wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/FunctionOverloading.qll

@@ -166,9 +166,9 @@ predicate traitTypeParameterOccurrence(
 }
 
 pragma[nomagic]
-private predicate functionResolutionDependsOnArgumentCand(
-  ImplItemNode impl, Function f, string functionName, TypeParameter traitTp, FunctionPosition pos,
-  TypePath path
+predicate functionResolutionDependsOnArgumentCand(
+  ImplItemNode impl, Function f, string functionName, TypeParamTypeParameter traitTp,
+  FunctionPosition pos, TypePath path
 ) {
   /*
    * As seen in the example below, when an implementation has a sibling for a
@@ -199,12 +199,14 @@ private predicate functionResolutionDependsOnArgumentCand(
   )
 }
 
-private predicate functionResolutionDependsOnPositionalArgumentCand(
-  ImplItemNode impl, Function f, string functionName, TypeParameter traitTp
+pragma[nomagic]
+predicate functionResolutionDependsOnPositionalArgumentCand(
+  ImplItemNode impl, Function f, string functionName, TypeParamTypeParameter traitTp, int pos,
+  TypePath path
 ) {
-  exists(FunctionPosition pos |
-    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, _) and
-    pos.isPosition()
+  exists(FunctionPosition pos0 |
+    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos0, path) and
+    pos = pos0.asPosition()
   )
 }
 
@@ -223,7 +225,7 @@ private Type getAssocFunctionNonTypeParameterTypeAt(
  */
 pragma[nomagic]
 private predicate hasEquivalentPositionalSibling(
-  ImplItemNode impl, ImplItemNode sibling, Function f, TypeParameter traitTp
+  ImplItemNode impl, ImplItemNode sibling, Function f, TypeParamTypeParameter traitTp
 ) {
   exists(string functionName, FunctionPosition pos, TypePath path |
     functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, path) and
@@ -255,7 +257,7 @@ private predicate hasEquivalentPositionalSibling(
  *
  * `traitTp` is a type parameter of the trait being implemented by `impl`, and
  * we need to check that the type of `f` corresponding to `traitTp` is satisfied
- * at any one of the positions `pos` in which that type occurs in `f`.
+ * at any one of the positions `pos` in which that type occurs at `path` in `f`.
  *
  * Type parameters that only occur in return positions are only included when
  * all other type parameters that occur in a positional position are insufficient
@@ -283,19 +285,20 @@ private predicate hasEquivalentPositionalSibling(
  */
 pragma[nomagic]
 predicate functionResolutionDependsOnArgument(
-  ImplItemNode impl, Function f, TypeParameter traitTp, FunctionPosition pos
+  ImplItemNode impl, Function f, TypeParamTypeParameter traitTp, FunctionPosition pos, TypePath path
 ) {
   exists(string functionName |
-    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, _)
+    functionResolutionDependsOnArgumentCand(impl, f, functionName, traitTp, pos, path)
   |
-    if functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, traitTp)
+    if functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, traitTp, _, _)
     then any()
     else
       // `traitTp` only occurs in return position; check that it is indeed needed for disambiguation
       exists(ImplItemNode sibling |
         implSiblings(_, impl, sibling) and
-        forall(TypeParameter otherTraitTp |
-          functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, otherTraitTp)
+        forall(TypeParamTypeParameter otherTraitTp |
+          functionResolutionDependsOnPositionalArgumentCand(impl, f, functionName, otherTraitTp, _,
+            _)
         |
           hasEquivalentPositionalSibling(impl, sibling, f, otherTraitTp)
         )

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -1096,10 +1096,10 @@ private module AssocFunctionResolution {
     }
 
     pragma[nomagic]
-    predicate resolutionDependsOnReturnType() {
+    predicate resolutionDependsOnReturnType(TypePath path) {
       exists(AssocFunctionCallCand afcc |
         afcc = MkAssocFunctionCallCand(this, _, _, _) and
-        afcc.resolutionDependsOnReturnType()
+        afcc.resolutionDependsOnReturnType(path)
       )
     }
 
