wip4

Author: hvitved

rust/ql/lib/codeql/rust/internal/TypeInference.qll

@@ -1238,7 +1238,8 @@ private module MethodCallResolution {
       derefChain = ""
       or
       exists(TypePath path0, Type t0, string derefChain0 |
-        t0 = this.getACandidateReceiverTypeAtNoMatch(path0, derefChain0)
+        this.noCandidateReceiverTypeAt(derefChain0) and
+        t0 = this.getACandidateReceiverTypeAtNoBorrow(path0, derefChain0)
       |
         path0.isCons(TRefTypeParameter(), path) and
         result = t0 and
@@ -1252,23 +1253,29 @@ private module MethodCallResolution {
       )
     }
 
+    /**
+     * Holds if the method inside `i` with matching name and arity can be ruled out
+     * as a candidate for the receiver type represented by `derefChainBorrow`.
+     */
     pragma[nomagic]
     private predicate isNotCandidate(ImplOrTraitItemNode i, string derefChainBorrow) {
       IsInstantiationOf<MethodCallCand, FunctionType, MethodCallIsInstantiationOfInput>::isNotInstantiationOf(MkMethodCallCand(this,
           derefChainBorrow), i, _)
       or
-      // not MethodCallIsInstantiationOfInput::potentialInstantiationOf(mcc, abs, constraint)
       exists(Type rootType, TypePath selfRootPath, Type selfRootType |
         rootType = this.getACandidateReceiverTypeAtSubstituteTraitBounds(derefChainBorrow) and
-        // mcc.isMethodCall(mc, selfPath, selfType, name, arity) and
         methodCallCandidate(this, i, _, rootType, selfRootPath, selfRootType) and
         selfRootType !=
           this.getACandidateReceiverTypeAtSubstituteTraitBounds(selfRootPath, derefChainBorrow)
       )
     }
 
+    /**
+     * Holds if the candidate receiver type represented by `derefChain` does not
+     * have a matching method target.
+     */
     pragma[nomagic]
-    private predicate getACandidateReceiverTypeAtNoBorrowNoMatch0(string derefChain) {
+    private predicate noCandidateReceiverTypeAtNoBorrow(string derefChain) {
       exists(Type rootType, string derefChainBorrow |
         derefChainBorrow = derefChain + ";" and
         not derefChain.matches("%.ref") and // no need to try a borrow if the last thing we did was a deref
@@ -1280,43 +1287,36 @@ private module MethodCallResolution {
       )
     }
 
-    pragma[nomagic]
-    private Type getACandidateReceiverTypeAtNoBorrowNoMatch(TypePath path, string derefChain) {
-      result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
-      this.getACandidateReceiverTypeAtNoBorrowNoMatch0(derefChain)
-    }
-
     pragma[nomagic]
     private predicate hasRefCandidate(ImplOrTraitItemNode i) {
       methodCallCandidate(this, i, _, TRefType(), _, _)
     }
 
+    /**
+     * Holds if the candidate receiver type represented by `derefChain;borrow` does not
+     * have a matching method target.
+     */
     pragma[nomagic]
-    private predicate getACandidateReceiverTypeAtNoMatch0(string derefChain) {
+    private predicate noCandidateReceiverTypeAt(string derefChain) {
       exists(string derefChainBorrow |
         derefChainBorrow = derefChain + ";borrow" and
-        this.getACandidateReceiverTypeAtNoBorrowNoMatch0(derefChain)
+        this.noCandidateReceiverTypeAtNoBorrow(derefChain)
       |
         forall(ImplOrTraitItemNode i | this.hasRefCandidate(i) |
           this.isNotCandidate(i, derefChainBorrow)
         )
       )
     }
 
-    pragma[nomagic]
-    private Type getACandidateReceiverTypeAtNoMatch(TypePath path, string derefChain) {
-      result = this.getACandidateReceiverTypeAtNoBorrowNoMatch(path, derefChain) and
-      this.getACandidateReceiverTypeAtNoMatch0(derefChain)
-    }
-
     /**
      * Gets a [candidate receiver type][1] of this method call at `path`.
      *
      * The type is obtained by repeatedly dereferencing the receiver expression's type,
      * as long as the method cannot be resolved in an earlier candidate type, and possibly
      * applying a borrow at the end.
      *
-     * The string `derefChainBorrow` encodes the above, separated by a semi-colon.
+     * The string `derefChainBorrow` encodes the sequences of dereferences and whether a
+     * borrow has been applied.
      *
      * [1]: https://doc.rust-lang.org/reference/expressions/method-call-expr.html#r-expr.method.candidate-receivers
      */
@@ -1326,19 +1326,24 @@ private module MethodCallResolution {
         result = this.getACandidateReceiverTypeAtNoBorrow(path, derefChain) and
         derefChainBorrow = derefChain + ";"
         or
-        exists(TypePath path0, Type t0 |
-          t0 = this.getACandidateReceiverTypeAtNoBorrowNoMatch(path0, derefChain) and
-          derefChainBorrow = derefChain + ";borrow"
-        |
+        this.noCandidateReceiverTypeAtNoBorrow(derefChain) and
+        derefChainBorrow = derefChain + ";borrow" and
+        (
           path.isEmpty() and
           result = TRefType()
           or
-          path = TypePath::cons(TRefTypeParameter(), path0) and
-          result = t0
+          exists(TypePath suffix |
+            result = this.getACandidateReceiverTypeAtNoBorrow(suffix, derefChain) and
+            path = TypePath::cons(TRefTypeParameter(), suffix)
+          )
         )
       )
     }
 
