wip3

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -825,23 +825,24 @@ private predicate functionInfo(
 
 /**
  * Holds if function `f` with the name `name` and the arity `arity` exists in
- * [blanket implementation][1] `impl` of `trait`, and the type at position
+ * blanket implementation `impl` of `trait`, and the type at position
  * `pos` is `t`.
  *
  * `blanketPath` points to the type `blanketTypeParam` inside `t`, which
  * is the type parameter used in the blanket implementation.
- *
- * [1]: https://doc.rust-lang.org/book/ch10-02-traits.html#using-trait-bounds-to-conditionally-implement-methods
  */
 pragma[nomagic]
 private predicate functionInfoBlanket(
   Function f, string name, int arity, ImplItemNode impl, Trait trait, FunctionTypePosition pos,
   FunctionType t, TypePath blanketPath, TypeParam blanketTypeParam
 ) {
-  functionInfo(f, name, arity, impl, pos, t) and
-  TTypeParamTypeParameter(blanketTypeParam) = t.getTypeAt(blanketPath) and
-  MethodResolution::isBlanketLike(impl, blanketTypeParam) and
-  trait = impl.resolveTraitTy()
+  exists(TypePath path0 |
+    functionInfo(f, name, arity, impl, pos, t) and
+    TTypeParamTypeParameter(blanketTypeParam) = t.getTypeAt(blanketPath) and
+    blanketPath = any(string s) + path0 and
+    BlanketImplementation::isBlanket(impl, path0, blanketTypeParam) and
+    trait = impl.resolveTraitTy()
+  )
 }
 
 /**
@@ -881,6 +882,30 @@ private module ArgIsInstantiationOf<
   }
 }
 
+/**
+ * Holds if `root` is a valid complex [`self` root type][1], with type
+ * parameter `tp`.
+ *
+ * [1]: https://doc.rust-lang.org/stable/reference/items/associated-items.html?highlight=self#r-items.associated.fn.method.self-ty
+ */
+pragma[nomagic]
+predicate complexSelfRoot(Type root, TypeParameter tp) {
+  tp = root.(RefType).getPositionalTypeParameter(_)
+  or
+  exists(Struct s |
+    root = TStruct(s) and
+    tp = root.getPositionalTypeParameter(0)
+  |
+    s instanceof BoxStruct
+    or
+    s instanceof RcStruct
+    or
+    s instanceof ArcStruct
+    or
+    s instanceof PinStruct
+  )
+}
+
 /**
  * Provides logic for resolving calls to methods.
  *
@@ -916,30 +941,6 @@ private module ArgIsInstantiationOf<
  * [1]: https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.candidate-receivers
  */
 private module MethodResolution {
-  /**
-   * Holds if `root` is a valid complex [`self` root type][1], with type
-   * parameter `tp`.
-   *
-   * [1]: https://doc.rust-lang.org/stable/reference/items/associated-items.html?highlight=self#r-items.associated.fn.method.self-ty
-   */
-  pragma[nomagic]
-  private predicate complexSelfRoot(Type root, TypeParameter tp) {
-    tp = root.(RefType).getPositionalTypeParameter(_)
-    or
-    exists(Struct s |
-      root = TStruct(s) and
-      tp = root.getPositionalTypeParameter(0)
-    |
-      s instanceof BoxStruct
-      or
-      s instanceof RcStruct
-      or
-      s instanceof ArcStruct
-      or
-      s instanceof PinStruct
-    )
-  }
-
   /**
    * Holds if the type path `path` pointing to `type` is stripped of any leading
    * complex root type allowed for `self` parameters, such as `&`, `Box`, `Rc`,
@@ -991,17 +992,6 @@ private module MethodResolution {
     methodInfo(m, name, arity, i, selfType, strippedTypePath, TTypeParamTypeParameter(tp))
   }
 
