+     * `derefChainBorrow = derefChain;borrow` does not have a matching method
+     * target.
      */
     pragma[nomagic]
-    private predicate hasNoCompatibleTarget(string derefChain) {
-      exists(TypePath strippedTypePath, Type strippedType, string derefChainBorrow |
+    predicate hasNoCompatibleTarget(string derefChain, string derefChainBorrow) {
+      exists(TypePath strippedTypePath, Type strippedType |
         derefChainBorrow = derefChain + ";borrow" and
-        this.hasNoCompatibleTargetNoBorrow(derefChain) and
+        this.hasNoCompatibleTargetNoBorrow(derefChain, _) and
         strippedType = this.getComplexStrippedType(strippedTypePath, derefChainBorrow)
       |
         // todo: also check that all blanket implementation candidates are incompatible
@@ -1270,7 +1271,7 @@ private module MethodCallResolution {
         result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
         derefChainBorrow = derefChain + ";"
         or
-        this.hasNoCompatibleTargetNoBorrow(derefChain) and
+        this.hasNoCompatibleTargetNoBorrow(derefChain, _) and
         derefChainBorrow = derefChain + ";borrow" and
         (
           path.isEmpty() and
@@ -1429,6 +1430,13 @@ private module MethodCallResolution {
       result = mc_.getACandidateReceiverTypeAtSubstituteLookupTraits(path, derefChainBorrow)
     }
 
+    pragma[nomagic]
+    predicate hasNoCompatibleTarget() {
+      mc_.hasNoCompatibleTarget(_, derefChainBorrow)
+      or
+      mc_.hasNoCompatibleTargetNoBorrow(_, derefChainBorrow)
+    }
+
     pragma[nomagic]
     predicate hasSignature(
       MethodCall mc, TypePath strippedTypePath, Type strippedType, string name, int arity
@@ -1476,13 +1484,7 @@ private module MethodCallResolution {
           i, _)
       |
         mc_.hasNameAndArity(name, _) and
-        result = getMethodSuccessor(i, name, _) and
-        if i.(Impl).hasTrait()
-        then
-          // inherent methods take precedence over trait methods, so only allow
-          // trait methods when there are no matching inherent methods
-          this.hasNoInherentTarget()
-        else any()
+        result = getMethodSuccessor(i, name, _)
       )
     }
 
@@ -1531,7 +1533,11 @@ private module MethodCallResolution {
     ) {
       exists(MethodCall mc, string name, int arity |
         mcc.hasSignature(mc, _, _, name, arity) and
-        methodCallBlanketCandidate(mc, m, _, _, blanketPath, blanketTypeParam)
+        methodCallBlanketCandidate(mc, m, _, _, blanketPath, blanketTypeParam) and
+        // Only apply blanket implementations when no other implementations are possible;
+        // this is to account for codebases that use the (unstable) specialization feature
+        // (https://rust-lang.github.io/rfcs/1210-impl-specialization.html)
+        mcc.hasNoCompatibleTarget()
       )
     }
   }
@@ -1544,23 +1550,36 @@ private module MethodCallResolution {
     IsInstantiationOfInputSig<MethodCallCand, FunctionType>
   {
     pragma[nomagic]
-    predicate potentialInstantiationOf(
-      MethodCallCand mcc, TypeAbstraction abs, FunctionType constraint
+    additional predicate potentialInstantiationOf0(
+      MethodCallCand mcc, ImplOrTraitItemNode i, FunctionType selfType
     ) {
       exists(
         MethodCall mc, Method m, string name, int arity, TypePath strippedTypePath,
         Type strippedType
       |
         mcc.hasSignature(mc, strippedTypePath, strippedType, name, arity)
       |
-        methodCallNonBlanketCandidate(mc, m, abs, constraint, strippedTypePath, strippedType)
+        methodCallNonBlanketCandidate(mc, m, i, selfType, strippedTypePath, strippedType)
         or
-        methodCallBlanketCandidate(mc, m, abs, constraint, _, _) and
+        methodCallBlanketCandidate(mc, m, i, selfType, _, _) and
         BlanketImplementation::SatisfiesBlanketConstraint<MethodCallCand, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(mcc,
           m)
       )
     }
 
+    pragma[nomagic]
+    predicate potentialInstantiationOf(
+      MethodCallCand mcc, TypeAbstraction abs, FunctionType constraint
+    ) {
+      potentialInstantiationOf0(mcc, abs, constraint) and
+      if abs.(Impl).hasTrait()
+      then
+        // inherent methods take precedence over trait methods, so only allow
+        // trait methods when there are no matching inherent methods
+        mcc.hasNoInherentTarget()
+      else any()
+    }
+
     predicate relevantTypeMention(FunctionType constraint) {
       methodInfo(_, _, _, _, constraint, _, _)
     }
@@ -1573,16 +1592,30 @@ private module MethodCallResolution {
   private module MethodCallCallExprIsInstantiationOfInput implements
     IsInstantiationOfInputSig<MethodCallCallExpr, TypeMentionTypeTree>
   {
+    pragma[nomagic]
+    private predicate potentialInstantiationOf0(
+      MethodCallCallExpr ce, ImplItemNode impl, TypeMentionTypeTree constraint
+    ) {
+      exists(getCallExprTypeQualifier(ce, _)) and
+      CallExprImpl::getResolvedFunction(ce) = impl.getASuccessor(_) and
+      constraint = impl.getSelfPath()
+    }
+
     pragma[nomagic]
     predicate potentialInstantiationOf(
       MethodCallCallExpr ce, TypeAbstraction abs, TypeMentionTypeTree constraint
     ) {
-      exists(getCallExprTypeQualifier(ce, _)) and
-      abs =
-        any(ImplItemNode impl |
-          CallExprImpl::getResolvedFunction(ce) = impl.getASuccessor(_) and
-          constraint = impl.getSelfPath()
-        )
+      potentialInstantiationOf0(ce, abs, constraint) and
+      if abs.(Impl).hasTrait()
+      then
+        // inherent methods take precedence over trait methods, so only allow
+        // trait methods when there are no matching inherent methods
+        MkMethodCallCand(ce, "").(MethodCallCand).hasNoInherentTarget()
+      else any()
+    }
+
+    predicate relevantTypeMention(TypeMentionTypeTree constraint) {
+      potentialInstantiationOf0(_, _, constraint)
     }
   }
 
