wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/FunctionOverloading.qll

@@ -86,7 +86,7 @@ predicate traitTypeParameterOccurrence(
   TypeParameter traitTp
 ) {
   f = trait.getAssocItem(functionName) and
-  traitTp = getAssocFunctionTypeAt(f, trait, pos, path) and
+  traitTp = getAssocFunctionTypeInclNonMethodSelfAt(f, trait, pos, path) and
   traitTp = trait.(TraitTypeAbstraction).getATypeParameter()
 }
 
@@ -141,7 +141,7 @@ pragma[nomagic]
 private Type getAssocFunctionNonTypeParameterTypeAt(
   ImplItemNode impl, Function f, FunctionPosition pos, TypePath path
 ) {
-  result = getAssocFunctionTypeAt(f, impl, pos, path) and
+  result = getAssocFunctionTypeInclNonMethodSelfAt(f, impl, pos, path) and
   not result instanceof TypeParameter
 }
 

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -82,7 +82,9 @@ private newtype TAssocFunctionType =
     // through `i`. This ensures that `parent` is either a supertrait of `i` or
     // `i` in an `impl` block implementing `parent`.
     (parent = i or BaseTypes::rootTypesSatisfaction(_, TTrait(parent), i, _, _)) and
-    exists(pos.getTypeMention(f))
+    // We always include the `self` position, even for non-methods, where it is used
+    // to match type qualifiers against the `impl` or trait type, such as in `Vec::new`.
+    (exists(pos.getTypeMention(f)) or pos.isSelf())
   }
 
 bindingset[abs, constraint, tp]
@@ -116,6 +118,22 @@ Type getAssocFunctionTypeAt(Function f, ImplOrTraitItemNode i, FunctionPosition
   )
 }
 
+/**
+ * Same as `getAssocFunctionTypeAt`, but also includes types at the `self` position
+ * for non-methods.
+ */
+pragma[nomagic]
+Type getAssocFunctionTypeInclNonMethodSelfAt(
+  Function f, ImplOrTraitItemNode i, FunctionPosition pos, TypePath path
+) {
+  result = getAssocFunctionTypeAt(f, i, pos, path)
+  or
+  f = i.getASuccessor(_) and
+  not f.hasSelfParam() and
+  pos.isSelf() and
+  result = resolveImplOrTraitType(i, path)
+}
+
 /**
  * The type of an associated function at a given position, when its implicit
  * `Self` type parameter is specialized to a given trait or `impl` block.
@@ -174,7 +192,7 @@ class AssocFunctionType extends MkAssocFunctionType {
   Type getTypeAt(TypePath path) {
     exists(Function f, FunctionPosition pos, ImplOrTraitItemNode i, Type t |
       this.appliesTo(f, i, pos) and
-      t = getAssocFunctionTypeAt(f, i, pos, path)
+      t = getAssocFunctionTypeInclNonMethodSelfAt(f, i, pos, path)
     |
       not t instanceof SelfTypeParameter and
       result = t
@@ -184,9 +202,12 @@ class AssocFunctionType extends MkAssocFunctionType {
   }
 
   private TypeMention getTypeMention() {
-    exists(Function f, FunctionPosition pos |
-      this.appliesTo(f, _, pos) and
+    exists(Function f, ImplOrTraitItemNode i, FunctionPosition pos | this.appliesTo(f, i, pos) |
       result = pos.getTypeMention(f)
+      or
+      pos.isSelf() and
+      not f.hasSelfParam() and
+      result = [i.(Impl).getSelfTy().(TypeMention), i.(TypeMention)]
     )
   }
 
@@ -294,8 +315,9 @@ module ArgIsInstantiationOf<
  */
 signature module ArgsAreInstantiationsOfInputSig {
   /**
-   * Holds if `f` implements a trait function with type parameter `traitTp`, where
-   * we need to check that the type of `f` for `traitTp` is satisfied.
+   * Holds if `f` implements (or is itself) a trait function with type parameter
+   * `traitTp`, where we need to check that the type of `f` for `traitTp` is
+   * satisfied.
    *
    * `pos` is one of the positions in `f` in which the relevant type occours.
    */

