wip

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -125,7 +125,7 @@ module Impl {
       // trait method's default implementation. This is not a dispatch whose
       // target is inferred from the type of the receiver, but should always
       // resolve to the function in the trait block as path resolution does.
-      qualifier.toString() != "Self"
+      not qualifier.(RelevantPath).isUnqualified("Self")
     }
 
     override predicate implicitBorrowAt(ArgumentPosition pos, boolean certain) { none() }

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -425,6 +425,8 @@ final class TraitTypeAbstraction extends TypeAbstraction, Trait {
     result.(TypeParamTypeParameter).getTypeParam() = this.getGenericParamList().getATypeParam()
     or
     result.(AssociatedTypeTypeParameter).getTrait() = this
+    or
+    result.(SelfTypeParameter).getTrait() = this
   }
 }
 

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -1277,10 +1277,6 @@ final class MethodCall extends Call {
   }
 }
 
-final private class FunctionCallExpr extends CallExpr {
-  FunctionCallExpr() { not this instanceof MethodCall }
-}
-
 /**
  * Holds if a method for `type` with the name `name` and the arity `arity`
  * exists in `impl`.
@@ -1406,42 +1402,48 @@ private predicate implSiblings(TraitItemNode trait, Impl impl1, Impl impl2) {
 pragma[nomagic]
 private predicate implHasSibling(Impl impl, Trait trait) { implSiblings(trait, impl, _) }
 
+pragma[nomagic]
+private predicate functionTypeAtPath(Function f, int pos, TypePath path, Type type) {
+  exists(TypeMention tm | type = tm.resolveTypeAt(path) |
+    tm = f.getParam(pos).getTypeRepr()
+    or
+    pos = -1 and
+    tm = f.getRetType().getTypeRepr()
+  )
+}
+
 /**
- * Holds if a type parameter of `trait` occurs in the method with the name
- * `methodName` at the `pos`th parameter at `path`.
+ * Holds if a type parameter of `trait` occurs in the function with the name
+ * `functionName` at the `pos`th parameter at `path`.
+ *
+ * The special position `-1` refers to the return type of the function, which
+ * is sometimes needed to disambiguate associated function calls like
+ * `Default::default()`.
  */
 bindingset[trait]
 pragma[inline_late]
 private predicate traitTypeParameterOccurrence(
-  TraitItemNode trait, string methodName, int pos, TypePath path
+  TraitItemNode trait, Function f, string functionName, int pos, TypePath path
 ) {
-  exists(Function f | f = trait.getAssocItem(methodName) |
-    f.getParam(pos).getTypeRepr().(TypeMention).resolveTypeAt(path) =
-      trait.(TraitTypeAbstraction).getATypeParameter()
-  )
-}
-
-bindingset[f, pos, path]
-pragma[inline_late]
-private predicate methodTypeAtPath(Function f, int pos, TypePath path, Type type) {
-  f.getParam(pos).getTypeRepr().(TypeMention).resolveTypeAt(path) = type
+  f = trait.getAssocItem(functionName) and
+  functionTypeAtPath(f, pos, path, trait.(TraitTypeAbstraction).getATypeParameter())
 }
 
 /**
- * Holds if resolving the method `f` in `impl` with the name `methodName`
+ * Holds if resolving the function `f` in `impl` with the name `functionName`
  * requires inspecting the types of applied _arguments_ in order to determine
  * whether it is the correct resolution.
  */
 pragma[nomagic]
-private predicate methodResolutionDependsOnArgument(
-  ImplItemNode impl, string methodName, Function f, int pos, TypePath path, Type type
+private predicate functionResolutionDependsOnArgument(
+  ImplItemNode impl, string functionName, Function f, int pos, TypePath path, Type type
 ) {
   /*
    * As seen in the example below, when an implementation has a sibling for a
-   * trait we find occurrences of a type parameter of the trait in a method
+   * trait we find occurrences of a type parameter of the trait in a function
    * signature in the trait. We then find the type given in the implementation
    * at the same position, which is a position that might disambiguate the
-   * method from its siblings.
+   * function from its siblings.
    *
    * ```rust
    * trait MyTrait<T> {
@@ -1463,9 +1465,10 @@ private predicate methodResolutionDependsOnArgument(
 
   exists(TraitItemNode trait |
     implHasSibling(impl, trait) and
-    traitTypeParameterOccurrence(trait, methodName, pos, path) and
-    methodTypeAtPath(f, pos, path, type) and
-    f = impl.getAssocItem(methodName)
+    traitTypeParameterOccurrence(trait, _, functionName, pos, path) and
+    functionTypeAtPath(f, pos, path, type) and
+    f = impl.getAssocItem(functionName) and
+    pos >= 0
   )
 }
 
