wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -96,7 +96,6 @@ module SatisfiesBlanketConstraint<
 
     Type getTypeAt(TypePath path) {
       result = at.getTypeAt(blanketPath.appendInverse(path)) and
-      not result = TNeverType() and
       not result = TUnknownType()
     }
 

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -329,7 +329,6 @@ module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunc
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
       result = substituteLookupTraits0(this.getEnclosingItemNode(), super.getTypeAt(path)) and
-      not result = TNeverType() and
       not result = TUnknownType()
     }
   }

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -36,7 +36,6 @@ newtype TType =
   TTrait(Trait t) or
   TImplTraitType(ImplTraitTypeRepr impl) or
   TDynTraitType(Trait t) { t = any(DynTraitTypeRepr dt).getTrait() } or
-  TNeverType() or
   TUnknownType() or
   TTypeParamTypeParameter(TypeParam t) or
   TAssociatedTypeTypeParameter(Trait trait, AssocType typeAlias) {
@@ -326,14 +325,6 @@ TypeParamTypeParameter getSliceTypeParameter() {
   result = any(SliceType t).getPositionalTypeParameter(0)
 }
 
-class NeverType extends Type, TNeverType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "!" }
-
-  override Location getLocation() { result instanceof EmptyLocation }
-}
-
 abstract class PtrType extends StructType { }
 
 pragma[nomagic]

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -272,7 +272,7 @@ import M2
 private module Input3 implements InputSig3 {
   private import rust as Rust
 
-  predicate cachedStageRevRef() {
+  predicate cacheRevRef() {
     Stages::TypeInferenceStage::ref()
     or
     (implicitDerefChainBorrow(_, _, _) implies any())
@@ -306,6 +306,16 @@ private module Input3 implements InputSig3 {
     )
     or
     result = n.(ShorthandSelfParameterMention)
+    or
+    exists(Static static |
+      n = static and
+      result = static.getTypeRepr()
+    )
+    or
+    exists(Const c |
+      n = c and
+      result = c.getTypeRepr()
+    )
   }
 
   class Expr = Rust::Expr;
@@ -342,32 +352,61 @@ private module Input3 implements InputSig3 {
 
   class ParenExpr = Rust::ParenExpr;
 
-  class Variable extends Rust::Variable {
+  private newtype TLocalVariable =
+    TVariableVariable(Rust::Variable v) or
+    TConstVariable(Const c) or
+    TStaticVariable(Static s)
+
+  class LocalVariable extends TLocalVariable {
+    Rust::Variable asVariable() { this = TVariableVariable(result) }
+
+    Const asConst() { this = TConstVariable(result) }
+
+    Static asStatic() { this = TStaticVariable(result) }
+
     AstNode getDefiningNode() {
-      result = this.getPat().getName() or
-      result = this.getParameter().(SelfParam)
+      result = this.asVariable().getPat().getName() or
+      result = this.asVariable().getParameter().(SelfParam) or
+      result = this.asConst() or
+      result = this.asStatic()
+    }
+
+    Expr getAnAccess() {
+      result = this.asVariable().getAnAccess()
+      or
+      result = this.asConst().getAnAccess()
+      or
+      result = this.asStatic().getAnAccess()
+    }
+
+    string toString() {
+      result = this.asVariable().toString()
+      or
+      result = this.asConst().toString()
+      or
+      result = this.asStatic().toString()
     }
 
-    Expr getAnAccess() { result = super.getAnAccess() }
+    Location getLocation() { result = this.getDefiningNode().getLocation() }
   }
 
-  abstract class LetDeclaration extends AstNode {
+  abstract class LocalVariableDeclaration extends AstNode {
     abstract predicate isCoercionSite();
 
     abstract AstNode getLeftOperand();
 
     abstract AstNode getRightOperand();
   }
 
-  private class LetExprLetDeclaration extends LetDeclaration, LetExpr {
+  private class LetExprDeclaration extends LocalVariableDeclaration, LetExpr {
     override predicate isCoercionSite() { not this.getPat() instanceof IdentPat }
 
     override AstNode getLeftOperand() { result = this.getPat() }
 
     override AstNode getRightOperand() { result = this.getScrutinee() }
   }
 
-  private class LetStmtLetDeclaration extends LetDeclaration, LetStmt {
+  private class LetStmtDeclaration extends LocalVariableDeclaration, LetStmt {
     override predicate isCoercionSite() {
       this.hasTypeRepr() or
       not identLetStmt(this, _, _)
@@ -393,16 +432,6 @@ private module Input3 implements InputSig3 {
   }
 
   class Call extends FunctionCallMatchingInput::Access {
-    /** Gets the target of this call. */
-    Callable getTargetCertain() {
-      exists(ImplOrTraitItemNodeOption i, FunctionDeclaration f, Path p |
-        result.isFunction(i, f) and
-        p = CallExprImpl::getFunctionPath(this) and
-        f = resolvePath(p) and
-        f.isDirectlyFor(i)
-      )
-    }
-
     Callable getTarget(string derefChainBorrow) { result = super.getTarget(derefChainBorrow) }
   }
 