+    /**
+     * Same as `getACandidateReceiverTypeAt`, but with traits substituted in for types
+     * with trait bounds.
+     */
     pragma[nomagic]
     Type getACandidateReceiverTypeAtSubstituteTraitBounds(TypePath path, string derefChainBorrow) {
       result = substituteTraitBounds(this.getACandidateReceiverTypeAt(path, derefChainBorrow))
@@ -1427,19 +1432,16 @@ private module MethodCallResolution {
       mc.isMethodCall(name, arity)
     }
 
+    /**
+     * Holds if the inherent method inside `i` with matching name and arity can be
+     * ruled out as a candidate for this call.
+     */
     pragma[nomagic]
-    private predicate isNotInherentTarget(Impl impl) {
+    private predicate isNotInherentCandidate(Impl impl) {
       IsInstantiationOf<MethodCallCand, FunctionType, MethodCallIsNotInstantiationOfInput>::isNotInstantiationOf(this,
         impl, _)
     }
 
-    // pragma[nomagic]
-    // private predicate blah(
-    //   Type type, Impl i, FunctionType self, TypePath selfRootPath, Type selfRootType
-    // ) {
-    //   not i.hasTrait() and
-    //   mc_.blah(type, i, self, selfPath, selfType, derefChainBorrow)
-    // }
     /**
      * Holds if this method call has no inherent target, i.e., it does not
      * resolve to a method in an `impl` block for the type of the receiver.
@@ -1452,14 +1454,7 @@ private module MethodCallResolution {
           methodInfo(_, name, arity, i, self, rootType, selfRootPath, selfRootType) and
           not i.hasTrait()
         |
-          // this.blah(type, i, self, selfPath, selfType)
-          // or
-          this.isNotInherentTarget(i)
-          // forall(Impl impl |
-          //   methodInfo(type, name, arity, impl, _, _, _) and
-          //   not impl.hasTrait()
-          // |
-          //   this.isNotInherentTarget(impl)
+          this.isNotInherentCandidate(i)
         )
       )
     }
@@ -1518,6 +1513,10 @@ private module MethodCallResolution {
     Location getLocation() { result = mc_.getLocation() }
   }
 
+  /**
+   * A configuration for matching the type of a receiver against the type of
+   * a `self` parameter.
+   */
   private module MethodCallIsInstantiationOfInput implements
     IsInstantiationOfInputSig<MethodCallCand, FunctionType>
   {
@@ -1528,7 +1527,6 @@ private module MethodCallResolution {
       exists(MethodCall mc, string name, int arity, TypePath selfRootPath, Type selfRootType |
         mcc.isMethodCall(mc, selfRootPath, selfRootType, name, arity) and
         methodCallCandidate(mc, abs, constraint, _, selfRootPath, selfRootType)
-        // mc = Debug::getRelevantLocatable()
       )
     }
 
@@ -1537,6 +1535,10 @@ private module MethodCallResolution {
     }
   }
 
+  /**
+   * A configuration for anti-matching the type of a receiver against the type of
+   * a `self` parameter in an inherent method.
+   */
   private module MethodCallIsNotInstantiationOfInput implements
     IsInstantiationOfInputSig<MethodCallCand, FunctionType>
   {
@@ -1548,7 +1550,6 @@ private module MethodCallResolution {
       exists(MethodCall mc, string name, int arity, Type rootType |
         mcc.isMethodCall(mc, TypePath::nil(), rootType, name, arity) and
         methodCallCandidate(mc, abs, constraint, rootType, _, _)
-        // mc = Debug::getRelevantLocatable()
       )
     }
 
@@ -1857,8 +1858,7 @@ private module FunctionCallResolution {
     /**
      * Gets the target of this call, where resolution does not rely on type inference.
      */
-    // inline to reduce non-linear recursion
-    pragma[inline]
+    pragma[nomagic]
     private ItemNode resolveUnambigousFunctionCallTarget() {
       (
         result = this.getATraitCandidateMethod(_, _, _, _)
@@ -1869,8 +1869,6 @@ private module FunctionCallResolution {
       not functionResolutionDependsOnArgument(_, result, _, _, _)
     }
 
-    // inline to reduce non-linear recursion
-    pragma[inline]
     ItemNode resolveCallTarget() {
       result = this.resolveUnambigousFunctionCallTarget()
       or