@@ -1597,7 +1630,7 @@ private module MethodCallResolution {
     predicate potentialInstantiationOf(
       MethodCallCand mcc, TypeAbstraction abs, FunctionType constraint
     ) {
-      MethodCallReceiverIsInstantiationOfInput::potentialInstantiationOf(mcc, abs, constraint) and
+      MethodCallReceiverIsInstantiationOfInput::potentialInstantiationOf0(mcc, abs, constraint) and
       abs = any(Impl i | not i.hasTrait())
     }
 
@@ -1674,7 +1707,7 @@ private module MethodCallMatchingInput implements MatchingWithEnvironmentInputSi
 
   class AccessEnvironment = string;
 
-  final private class MethodCallFinal = MethodCallResolution::MethodCall;
+  final private class MethodCallFinal = MethodResolution::MethodCall;
 
   class Access extends MethodCallFinal {
     Access() {
@@ -1764,7 +1797,7 @@ private Type inferMethodCallExprType(AstNode n, TypePath path) {
     MethodCallMatchingInput::Access a, MethodCallMatchingInput::AccessPosition apos,
     string derefChainBorrow, TypePath path0
   |
-    result = inferMethodCallExprType0(a, apos, n, derefChainBorrow, path0)
+    result = inferMethodCallExprType0(a, apos, n, derefChainBorrow, path0) //and
   |
     (
       not apos.asArgumentPosition().isSelf()
@@ -1786,10 +1819,10 @@ private Type inferMethodCallExprType(AstNode n, TypePath path) {
 }
 
 /**
- * Provides logic for resolving associated function calls. This includes
+ * Provides logic for resolving calls to associated functions. This includes
  * "calls" to tuple variants and tuple structs.
  */
-private module AssocFunctionCallResolution {
+private module AssocFunctionResolution {
   private import FunctionOverloading
 
   /**
@@ -2131,7 +2164,7 @@ private module AssocFunctionCallMatchingInput implements MatchingInputSig {
     }
   }
 
-  class Access extends AssocFunctionCallResolution::AssocFunctionCall {
+  class Access extends AssocFunctionResolution::AssocFunctionCall {
     pragma[nomagic]
     Type getTypeArgument(TypeArgumentPosition apos, TypePath path) {
       result = getCallExprTypeArgument(this, apos).resolveTypeAt(path)
@@ -2218,7 +2251,7 @@ private module OperationMatchingInput implements MatchingInputSig {
     }
   }
 
-  class Access extends MethodCallResolution::MethodCallOperation {
+  class Access extends MethodResolution::MethodCallOperation {
     Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
 
     pragma[nomagic]
@@ -2247,7 +2280,7 @@ private Type getFieldExprLookupType(FieldExpr fe, string name) {
   exists(TypePath path |
     result = inferType(fe.getContainer(), path) and
     name = fe.getIdentifier().getText() and
-    MethodCallResolution::isComplexRootStripped(path, result)
+    MethodResolution::isComplexRootStripped(path, result)
   )
 }
 
@@ -2885,21 +2918,21 @@ private module Cached {
   /** Holds if `receiver` is the receiver of a method call with an implicit dereference. */
   cached
   predicate receiverHasImplicitDeref(AstNode receiver) {
-    any(MethodCallResolution::MethodCall mc).receiverHasImplicitDeref(receiver)
+    any(MethodResolution::MethodCall mc).receiverHasImplicitDeref(receiver)
   }
 
   /** Holds if `receiver` is the receiver of a method call with an implicit borrow. */
   cached
   predicate receiverHasImplicitBorrow(AstNode receiver) {
-    any(MethodCallResolution::MethodCall mc).receiverHasImplicitBorrow(receiver)
+    any(MethodResolution::MethodCall mc).receiverHasImplicitBorrow(receiver)
   }
 
   /** Gets a function that `call` resolves to, if any. */
   cached
   Function resolveCallTarget(Call call) {
-    result = call.(MethodCallResolution::MethodCall).resolveCallTarget(_)
+    result = call.(MethodResolution::MethodCall).resolveCallTarget(_)
     or
-    result = call.(AssocFunctionCallResolution::AssocFunctionCall).resolveCallTarget()
+    result = call.(AssocFunctionResolution::AssocFunctionCall).resolveCallTarget()
   }
 
   /**