-  predicate isBlanketLike(ImplItemNode i, TypeParam tp) {
-    tp = i.getBlanketImplementationTypeParam()
-    // or
-    // exists(TypeMention tm, Type root, TypeParameter tp0 |
-    //   tm = i.(Impl).getSelfTy() and
-    //   complexSelfRoot(root, tp0) and
-    //   tm.resolveType() = root and
-    //   tm.resolveTypeAt(TypePath::singleton(tp0)) = TTypeParamTypeParameter(tp)
-    // )
-  }
-
   /**
    * Same as `methodInfo`, but restricted to non-blanket implementations, and
    * allowing for any `strippedType` when the corresponding type inside `m` is
@@ -1016,18 +1006,16 @@ private module MethodResolution {
       methodInfo(m, name, arity, i, selfType, strippedTypePath, strippedType) or
       methodInfoTypeParam(m, name, arity, i, selfType, strippedTypePath, _)
     ) and
-    not isBlanketLike(i, _)
+    not BlanketImplementation::isBlanket(i, _, _)
   }
 
   /**
    * Holds if method `m` with the name `name` and the arity `arity` exists in
-   * [blanket implementation][1] `impl` of `trait`, and the type of the `self`
+   * blanket implementation `impl` of `trait`, and the type of the `self`
    * parameter is `selfType`.
    *
    * `blanketPath` points to the type `blanketTypeParam` inside `selfType`, which
    * is the type parameter used in the blanket implementation.
-   *
-   * [1]: https://doc.rust-lang.org/book/ch10-02-traits.html#using-trait-bounds-to-conditionally-implement-methods
    */
   pragma[nomagic]
   private predicate methodInfoBlanket(
@@ -1179,6 +1167,7 @@ private module MethodResolution {
       result = this.getReceiverTypeAt(path) and
       derefChain = ""
       or
+      this.supportsAutoDerefAndBorrow() and
       exists(TypePath path0, Type t0, string derefChain0 |
         this.hasNoCompatibleTarget(derefChain0, _) and
         t0 = this.getACandidateReceiverTypeAtNoBorrow(path0, derefChain0)
@@ -1242,7 +1231,7 @@ private module MethodResolution {
         forall(ImplOrTraitItemNode i |
           methodCallNonBlanketCandidate(this, _, i, _, strippedTypePath, strippedType)
           or
-          CallExprImpl::getResolvedFunction(this) = i.(ImplItemNode).getASuccessor(_)
+          this.(MethodCallCallExpr).hasTypeQualifiedCandidate(i)
         |
           this.hasIncompatibleTarget(i, derefChainBorrow)
         )
@@ -1265,7 +1254,7 @@ private module MethodResolution {
         forall(ImplOrTraitItemNode i |
           methodCallNonBlanketCandidate(this, _, i, _, strippedTypePath, strippedType)
           or
-          CallExprImpl::getResolvedFunction(this) = i.(ImplItemNode).getASuccessor(_)
+          this.(MethodCallCallExpr).hasTypeQualifiedCandidate(i)
         |
           this.hasIncompatibleTarget(i, derefChainBorrow)
         )
@@ -1290,6 +1279,7 @@ private module MethodResolution {
         result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
         derefChainBorrow = derefChain + ";"
         or
+        this.supportsAutoDerefAndBorrow() and
         this.hasNoCompatibleTargetNoBorrow(derefChain, _) and
         derefChainBorrow = derefChain + ";borrow" and
         (
@@ -1371,6 +1361,20 @@ private module MethodResolution {
       forall(ItemNode i | i = CallExprImpl::getResolvedFunction(this) | i instanceof Method)
     }
 
+    /**
+     * Holds if this call has a type qualifier, and we are able to resolve,
+     * using path resolution, the function to a member of `impl`.
+     *
+     * When this is the case, we still want to check that the type qualifier
+     * is an instance of the type being implemented, which is done in
+     * `MethodCallCallExprIsInstantiationOfInput`.
+     */
+    pragma[nomagic]
+    predicate hasTypeQualifiedCandidate(ImplItemNode impl) {
+      exists(getCallExprTypeQualifier(this, _)) and
+      CallExprImpl::getResolvedFunction(this) = impl.getASuccessor(_)
+    }
+
     pragma[nomagic]
     override predicate hasNameAndArity(string name, int arity) {
       name = CallExprImpl::getFunctionPath(this).getText() and
@@ -1492,18 +1496,30 @@ private module MethodResolution {
       )
     }
 