@@ -1505,11 +1508,12 @@ private Function getMethodFromImpl(MethodCall mc) {
     name = mc.getMethodName() and
     result = getMethodSuccessor(impl, name)
   |
-    not methodResolutionDependsOnArgument(impl, _, _, _, _, _)
+    not functionResolutionDependsOnArgument(impl, name, _, _, _, _)
     or
     exists(int pos, TypePath path, Type type |
-      methodResolutionDependsOnArgument(impl, name, result, pos, path, type) and
-      inferType(mc.getPositionalArgument(pos), path) = type
+      functionResolutionDependsOnArgument(impl, name, result, pos, pragma[only_bind_into](path),
+        type) and
+      inferType(mc.getPositionalArgument(pos), pragma[only_bind_into](path)) = type
     )
   )
 }
@@ -1535,37 +1539,96 @@ private Function resolveMethodCallTarget(MethodCall mc) {
 
 pragma[nomagic]
 private predicate assocFuncResolutionDependsOnArgument(Function f, Impl impl, int pos) {
-  methodResolutionDependsOnArgument(impl, _, f, pos, _, _)
+  functionResolutionDependsOnArgument(impl, _, f, pos, _, _) and
+  not f.getParamList().hasSelfParam()
 }
 
-private class AssocFunctionCallExpr extends FunctionCallExpr {
-  private int pos;
+private class FunctionCallExpr extends CallExpr {
+  FunctionCallExpr() { not this instanceof MethodCall }
+
+  ItemNode getResolvedFunction() { result = CallExprImpl::getResolvedFunction(this) }
 
-  AssocFunctionCallExpr() {
-    assocFuncResolutionDependsOnArgument(CallExprImpl::getResolvedFunction(this), _, pos)
+  pragma[nomagic]
+  Trait getTrait() {
+    exists(Path qualifier |
+      qualifier = this.getFunction().(PathExpr).getPath().getQualifier() and
+      result = resolvePath(qualifier) and
+      // When the qualifier is `Self` and resolves to a trait, it's inside a
+      // trait method's default implementation. This is not a dispatch whose
+      // target is inferred from the type of the receiver, but should always
+      // resolve to the function in the trait block as path resolution does.
+      not qualifier.(RelevantPath).isUnqualified("Self")
+    )
   }
 
-  Function getACandidate(Impl impl) {
-    result = CallExprImpl::getResolvedFunction(this) and
+  predicate hasTrait() { exists(this.getTrait()) }
+
+  predicate isAmbigous() {
+    this.hasTrait()
+    or
+    assocFuncResolutionDependsOnArgument(this.getResolvedFunction(), _, _)
+  }
+
+  pragma[nomagic]
+  Function getAnAmbigousCandiate(ImplItemNode impl, int pos) {
+    exists(TraitItemNode trait, Function traitFunction |
+      trait = this.getTrait() and
+      traitFunction = this.getResolvedFunction() and
+      result.implements(traitFunction) and
+      result = impl.getAnAssocItem()
+    |
+      assocFuncResolutionDependsOnArgument(result, impl, pos)
+      or
+      not assocFuncResolutionDependsOnArgument(result, _, _) and
+      traitTypeParameterOccurrence(trait, traitFunction, _, pos, _)
+    )
+    or
+    result = this.getResolvedFunction() and
     assocFuncResolutionDependsOnArgument(result, impl, pos)
   }
 
-  int getPosition() { result = pos }
+  Function getAnAmbigousCandiate(ImplItemNode impl, int pos, int rnk) {
+    pos = rank[rnk + 1](int pos0 | result = this.getAnAmbigousCandiate(impl, pos0) | pos0)
+  }
+}
+
+private newtype TAmbigousAssocFunctionCallExpr =
+  MkAmbigousAssocFunctionCallExpr(FunctionCallExpr call, Function f, ImplItemNode impl, int pos) {
+    f = call.getAnAmbigousCandiate(impl, pos)
+  }
+
+private class AmbigousAssocFunctionCallExpr extends MkAmbigousAssocFunctionCallExpr {
+  FunctionCallExpr call;
+  Function f;
+  ImplItemNode impl_;
+  int pos;
+
+  AmbigousAssocFunctionCallExpr() { this = MkAmbigousAssocFunctionCallExpr(call, f, impl_, pos) }
+
+  Type getTypeAt(TypePath path) {
+    result = inferType(call.getArg(pos), path)
+    or
+    pos = -1 and
+    result = inferType(call, path)
+  }
+
+  string toString() { result = call.toString() }
 
-  /** Gets the type of the receiver of the associated function call at `path`. */
-  Type getTypeAt(TypePath path) { result = inferType(this.getArg(pos), path) }
+  Location getLocation() { result = call.getLocation() }
 }
 