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -286,11 +286,13 @@ private class FunctionDeclaration extends Function {
   }
 
   pragma[nomagic]
-  Type getParameterType(ImplOrTraitItemNodeOption i, FunctionPosition pos, TypePath path) {
+  Type getParameterTypeInclNonMethodSelf(
+    ImplOrTraitItemNodeOption i, FunctionPosition pos, TypePath path
+  ) {
     i = parent and
     (
       not pos.isReturn() and
-      result = getAssocFunctionTypeAt(this, i.asSome(), pos, path)
+      result = getAssocFunctionTypeInclNonMethodSelfAt(this, i.asSome(), pos, path)
       or
       i.isNone() and
       result = this.getParam(pos.asPosition()).getTypeRepr().(TypeMention).getTypeAt(path)
@@ -322,13 +324,6 @@ private class FunctionDeclaration extends Function {
     else result = this.resolveRetType(i, path)
   }
 
-  Type getDeclaredType(ImplOrTraitItemNodeOption i, FunctionPosition pos, TypePath path) {
-    result = this.getParameterType(i, pos, path)
-    or
-    pos.isReturn() and
-    result = this.getReturnType(i, path)
-  }
-
   string toStringExt(ImplOrTraitItemNode i) {
     i = parent.asSome() and
     if this = i.getAnAssocItem()
@@ -1059,13 +1054,24 @@ private Path getCallExprPathQualifier(CallExpr ce) {
  *
  * For example, the type qualifier of `Foo::<i32>::default()` is `Foo::<i32>`,
  * but only when `Foo` is not a trait.
+ *
+ * `isDefaultTypeArg` indicates whether the returned type is a default type
+ * argument, for example in `Vec::new()` the default type for the type parameter
+ * `A` of `Vec` is `Global`.
  */
 pragma[nomagic]
-private Type getCallExprTypeQualifier(CallExpr ce, TypePath path) {
-  exists(TypeMention tm |
-    tm = getCallExprPathQualifier(ce) and
+private Type getCallExprTypeQualifier(CallExpr ce, TypePath path, boolean isDefaultTypeArg) {
+  exists(TypeMention tm | tm = getCallExprPathQualifier(ce) |
     result = tm.getTypeAt(path) and
-    not resolvePath(tm) instanceof Trait
+    not resolvePath(tm) instanceof Trait and
+    isDefaultTypeArg = false
+    or
+    exists(TypeParameter tp, TypePath suffix |
+      result =
+        tm.(NonAliasPathTypeMention).getDefaultTypeForTypeParameterInNonAnnotationAt(tp, suffix) and
+      path = TypePath::cons(tp, suffix) and
+      isDefaultTypeArg = true
+    )
   )
 }
 
@@ -1148,7 +1154,7 @@ private module ContextTyping {
         ) and
         not (
           tp instanceof TSelfTypeParameter and
-          exists(getCallExprTypeQualifier(this, _))
+          exists(getCallExprTypeQualifier(this, _, _))
         )
       )
     }
@@ -1947,7 +1953,7 @@ private module MethodResolution {
      */
     pragma[nomagic]
     predicate hasTypeQualifiedCandidate(ImplItemNode impl) {
-      exists(getCallExprTypeQualifier(this, _)) and
+      exists(getCallExprTypeQualifier(this, _, _)) and
       CallExprImpl::getResolvedFunction(this) = impl.getADescendant()
     }
 
@@ -1966,7 +1972,7 @@ private module MethodResolution {
 
     // needed for `TypeQualifierIsInstantiationOfImplSelfInput`
     Type getTypeAt(TypePath path) {
-      result = substituteLookupTraits(getCallExprTypeQualifier(this, path))
+      result = substituteLookupTraits(getCallExprTypeQualifier(this, path, _))
     }
 
     override predicate supportsAutoDerefAndBorrow() { none() }
@@ -2422,7 +2428,10 @@ private module MethodCallMatchingInput implements MatchingWithEnvironmentInputSi
     }
 