+    pragma[nomagic]
+    private predicate argIsInstanceOf(ImplOrTraitItemNode i) {
+      IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, MethodCallCallExprIsInstantiationOfInput>::isInstantiationOf(mc_,
+        i, _)
+    }
+
     pragma[nomagic]
     private predicate argIsInstanceOf(ImplOrTraitItemNode i, string name, int arity) {
       (
         ArgIsInstantiationOf<MethodCallCand, MethodCallReceiverIsInstantiationOfInput>::argIsInstanceOf(this,
           i, _)
         or
-        IsInstantiationOf<MethodCallCallExpr, TypeMentionTypeTree, MethodCallCallExprIsInstantiationOfInput>::isInstantiationOf(mc_,
-          i, _)
+        this.argIsInstanceOf(i)
       ) and
       mc_.hasNameAndArity(name, arity)
     }
 
+    pragma[nomagic]
+    private predicate foo(ImplOrTraitItemNode i) {
+      ArgIsInstantiationOf<MethodCallCand, MethodCallReceiverIsInstantiationOfInput>::argIsInstanceOf(this,
+        i, _) and
+      mc_ = Debug::getRelevantLocatable()
+    }
+
     pragma[nomagic]
     private Method resolveCallTargetCand(ImplOrTraitItemNode i) {
       exists(string name, int arity |
@@ -1553,11 +1569,11 @@ private module MethodResolution {
   {
     pragma[nomagic]
     predicate hasBlanketCandidate(
-      MethodCallCand mcc, Function m, TypePath blanketPath, TypeParam blanketTypeParam
+      MethodCallCand mcc, ImplItemNode impl, TypePath blanketPath, TypeParam blanketTypeParam
     ) {
       exists(MethodCall mc, string name, int arity |
         mcc.hasSignature(mc, _, _, name, arity) and
-        methodCallBlanketCandidate(mc, m, _, _, blanketPath, blanketTypeParam) and
+        methodCallBlanketCandidate(mc, _, impl, _, blanketPath, blanketTypeParam) and
         // Only apply blanket implementations when no other implementations are possible;
         // this is to account for codebases that use the (unstable) specialization feature
         // (https://rust-lang.github.io/rfcs/1210-impl-specialization.html)
@@ -1587,10 +1603,20 @@ private module MethodResolution {
         or
         methodCallBlanketCandidate(mc, m, i, selfType, _, _) and
         BlanketImplementation::SatisfiesBlanketConstraint<MethodCallCand, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(mcc,
-          m)
+          i)
       )
     }
 
+    private predicate potentialInstantiationOf1(
+      MethodCallCand mcc, ImplOrTraitItemNode i, FunctionType selfType, TypePath path, Type t,
+      TypePath path2, Type t2
+    ) {
+      potentialInstantiationOf0(mcc, i, selfType) and
+      mcc.getLocation() = Debug::getRelevantLocatable().getLocation() and
+      t = selfType.getTypeAt(path) and
+      t2 = mcc.getTypeAt(path2)
+    }
+
     pragma[nomagic]
     predicate potentialInstantiationOf(
       MethodCallCand mcc, TypeAbstraction abs, FunctionType constraint
@@ -1620,8 +1646,7 @@ private module MethodResolution {
     private predicate potentialInstantiationOf0(
       MethodCallCallExpr ce, ImplItemNode impl, TypeMentionTypeTree constraint
     ) {
-      exists(getCallExprTypeQualifier(ce, _)) and
-      CallExprImpl::getResolvedFunction(ce) = impl.getASuccessor(_) and
+      ce.hasTypeQualifiedCandidate(impl) and
       constraint = impl.getSelfPath()
     }
 
@@ -1634,7 +1659,7 @@ private module MethodResolution {
       then
         // inherent methods take precedence over trait methods, so only allow
         // trait methods when there are no matching inherent methods
-        MkMethodCallCand(ce, "").(MethodCallCand).hasNoInherentTarget()
+        MkMethodCallCand(ce, _).(MethodCallCand).hasNoInherentTarget()
       else any()
     }
 