@@ -1578,23 +1578,65 @@ private module AssocFunctionResolution {
     pragma[nomagic]
     AssocFunctionDeclaration resolveCallTarget(ImplOrTraitItemNode i) {
       result = this.resolveCallTargetCand(i) and
-      not FunctionOverloading::functionResolutionDependsOnArgument(i, result, _, _)
+      not FunctionOverloading::functionResolutionDependsOnArgument(i, result, _, _, _)
       or
       OverloadedCallArgsAreInstantiationsOf::argsAreInstantiationsOf(this, i, result)
     }
 
     pragma[nomagic]
-    predicate resolutionDependsOnReturnType() {
-      exists(
-        ImplOrTraitItemNode i, AssocFunctionDeclaration target, TypeParameter tp,
-        FunctionPosition pos
-      |
+    private predicate hasUnknownTypeAtPos(int pos, TypePath path) {
+      exists(FunctionPosition pos0 |
+        inferType(afc_.getNodeAt(pos0), path) = TUnknownType() and
+        pos = pos0.asPosition()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate resolutionDependsOnReturnTypeCand(
+      ImplOrTraitItemNode i, AssocFunctionDeclaration target, TypeParameter traitTp, TypePath path
+    ) {
+      exists(FunctionPosition pos |
         target = this.resolveCallTargetCand(i) and
-        FunctionOverloading::functionResolutionDependsOnArgument(i, target, tp, pos) and
+        FunctionOverloading::functionResolutionDependsOnArgument(i, target, traitTp, pos, path) and
         pos.isReturn()
       )
     }
 
+    pragma[nomagic]
+    private predicate resolutionDependsOnPositionalAndReturnTypeCand(
+      ImplOrTraitItemNode i, AssocFunctionDeclaration target, TypePath path, int pos0,
+      TypePath prefix
+    ) {
+      exists(TypeParameter traitTp, TypePath path0 |
+        this.resolutionDependsOnReturnTypeCand(i, target, traitTp, path) and
+        FunctionOverloading::functionResolutionDependsOnPositionalArgumentCand(i, target, _,
+          traitTp, pos0, path0) and
+        prefix = path0.getAPrefix()
+      )
+    }
+
+    /**
+     * Holds if resolving this call requires contextual information about the
+     * return type at `path`.
+     */
+    pragma[nomagic]
+    predicate resolutionDependsOnReturnType(TypePath path) {
+      exists(ImplOrTraitItemNode i, AssocFunctionDeclaration target |
+        exists(TypeParameter traitTp |
+          this.resolutionDependsOnReturnTypeCand(i, target, traitTp, path) and
+          not FunctionOverloading::functionResolutionDependsOnPositionalArgumentCand(i, target, _,
+            traitTp, _, _)
+        )
+        or
+        // when `traitTp` is also mentioned in a parameter, require that typing of the
+        // corresponding argument also needs contextual typing
+        exists(int pos0, TypePath prefix |
+          this.resolutionDependsOnPositionalAndReturnTypeCand(i, target, path, pos0, prefix) and
+          this.hasUnknownTypeAtPos(pos0, prefix)
+        )
+      )
+    }
+
     string toString() {
       result = afc_ + " at " + selfPos_ + " [" + derefChain.toString() + "; " + borrow + "]"
     }
@@ -1819,7 +1861,7 @@ private module AssocFunctionResolution {
     ArgsAreInstantiationsOfInputSig
   {
     predicate toCheck(ImplOrTraitItemNode i, Function f, TypeParameter traitTp, FunctionPosition pos) {
-      FunctionOverloading::functionResolutionDependsOnArgument(i, f, traitTp, pos)
+      FunctionOverloading::functionResolutionDependsOnArgument(i, f, traitTp, pos, _)
     }
 
     class Call extends AssocFunctionCallCand {
@@ -3043,12 +3085,10 @@ private module Input3 implements InputSig3 {
   private Type inferUnknownType(AstNode n, TypePath path) {
     result = TUnknownType() and
     (
+      n.(AssocFunctionResolution::AssocFunctionCall).resolutionDependsOnReturnType(path)
+      or
       path.isEmpty() and
-      (
-        n.(AssocFunctionResolution::AssocFunctionCall).resolutionDependsOnReturnType()
-        or
-        isPanicMacroCall(n)
-      )
+      isPanicMacroCall(n)
       or
       n.(ArrayListExpr).getNumberOfExprs() = 0 and
       path = TypePath::singleton(getArrayTypeParameter())