Rust: Type inference 2.0

Author: hvitved

rust/ql/lib/codeql/rust/internal/CachedStages.qll

@@ -30,6 +30,8 @@ import rust
  * The `backref` predicate starts with `1 = 1 or` to ensure that the predicate will be optimized down to a constant by the optimizer.
  */
 module Stages {
+  private import codeql.rust.internal.typeinference.TypeInference as TypeInference
+
   /**
    * The abstract syntex tree (AST) stage.
    */
@@ -126,35 +128,7 @@ module Stages {
   /**
    * The type inference stage.
    */
-  cached
-  module TypeInferenceStage {
-    private import codeql.rust.internal.typeinference.Type
-    private import codeql.rust.internal.typeinference.TypeInference
-    private import codeql.rust.dataflow.internal.ModelsAsData
-
-    /**
-     * Always holds.
-     * Ensures that a predicate is evaluated as part of the type inference stage.
-     */
-    cached
-    predicate ref() { 1 = 1 }
-
-    /**
-     * DO NOT USE!
-     *
-     * Contains references to each predicate that use the above `ref` predicate.
-     */
-    cached
-    predicate backref() {
-      1 = 1
-      or
-      exists(Type t)
-      or
-      exists(inferType(_))
-      or
-      mayInvokeCallback(_, _)
-    }
-  }
+  module TypeInferenceStage = TypeInference::CachedStage;
 
   /**
    * The data flow stage.

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -96,8 +96,7 @@ module SatisfiesBlanketConstraint<
 
     Type getTypeAt(TypePath path) {
       result = at.getTypeAt(blanketPath.appendInverse(path)) and
-      not result = TNeverType() and
-      not result = TUnknownType()
+      not result instanceof PseudoType
     }
 
     string toString() { result = at.toString() + " [blanket at " + blanketPath.toString() + "]" }

rust/ql/lib/codeql/rust/internal/typeinference/FunctionOverloading.qll

@@ -166,9 +166,9 @@ predicate traitTypeParameterOccurrence(
 }
 
 pragma[nomagic]
-private predicate functionResolutionDependsOnArgumentCand(
-  ImplItemNode impl, Function f, string functionName, TypeParameter traitTp, FunctionPosition pos,
-  TypePath path
+predicate functionResolutionDependsOnArgumentCand(
+  ImplItemNode impl, Function f, string functionName, TypeParamTypeParameter traitTp,
+  FunctionPosition pos, TypePath path
 ) {
   /*
    * As seen in the example below, when an implementation has a sibling for a
@@ -199,12 +199,14 @@ private predicate functionResolutionDependsOnArgumentCand(
   )
 }
 
-private predicate functionResolutionDependsOnPositionalArgumentCand(
-  ImplItemNode impl, Function f, string functionName, TypeParameter traitTp
+pragma[nomagic]
+predicate functionResolutionDependsOnPositionalArgumentCand(
+  ImplItemNode impl, Function f, string functionName, TypeParamTypeParameter traitTp, int pos,
+  TypePath path
 ) {
-  exists(FunctionPosition pos |
-    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, _) and
-    pos.isPosition()
+  exists(FunctionPosition pos0 |
+    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos0, path) and
+    pos = pos0.asPosition()
   )
 }
 
