wip

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/CallExprBaseImpl.qll

@@ -28,11 +28,7 @@ module Impl {
    */
   class CallExprBase extends Generated::CallExprBase {
     /** Gets the static target of this call, if any. */
-    final Callable getStaticTarget() {
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      result = TypeInference::resolveCallTarget(this)
-    }
+    final Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     override Expr getArg(int index) { result = this.getArgList().getArg(index) }
   }

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -59,11 +59,7 @@ module Impl {
     Expr getReceiver() { result = this.getArgument(TSelfArgumentPosition()) }
 
     /** Gets the static target of this call, if any. */
-    Function getStaticTarget() {
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      result = this.(CallExpr).getStaticTarget()
-    }
+    Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     /** Gets a runtime target of this call, if any. */
     pragma[nomagic]

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -770,9 +770,7 @@ private module CallExprBaseMatchingInput implements MatchingInputSig {
     Declaration getTarget() {
       result = resolveMethodCallTarget(this) // mutual recursion; resolving method calls requires resolving types and vice versa
       or
-      result = resolveCallTargetSimple(this)
-      or
-      result = resolveCallTargetComplex(this) // mutual recursion
+      result = resolveFunctionCallTarget(this) // potential mutual recursion; resolving some associated function calls requires resolving types
     }
   }
 
@@ -1221,12 +1219,22 @@ private Type inferForLoopExprType(AstNode n, TypePath path) {
 final class MethodCall extends Call {
   MethodCall() { exists(this.getReceiver()) }
 
+  private Type getReceiverTypeAt(TypePath path) {
+    result = inferType(super.getReceiver(), path)
+    or
+    exists(PathExpr pe, TypeMention tm |
+      pe = this.(CallExpr).getFunction() and
+      tm = pe.getPath().getQualifier() and
+      result = tm.resolveTypeAt(path)
+    )
+  }
+
   /** Gets the type of the receiver of the method call at `path`. */
   Type getTypeAt(TypePath path) {
     if this.receiverImplicitlyBorrowed()
     then
       exists(TypePath path0, Type t0 |
-        t0 = inferType(super.getReceiver(), path0) and
+        t0 = this.getReceiverTypeAt(path0) and
         (
           path0.isCons(TRefTypeParameter(), path)
           or
@@ -1254,10 +1262,14 @@ final class MethodCall extends Call {
         t0.(StructType).asItemNode() instanceof StringStruct and
         result.(StructType).asItemNode() instanceof Builtins::Str
       )
-    else result = inferType(super.getReceiver(), path)
+    else result = this.getReceiverTypeAt(path)
   }
 }
 
+final private class FunctionCallExpr extends CallExpr {
+  FunctionCallExpr() { not this instanceof MethodCall }
+}
+
 /**
  * Holds if a method for `type` with the name `name` and the arity `arity`
  * exists in `impl`.
@@ -1497,15 +1509,28 @@ private Function getTraitMethod(ImplTraitReturnType trait, string name) {
   result = getMethodSuccessor(trait.getImplTraitTypeRepr(), name)
 }
 
+pragma[nomagic]
+private Function resolveMethodCallTarget(MethodCall mc) {
+  // The method comes from an `impl` block targeting the type of the receiver.
+  result = getMethodFromImpl(mc)
+  or
+  // The type of the receiver is a type parameter and the method comes from a
+  // trait bound on the type parameter.
+  result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
+  or
+  // The type of the receiver is an `impl Trait` type.
+  result = getTraitMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
+}
+
 pragma[nomagic]
 private predicate assocFuncResolutionDependsOnArgument(Function f, Impl impl, int pos) {
   methodResolutionDependsOnArgument(impl, _, f, pos, _, _)
 }
 
-private class AssocFuncCallExpr extends CallExpr {
+private class AssocFunctionCallExpr extends FunctionCallExpr {
   private int pos;
 
-  AssocFuncCallExpr() {
+  AssocFunctionCallExpr() {
     assocFuncResolutionDependsOnArgument(CallExprImpl::getResolvedFunction(this), _, pos)
   }
 
@@ -1521,11 +1546,11 @@ private class AssocFuncCallExpr extends CallExpr {
 }
 
 private module AssocFuncIsInstantiationOfInput implements
-  IsInstantiationOfInputSig<AssocFuncCallExpr>
+  IsInstantiationOfInputSig<AssocFunctionCallExpr>
 {
   pragma[nomagic]
   predicate potentialInstantiationOf(
-    AssocFuncCallExpr ce, TypeAbstraction impl, TypeMention constraint
+    AssocFunctionCallExpr ce, TypeAbstraction impl, TypeMention constraint
   ) {
     exists(Function cand |
       cand = ce.getACandidate(impl) and
@@ -1534,21 +1559,34 @@ private module AssocFuncIsInstantiationOfInput implements
   }
 }
 