@@ -467,8 +496,6 @@ private module Input3 implements InputSig3 {
   }
 
   Type inferTypeCertainSpecific(AstNode n, TypePath path) {
-    result = inferFunctionBodyType(n, path)
-    or
     result = inferLiteralType(n, path, true)
     or
     result = inferRefPatType(n) and
@@ -498,16 +525,14 @@ private module Input3 implements InputSig3 {
     path.isEmpty() and
     result instanceof UnitType
     or
-    isPanicMacroCall(n) and
-    path.isEmpty() and
-    result instanceof NeverType
-    or
     n instanceof ClosureExpr and
     path.isEmpty() and
     result = closureRootType()
   }
 
   predicate inferStepSymmetric(AstNode n1, TypePath prefix1, AstNode n2, TypePath prefix2) {
+    // inferStepSymmetricCertain0(n1, prefix1, n2, prefix2)
+    // or
     prefix1.isEmpty() and
     prefix2.isEmpty() and
     (
@@ -619,9 +644,17 @@ private module Input3 implements InputSig3 {
       or
       result = inferOperationType(n, pos, path)
     )
+    or
+    result = inferFieldExprType(n, path, true)
   }
 
   Type inferTypeSpecific(AstNode n, TypePath path) {
+    // result = inferTypeCertainSpecific0(n, path)
+    // or
+    isPanicMacroCall(n) and
+    path.isEmpty() and
+    result instanceof UnknownType
+    or
     result = inferAssignmentOperationType(n, path)
     or
     exists(FunctionPosition pos | pos.isReturn() |
@@ -630,7 +663,7 @@ private module Input3 implements InputSig3 {
       result = inferOperationType(n, pos, path)
     )
     or
-    result = inferFieldExprType(n, path)
+    result = inferFieldExprType(n, path, false)
     or
     result = inferTryExprType(n, path)
     or
@@ -666,7 +699,7 @@ module Consistency {
 
   private Type inferTypeCertainAdj(AstNode n, TypePath path) {
     result = inferTypeCertain(n, path) and
-    not result = TNeverType()
+    not result = TUnknownType()
   }
 
   predicate nonUniqueCertainType(AstNode n, TypePath path, Type t) {
@@ -834,17 +867,6 @@ private Type getCallExprTypeArgument(CallExpr ce, TypeArgumentPosition apos, Typ
   )
 }
 
-pragma[nomagic]
-private Type inferFunctionBodyType(AstNode n, TypePath path) {
-  exists(Function f |
-    n = f.getFunctionBody() and
-    result = getReturnTypeMention(f).getTypeAt(path) and
-    not exists(ImplTraitReturnType i | i.getFunction() = f |
-      result = i or result = i.getATypeParameter()
-    )
-  )
-}
-
 /**
  * Holds if `me` is a call to the `panic!` macro.
  *
@@ -1127,17 +1149,14 @@ private module ContextTyping {
  */
 bindingset[path, type]
 private predicate isComplexRootStripped(TypePath path, Type type) {
-  (
-    path.isEmpty() and
-    not validSelfType(type)
-    or
-    exists(TypeParameter tp |
-      complexSelfRoot(_, tp) and
-      path = TypePath::singleton(tp) and
-      exists(type)
-    )
-  ) and
-  type != TNeverType()
+  path.isEmpty() and
+  not validSelfType(type)
+  or
+  exists(TypeParameter tp |
+    complexSelfRoot(_, tp) and
+    path = TypePath::singleton(tp) and
+    exists(type)
+  )
 }
 
 private newtype TBorrowKind =
@@ -1606,7 +1625,6 @@ private module AssocFunctionResolution {
       not this.hasReceiver() and
       exists(TypePath strippedTypePath, Type strippedType |
         strippedType = substituteLookupTraits(this, this.getTypeAt(selfPos, strippedTypePath)) and
-        strippedType != TNeverType() and
         strippedType != TUnknownType()
       |
         nonBlanketLikeCandidate(this, _, selfPos, _, _, strippedTypePath, strippedType)
@@ -1703,7 +1721,6 @@ private module AssocFunctionResolution {
       FunctionPosition selfPos, DerefChain derefChain, BorrowKind borrow, TypePath path
     ) {
       result = this.getSelfTypeAt(selfPos, derefChain, borrow, path) and
-      result != TNeverType() and
       result != TUnknownType()
     }
 