@@ -1914,10 +1939,10 @@ private module AssocFunctionResolution {
 
   pragma[nomagic]
   private predicate functionCallBlanketCandidate(
-    AssocFunctionCall fc, AssocFunction f, FunctionTypePosition pos, TypePath blanketPath,
-    TypeParam blanketTypeParam
+    AssocFunctionCall fc, AssocFunction f, ImplItemNode impl, FunctionTypePosition pos,
+    TypePath blanketPath, TypeParam blanketTypeParam
   ) {
-    exists(string name, int arity, ImplItemNode impl, Trait trait, FunctionType t |
+    exists(string name, int arity, Trait trait, FunctionType t |
       fc.hasNameAndArity(name, arity) and
       exists(getTypeAt(fc, pos, blanketPath)) and
       functionInfoBlanketRelevantPos(f, name, arity, impl, trait, pos, t, blanketPath,
@@ -1928,7 +1953,7 @@ private module AssocFunctionResolution {
 
   private newtype TAssocFunctionCallAndPos =
     MkAssocFunctionCallAndPos(AssocFunctionCall fc, FunctionTypePosition pos) {
-      functionCallBlanketCandidate(fc, _, pos, _, _)
+      functionCallBlanketCandidate(fc, _, _, pos, _, _)
     }
 
   class AssocFunctionCallAndPos extends MkAssocFunctionCallAndPos {
@@ -1949,11 +1974,12 @@ private module AssocFunctionResolution {
   {
     pragma[nomagic]
     predicate hasBlanketCandidate(
-      AssocFunctionCallAndPos fcp, Function f, TypePath blanketPath, TypeParam blanketTypeParam
+      AssocFunctionCallAndPos fcp, ImplItemNode impl, TypePath blanketPath,
+      TypeParam blanketTypeParam
     ) {
       exists(AssocFunctionCall fc, FunctionTypePosition pos |
         fcp = MkAssocFunctionCallAndPos(fc, pos) and
-        functionCallBlanketCandidate(fc, f, pos, blanketPath, blanketTypeParam)
+        functionCallBlanketCandidate(fc, _, impl, pos, blanketPath, blanketTypeParam)
       )
     }
   }
@@ -1969,11 +1995,11 @@ private module AssocFunctionResolution {
     predicate potentialInstantiationOf(
       AssocFunctionCallAndPos fcp, TypeAbstraction abs, FunctionType constraint
     ) {
-      exists(Function f, FunctionTypePosition pos |
+      exists(FunctionTypePosition pos |
         BlanketImplementation::SatisfiesBlanketConstraint<AssocFunctionCallAndPos, SatisfiesBlanketConstraintInput>::satisfiesBlanketConstraint(fcp,
-          f) and
+          abs) and
         fcp = MkAssocFunctionCallAndPos(_, pos) and
-        functionInfoBlanketRelevantPos(f, _, _, abs, _, pos, constraint, _, _)
+        functionInfoBlanketRelevantPos(_, _, _, abs, _, pos, constraint, _, _)
       )
     }
 
@@ -2289,13 +2315,33 @@ private module OperationMatchingInput implements MatchingInputSig {
     Declaration getTarget() {
       result = this.resolveCallTarget(_) // mutual recursion
     }
+
+    private Declaration getTarget(
+      int c, FunctionTypePosition pos, TypePath path, Type type, Type t1, Type t2
+    ) {
+      c = strictcount(this.getTarget()) and
+      result = this.getTarget() and
+      FunctionOverloading::functionResolutionDependsOnArgument(_, result, pos, path, type) and
+      t1 = this.getInferredType(pos, path) and
+      t2 = result.getDeclaredType(pos, path) and
+      t1 != t2 and
+      not this.getInferredType(pos, path) = result.getDeclaredType(pos, path)
+    }
+
+    private Declaration getTarget(int c, FunctionTypePosition pos, TypePath path, Type type) {
+      c = strictcount(this.getTarget()) and
+      result = this.getTarget() and
+      this = Debug::getRelevantLocatable() and
+      type = result.getDeclaredType(pos, path)
+    }
   }
 }
 
 private module OperationMatching = Matching<OperationMatchingInput>;
 
 pragma[nomagic]
 private Type inferOperationType(AstNode n, TypePath path) {
+  // none() and
   exists(OperationMatchingInput::Access a, OperationMatchingInput::AccessPosition apos |
     n = a.getNodeAt(apos) and
     result = OperationMatching::inferAccessType(a, apos, path)
@@ -3079,8 +3125,8 @@ module Debug {
   Locatable getRelevantLocatable() {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
-      filepath.matches("%/sqlx.rs") and
-      startline = 246
+      filepath.matches("%/day23.rs") and
+      startline = 161
     )
   }