@@ -223,7 +225,7 @@ private Type getAssocFunctionNonTypeParameterTypeAt(
  */
 pragma[nomagic]
 private predicate hasEquivalentPositionalSibling(
-  ImplItemNode impl, ImplItemNode sibling, Function f, TypeParameter traitTp
+  ImplItemNode impl, ImplItemNode sibling, Function f, TypeParamTypeParameter traitTp
 ) {
   exists(string functionName, FunctionPosition pos, TypePath path |
     functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, path) and
@@ -255,7 +257,7 @@ private predicate hasEquivalentPositionalSibling(
  *
  * `traitTp` is a type parameter of the trait being implemented by `impl`, and
  * we need to check that the type of `f` corresponding to `traitTp` is satisfied
- * at any one of the positions `pos` in which that type occurs in `f`.
+ * at any one of the positions `pos` in which that type occurs at `path` in `f`.
  *
  * Type parameters that only occur in return positions are only included when
  * all other type parameters that occur in a positional position are insufficient
@@ -283,19 +285,20 @@ private predicate hasEquivalentPositionalSibling(
  */
 pragma[nomagic]
 predicate functionResolutionDependsOnArgument(
-  ImplItemNode impl, Function f, TypeParameter traitTp, FunctionPosition pos
+  ImplItemNode impl, Function f, TypeParamTypeParameter traitTp, FunctionPosition pos, TypePath path
 ) {
   exists(string functionName |
-    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, _)
+    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, path)
   |
-    if functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, traitTp)
+    if functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, traitTp, _, _)
     then any()
     else
       // `traitTp` only occurs in return position; check that it is indeed needed for disambiguation
       exists(ImplItemNode sibling |
         implSiblings(_, impl, sibling) and
-        forall(TypeParameter otherTraitTp |
-          functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, otherTraitTp)
+        forall(TypeParamTypeParameter otherTraitTp |
+          functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, otherTraitTp, _,
+            _)
         |
           hasEquivalentPositionalSibling(impl, sibling, f, otherTraitTp)
         )

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -329,8 +329,7 @@ module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunc
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
       result = substituteLookupTraits0(this.getEnclosingItemNode(), super.getTypeAt(path)) and
-      not result = TNeverType() and
-      not result = TUnknownType()
+      not result instanceof PseudoType
     }
   }
 

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -36,8 +36,13 @@ newtype TType =
   TTrait(Trait t) or
   TImplTraitType(ImplTraitTypeRepr impl) or
   TDynTraitType(Trait t) { t = any(DynTraitTypeRepr dt).getTrait() } or
-  TNeverType() or
   TUnknownType() or
+  TClosureParameterPseudoType(Param p) {
+    exists(ClosureExpr ce |
+      p = ce.getParam(_) and
+      not p.hasTypeRepr()
+    )
+  } or
   TTypeParamTypeParameter(TypeParam t) or
   TAssociatedTypeTypeParameter(Trait trait, AssocType typeAlias) {
     getTraitAssocType(trait) = typeAlias
@@ -326,14 +331,6 @@ TypeParamTypeParameter getSliceTypeParameter() {
   result = any(SliceType t).getPositionalTypeParameter(0)
 }
 
-class NeverType extends Type, TNeverType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "!" }
-
-  override Location getLocation() { result instanceof EmptyLocation }
-}
-
 abstract class PtrType extends StructType { }
 
 pragma[nomagic]
@@ -355,6 +352,10 @@ class PtrConstType extends PtrType {
   override string toString() { result = "*const" }
 }
 
+abstract class PseudoType extends Type {
+  override TypeParameter getPositionalTypeParameter(int i) { none() }
+}
+
 /**
  * A special pseudo type used to indicate that the actual type may have to be
  * inferred by propagating type information back into call arguments.
@@ -377,14 +378,24 @@ class PtrConstType extends PtrType {
  * into call arguments (including method call receivers), in order to avoid
  * combinatorial explosions.
  */
-class UnknownType extends Type, TUnknownType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "(context typed)" }
+class UnknownType extends PseudoType, TUnknownType {
+  override string toString() { result = "(unknown type)" }
 
   override Location getLocation() { result instanceof EmptyLocation }
 }
 
+class ClosureParameterPseudoType extends PseudoType, TClosureParameterPseudoType {
+  private Param param;
+
+  ClosureParameterPseudoType() { this = TClosureParameterPseudoType(param) }
+
+  Param getParam() { result = param }
+
+  override string toString() { result = "(closure parameter " + param + ")" }
+
+  override Location getLocation() { result = param.getLocation() }
+}
+
 /** A type parameter. */
 abstract class TypeParameter extends Type {
   override TypeParameter getPositionalTypeParameter(int i) { none() }