+/**
+ * Gets the target of `call`, where resolution does not rely on type inference.
+ */
 pragma[nomagic]
-ItemNode resolveCallTargetSimple(CallExpr ce) {
-  result = CallExprImpl::getResolvedFunction(ce) and
+private ItemNode resolveFunctionCallTargetSimple(FunctionCallExpr call) {
+  result = CallExprImpl::getResolvedFunction(call) and
   not assocFuncResolutionDependsOnArgument(result, _, _)
 }
 
+/**
+ * Gets the target of `call`, where resolution relies on type inference.
+ */
 pragma[nomagic]
-Function resolveCallTargetComplex(AssocFuncCallExpr ce) {
+private Function resolveFunctionCallTargetComplex(AssocFunctionCallExpr call) {
   exists(Impl impl |
-    IsInstantiationOf<AssocFuncCallExpr, AssocFuncIsInstantiationOfInput>::isInstantiationOf(ce,
+    IsInstantiationOf<AssocFunctionCallExpr, AssocFuncIsInstantiationOfInput>::isInstantiationOf(call,
       impl, _) and
-    result = getMethodSuccessor(impl, ce.getACandidate(_).getName().getText())
+    result = getMethodSuccessor(impl, call.getACandidate(_).getName().getText())
   )
 }
 
+pragma[inline]
+private ItemNode resolveFunctionCallTarget(FunctionCallExpr call) {
+  result = resolveFunctionCallTargetSimple(call)
+  or
+  result = resolveFunctionCallTargetComplex(call)
+}
+
 cached
 private module Cached {
   private import codeql.rust.internal.CachedStages
@@ -1577,26 +1615,12 @@ private module Cached {
     )
   }
 
-  /** Gets a method that the method call `mc` resolves to, if any. */
-  cached
-  Function resolveMethodCallTarget(MethodCall mc) {
-    // The method comes from an `impl` block targeting the type of the receiver.
-    result = getMethodFromImpl(mc)
-    or
-    // The type of the receiver is a type parameter and the method comes from a
-    // trait bound on the type parameter.
-    result = getTypeParameterMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
-    or
-    // The type of the receiver is an `impl Trait` type.
-    result = getTraitMethod(mc.getTypeAt(TypePath::nil()), mc.getMethodName())
-  }
-
-  /** Gets a method that the method call `mc` resolves to, if any. */
+  /** Gets a function that `call` resolves to, if any. */
   cached
-  Function resolveCallTarget(CallExpr ce) {
-    result = resolveCallTargetSimple(ce)
+  Function resolveCallTarget(Call call) {
+    result = resolveMethodCallTarget(call)
     or
-    result = resolveCallTargetComplex(ce)
+    result = resolveFunctionCallTarget(call)
   }
 
   pragma[inline]
@@ -1733,8 +1757,8 @@ private module Debug {
   private Locatable getRelevantLocatable() {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
-      filepath.matches("%/sqlx.rs") and
-      startline = [56 .. 60]
+      filepath.matches("%/main.rs") and
+      startline = 120
     )
   }
 

rust/ql/test/library-tests/type-inference/main.rs

@@ -117,7 +117,7 @@ mod trait_impl {
         let a = x.trait_method(); // $ type=a:bool method=MyThing::trait_method
 
         let y = MyThing { field: false };
-        let b = MyTrait::trait_method(y); // $ type=b:bool method=MyThing::trait_method $ SPURIOUS: method=trait_method
+        let b = MyTrait::trait_method(y); // $ type=b:bool method=MyThing::trait_method
     }
 }
 

rust/ql/test/library-tests/type-inference/type-inference.expected

@@ -273,14 +273,11 @@ inferType
 | main.rs:117:17:117:17 | x |  | main.rs:99:5:102:5 | MyThing |
 | main.rs:117:17:117:32 | x.trait_method() |  | {EXTERNAL LOCATION} | bool |
 | main.rs:119:13:119:13 | y |  | main.rs:99:5:102:5 | MyThing |
-| main.rs:119:13:119:13 | y |  | main.rs:104:5:106:5 | trait MyTrait |
 | main.rs:119:17:119:40 | MyThing {...} |  | main.rs:99:5:102:5 | MyThing |
-| main.rs:119:17:119:40 | MyThing {...} |  | main.rs:104:5:106:5 | trait MyTrait |
 | main.rs:119:34:119:38 | false |  | {EXTERNAL LOCATION} | bool |
 | main.rs:120:13:120:13 | b |  | {EXTERNAL LOCATION} | bool |
 | main.rs:120:17:120:40 | ...::trait_method(...) |  | {EXTERNAL LOCATION} | bool |
 | main.rs:120:39:120:39 | y |  | main.rs:99:5:102:5 | MyThing |
-| main.rs:120:39:120:39 | y |  | main.rs:104:5:106:5 | trait MyTrait |
 | main.rs:137:15:137:18 | SelfParam |  | main.rs:125:5:128:5 | MyThing |
 | main.rs:137:15:137:18 | SelfParam | A | main.rs:130:5:131:14 | S1 |
 | main.rs:137:27:139:9 | { ... } |  | main.rs:130:5:131:14 | S1 |