-private module AssocFuncIsInstantiationOfInput implements
-  IsInstantiationOfInputSig<AssocFunctionCallExpr>
+private module AmbigousAssocFuncIsInstantiationOfInput implements
+  IsInstantiationOfInputSig<AmbigousAssocFunctionCallExpr>
 {
   pragma[nomagic]
   predicate potentialInstantiationOf(
-    AssocFunctionCallExpr ce, TypeAbstraction impl, TypeMention constraint
+    AmbigousAssocFunctionCallExpr ce, TypeAbstraction impl, TypeMention constraint
   ) {
-    exists(Function cand |
-      cand = ce.getACandidate(impl) and
-      constraint = cand.getParam(ce.getPosition()).getTypeRepr()
+    exists(Function cand, int pos | ce = MkAmbigousAssocFunctionCallExpr(_, cand, impl, pos) |
+      constraint = cand.getParam(pos).getTypeRepr()
+      or
+      pos = -1 and
+      constraint = cand.getRetType().getTypeRepr()
     )
   }
 }
@@ -1574,28 +1637,39 @@ private module AssocFuncIsInstantiationOfInput implements
  * Gets the target of `call`, where resolution does not rely on type inference.
  */
 pragma[nomagic]
-private ItemNode resolveFunctionCallTargetSimple(FunctionCallExpr call) {
-  result = CallExprImpl::getResolvedFunction(call) and
-  not assocFuncResolutionDependsOnArgument(result, _, _)
+private ItemNode resolveUnambigousFunctionCallTarget(FunctionCallExpr call) {
+  result = call.getResolvedFunction() and
+  not call.isAmbigous()
+}
+
+pragma[nomagic]
+private Function resolveAmbigousFunctionCallTargetFromIndex(FunctionCallExpr call, int index) {
+  exists(Impl impl, int pos |
+    IsInstantiationOf<AmbigousAssocFunctionCallExpr, AmbigousAssocFuncIsInstantiationOfInput>::isInstantiationOf(MkAmbigousAssocFunctionCallExpr(call,
+        result, _, pos), impl, _) and
+    result = call.getAnAmbigousCandiate(impl, pos, index)
+  |
+    index = 0
+    or
+    result = resolveAmbigousFunctionCallTargetFromIndex(call, index - 1)
+  )
 }
 
 /**
  * Gets the target of `call`, where resolution relies on type inference.
  */
 pragma[nomagic]
-private Function resolveFunctionCallTargetComplex(AssocFunctionCallExpr call) {
-  exists(Impl impl |
-    IsInstantiationOf<AssocFunctionCallExpr, AssocFuncIsInstantiationOfInput>::isInstantiationOf(call,
-      impl, _) and
-    result = getMethodSuccessor(impl, call.getACandidate(_).getName().getText())
-  )
+private Function resolveAmbigousFunctionCallTarget(FunctionCallExpr call) {
+  result =
+    resolveAmbigousFunctionCallTargetFromIndex(call,
+      max(int index | result = call.getAnAmbigousCandiate(_, _, index)))
 }
 
 pragma[inline]
 private ItemNode resolveFunctionCallTarget(FunctionCallExpr call) {
-  result = resolveFunctionCallTargetSimple(call)
+  result = resolveUnambigousFunctionCallTarget(call)
   or
-  result = resolveFunctionCallTargetComplex(call)
+  result = resolveAmbigousFunctionCallTarget(call)
 }
 
 cached
@@ -1770,8 +1844,8 @@ private module Debug {
   private Locatable getRelevantLocatable() {
     exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
       result.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
-      filepath.matches("%/sqlx.rs") and
-      startline = [56 .. 60]
+      filepath.matches("%/test_futures.rs") and
+      startline = 45
     )
   }
 

rust/ql/test/library-tests/dataflow/global/CONSISTENCY/PathResolutionConsistency.expected

@@ -0,0 +1,2 @@
+multipleCallTargets
+| main.rs:272:14:272:29 | ...::deref(...) |

rust/ql/test/library-tests/type-inference/main.rs

@@ -2096,10 +2096,10 @@ mod method_determined_by_argument_type {
 
         let x = i64::my_from(73i64); // $ method=MyFrom<i64>::my_from
         let y = i64::my_from(true); // $ method=MyFrom<bool>::my_from
-        let z: i64 = MyFrom::my_from(73i64); // $ MISSING: method=MyFrom<i64>::my_from $ SPURIOUS: method=MyFrom::my_from
+        let z: i64 = MyFrom::my_from(73i64); // $ method=MyFrom<i64>::my_from
         i64::my_from2(73i64, 0i64); // $ method=MyFrom2<i64>::my_from2
         i64::my_from2(true, 0i64); // $ method=MyFrom2<bool>::my_from2
-        MyFrom2::my_from2(73i64, 0i64); // $ MISSING: method=MyFrom2<i64>::my_from2 $ SPURIOUS: method=MyFrom2::my_from2
+        MyFrom2::my_from2(73i64, 0i64); // $ method=MyFrom2<i64>::my_from2
     }
 }