     Type getDeclaredType(DeclarationPosition dpos, TypePath path) {
-      result = m.getDeclaredType(someParent, dpos, path)
+      result = m.getParameterTypeInclNonMethodSelf(someParent, dpos, path)
+      or
+      dpos.isReturn() and
+      result = m.getReturnType(someParent, path)
     }
 
     string toString() { result = m.toStringExt(parent) }
@@ -2743,7 +2752,7 @@ private module NonMethodResolution {
       result = this.getPathResolutionResolved() and
       result = i.getASuccessor(_) and
       not exists(this.resolveCallTargetViaPathResolution()) and
-      FunctionOverloading::functionResolutionDependsOnArgument(i, result, _, _)
+      implTraitTypeParameterOccurrence(_, _, _, i, result, _, _)
     }
 
     pragma[nomagic]
@@ -2778,14 +2787,9 @@ private module NonMethodResolution {
       this.resolveCallTargetBlanketLikeCand(_, _, _, _) and
       not exists(this.resolveCallTargetViaPathResolution()) and
       forall(ImplOrTraitItemNode i, Function f |
-        this.(NonMethodNonTraitArgsAreInstantiationsOfNonBlanketInput::Call).hasTargetCand(i, f)
+        this.(NonMethodArgsAreInstantiationsOfNonBlanketInput::Call).hasTargetCand(i, f)
       |
-        NonMethodNonTraitArgsAreInstantiationsOfNonBlanket::argsAreNotInstantiationsOf(this, i, f)
-      ) and
-      forall(ImplOrTraitItemNode i, Function f |
-        this.(NonMethodTraitArgsAreInstantiationsOfNonBlanketInput::Call).hasTargetCand(i, f)
-      |
-        NonMethodTraitArgsAreInstantiationsOfNonBlanket::argsAreNotInstantiationsOf(this, i, f)
+        NonMethodArgsAreInstantiationsOfNonBlanket::argsAreNotInstantiationsOf(this, i, f)
       )
     }
 
@@ -2796,7 +2800,7 @@ private module NonMethodResolution {
     ItemNode resolveCallTargetViaPathResolution() {
       not this.hasTrait() and
       result = this.getPathResolutionResolved() and
-      not FunctionOverloading::functionResolutionDependsOnArgument(_, result, _, _)
+      not implTraitTypeParameterOccurrence(_, _, _, _, result, _, _)
     }
 
     /**
@@ -2809,9 +2813,7 @@ private module NonMethodResolution {
       or
       NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOf(this, i, result)
       or
-      NonMethodNonTraitArgsAreInstantiationsOfNonBlanket::argsAreInstantiationsOf(this, i, result)
-      or
-      NonMethodTraitArgsAreInstantiationsOfNonBlanket::argsAreInstantiationsOf(this, i, result)
+      NonMethodArgsAreInstantiationsOfNonBlanket::argsAreInstantiationsOf(this, i, result)
     }
 
     pragma[nomagic]
@@ -2890,21 +2892,27 @@ private module NonMethodResolution {
   private module ArgIsInstantiationOfBlanketParam =
     ArgIsInstantiationOf<CallAndBlanketPos, ArgIsInstantiationOfBlanketParamInput>;
 
-  private Type getArgType(NonMethodCall call, FunctionPosition pos, TypePath path) {
-    result = inferType(call.getNodeAt(pos), path)
+  private Type getArgType(
+    NonMethodCall call, FunctionPosition pos, TypePath path, boolean isDefaultTypeArg
+  ) {
+    result = inferType(call.getNodeAt(pos), path) and
+    isDefaultTypeArg = false
+    or
+    result = getCallExprTypeQualifier(call, path, isDefaultTypeArg) and
+    pos.isSelf()
   }
 
   private module NonMethodArgsAreInstantiationsOfBlanketInput implements
     ArgsAreInstantiationsOfInputSig
   {
     predicate toCheck(ImplOrTraitItemNode i, Function f, TypeParameter traitTp, FunctionPosition pos) {
-      // For calls to blanket functions, we check all the positions in which a
-      // type parameter occurs.
       implTraitTypeParameterOccurrence(_, _, pos, i, f, _, traitTp)
     }
 
     final class Call extends NonMethodCall {
-      Type getArgType(FunctionPosition pos, TypePath path) { result = getArgType(this, pos, path) }
+      Type getArgType(FunctionPosition pos, TypePath path) {
+        result = getArgType(this, pos, path, false)
+      }
 
       predicate hasTargetCand(ImplOrTraitItemNode i, Function f) {
         f = this.resolveCallTargetBlanketCand(i)
@@ -2915,31 +2923,10 @@ private module NonMethodResolution {
   private module NonMethodArgsAreInstantiationsOfBlanket =
     ArgsAreInstantiationsOf<NonMethodArgsAreInstantiationsOfBlanketInput>;
 