@@ -2343,7 +2360,6 @@ private module AssocFunctionResolution {
 
       Type getTypeAt(TypePath path) {
         result = substituteLookupTraits(afc, afc.getSelfTypeAtNoBorrow(selfPos, derefChain, path)) and
-        result != TNeverType() and
         result != TUnknownType()
       }
 
@@ -3313,7 +3329,7 @@ private module FieldExprMatching = Matching<FieldExprMatchingInput>;
  * the receiver of field expression call.
  */
 pragma[nomagic]
-private Type inferFieldExprType(AstNode n, TypePath path) {
+private Type inferFieldExprType(AstNode n, TypePath path, boolean topDown) {
   exists(
     FieldExprMatchingInput::Access a, FieldExprMatchingInput::AccessPosition apos, TypePath path0
   |
@@ -3322,6 +3338,7 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
   |
     if apos.isSelf()
     then
+      topDown = true and
       exists(Type receiverType | receiverType = inferType(n) |
         if receiverType instanceof RefType
         then
@@ -3331,7 +3348,9 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
           path = TypePath::cons(getRefTypeParameter(_), path0)
         else path = path0
       )
-    else path = path0
+    else (
+      topDown = false and path = path0
+    )
   )
 }
 
@@ -3437,7 +3456,10 @@ private DynTraitTypeParameter getDynFutureOutputTypeParameter() {
 pragma[nomagic]
 predicate isUnitBlockExpr(BlockExpr be) {
   not be.getStmtList().hasTailExpr() and
-  not be = any(Callable c).getBody() and
+  not exists(Callable c |
+    be = c.getBody() and
+    c = any(ReturnExpr re).getEnclosingCallable()
+  ) and
   not be.hasLabel()
 }
 

rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll

@@ -676,7 +676,7 @@ private module MkTypeMention<getAdditionalPathTypeAtSig/2 getAdditionalPathTypeA
   }
 
   class NeverTypeReprMention extends TypeMentionImpl, NeverTypeRepr {
-    override Type getTypeAt(TypePath path) { result = TNeverType() and path.isEmpty() }
+    override Type getTypeAt(TypePath path) { result = TUnknownType() and path.isEmpty() }
   }
 
   class PtrTypeReprMention extends TypeMentionImpl instanceof PtrTypeRepr {

rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected

@@ -1,5 +1,4 @@
 multipleResolvedTargets
 | main.rs:2223:9:2223:31 | ... .my_add(...) |
 | main.rs:2225:9:2225:29 | ... .my_add(...) |
-| main.rs:2740:13:2740:17 | x.f() |
 | regressions.rs:179:17:179:27 | ... + ... |

rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected

@@ -64,7 +64,7 @@ mod fn_once_trait {
         let _r = apply(f, true); // $ target=apply type=_r:i64
 
         let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
-        let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
+        let _r2 = apply_two(f); // $ target=apply_two type=_r2:i64
     }
 }
 
@@ -101,7 +101,7 @@ mod fn_mut_trait {
         let _r = apply(f, true); // $ target=apply type=_r:i64
 
         let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
-        let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
+        let _r2 = apply_two(f); // $ target=apply_two type=_r2:i64
     }
 }
 
@@ -138,7 +138,7 @@ mod fn_trait {
         let _r = apply(f, true); // $ target=apply type=_r:i64
 
         let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
-        let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
+        let _r2 = apply_two(f); // $ target=apply_two type=_r2:i64
     }
 }
 

rust/ql/test/library-tests/type-inference/closure.rs

@@ -141,7 +141,7 @@ mod implicit_deref_coercion_cycle {
 
     #[rustfmt::skip]
     pub fn test() {
-        let mut key_to_key = HashMap::<&Key, &Key>::new(); // $ target=new
+        let mut key_to_key = HashMap::<_, &Key>::new(); // $ target=new
         let mut key = &Key {}; // Initialize key2 to a reference
         if let Some(ref_key) = key_to_key.get(key) { // $ target=get
             // Below `ref_key` is implicitly dereferenced from `&&Key` to `&Key`