-  private module NonMethodNonTraitArgsAreInstantiationsOfNonBlanketInput implements
+  private module NonMethodArgsAreInstantiationsOfNonBlanketInput implements
     ArgsAreInstantiationsOfInputSig
   {
     predicate toCheck(ImplOrTraitItemNode i, Function f, TypeParameter traitTp, FunctionPosition pos) {
-      // For calls to non-blanket functions, where no trait qualifier is supplied, e.g.
-      // `Vec::from(...)` we only check the positions needed for disambiguating sibling
-      // implementations.
-      FunctionOverloading::functionResolutionDependsOnArgument(i, f, traitTp, pos)
-    }
-
-    class Call extends NonMethodCall {
-      Type getArgType(FunctionPosition pos, TypePath path) { result = getArgType(this, pos, path) }
-
-      predicate hasTargetCand(ImplOrTraitItemNode i, Function f) {
-        f = this.resolveCallTargetNonBlanketCand(i)
-      }
-    }
-  }
-
-  private module NonMethodTraitArgsAreInstantiationsOfNonBlanketInput implements
-    ArgsAreInstantiationsOfInputSig
-  {
-    predicate toCheck(ImplOrTraitItemNode i, Function f, TypeParameter traitTp, FunctionPosition pos) {
-      // For calls to non-blanket functions, where a trait qualifier is supplied, e.g.
-      // `From::from(...)`, we check all the positions in which a type parameter occurs.
       implTraitTypeParameterOccurrence(_, _, pos, i, f, _, traitTp)
       or
       // Also match against the trait function itself
@@ -2948,9 +2935,13 @@ private module NonMethodResolution {
     }
 
     class Call extends NonMethodCall {
-      Type getArgType(FunctionPosition pos, TypePath path) { result = getArgType(this, pos, path) }
+      Type getArgType(FunctionPosition pos, TypePath path) {
+        result = getArgType(this, pos, path, _)
+      }
 
       predicate hasTargetCand(ImplOrTraitItemNode i, Function f) {
+        f = this.resolveCallTargetNonBlanketCand(i)
+        or
         exists(TraitItemNode trait, NonMethodFunction resolved, ImplItemNode i1, Function f1 |
           this.hasTraitResolved(trait, resolved) and
           implTraitTypeParameterOccurrence(trait, resolved, _, i1, f1, _, _) and
@@ -2975,11 +2966,8 @@ private module NonMethodResolution {
     }
   }
 
-  private module NonMethodNonTraitArgsAreInstantiationsOfNonBlanket =
-    ArgsAreInstantiationsOf<NonMethodNonTraitArgsAreInstantiationsOfNonBlanketInput>;
-
-  private module NonMethodTraitArgsAreInstantiationsOfNonBlanket =
-    ArgsAreInstantiationsOf<NonMethodTraitArgsAreInstantiationsOfNonBlanketInput>;
+  private module NonMethodArgsAreInstantiationsOfNonBlanket =
+    ArgsAreInstantiationsOf<NonMethodArgsAreInstantiationsOfNonBlanketInput>;
 }
 
 abstract private class TupleLikeConstructor extends Addressable {
@@ -3079,26 +3067,7 @@ private module NonMethodCallMatchingInput implements MatchingInputSig {
     }
 
     override Type getParameterType(DeclarationPosition dpos, TypePath path) {
-      // For associated functions, we may also need to match type arguments against
-      // the `Self` type. For example, in
-      //
-      // ```rust
-      // struct Foo<T>(T);
-      //
-      // impl<T : Default> Foo<T> {
-      //   fn default() -> Self {
-      //     Foo(Default::default())
-      //   }
-      // }
-      //
-      // Foo::<i32>::default();
-      // ```
-      //
-      // we need to match `i32` against the type parameter `T` of the `impl` block.
-      dpos.isSelf() and
-      result = resolveImplOrTraitType(i.asSome(), path)
-      or
-      result = f.getParameterType(i, dpos, path)
+      result = f.getParameterTypeInclNonMethodSelf(i, dpos, path)
     }
 
     override Type getReturnType(TypePath path) { result = f.getReturnType(i, path) }
@@ -3143,7 +3112,7 @@ private module NonMethodCallMatchingInput implements MatchingInputSig {
     pragma[nomagic]
     Type getInferredType(AccessPosition apos, TypePath path) {
       apos.isSelf() and
-      result = getCallExprTypeQualifier(this, path)
+      result = getCallExprTypeQualifier(this, path, false)
       or
       result = inferType(this.getNodeAt(apos), path)
     }