wip

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -96,7 +96,6 @@ module SatisfiesBlanketConstraint<
 
     Type getTypeAt(TypePath path) {
       result = at.getTypeAt(blanketPath.appendInverse(path)) and
-      not result = TNeverType() and
       not result = TUnknownType()
     }
 

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -329,7 +329,6 @@ module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunc
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
       result = substituteLookupTraits0(this.getEnclosingItemNode(), super.getTypeAt(path)) and
-      not result = TNeverType() and
       not result = TUnknownType()
     }
   }

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -36,7 +36,6 @@ newtype TType =
   TTrait(Trait t) or
   TImplTraitType(ImplTraitTypeRepr impl) or
   TDynTraitType(Trait t) { t = any(DynTraitTypeRepr dt).getTrait() } or
-  TNeverType() or
   TUnknownType() or
   TTypeParamTypeParameter(TypeParam t) or
   TAssociatedTypeTypeParameter(Trait trait, AssocType typeAlias) {
@@ -326,14 +325,6 @@ TypeParamTypeParameter getSliceTypeParameter() {
   result = any(SliceType t).getPositionalTypeParameter(0)
 }
 
-class NeverType extends Type, TNeverType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "!" }
-
-  override Location getLocation() { result instanceof EmptyLocation }
-}
-
 abstract class PtrType extends StructType { }
 
 pragma[nomagic]

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -272,7 +272,7 @@ import M2
 private module Input3 implements InputSig3 {
   private import rust as Rust
 
-  predicate cachedStageRevRef() {
+  predicate cacheRevRef() {
     Stages::TypeInferenceStage::ref()
     or
     (implicitDerefChainBorrow(_, _, _) implies any())
@@ -306,6 +306,16 @@ private module Input3 implements InputSig3 {
     )
     or
     result = n.(ShorthandSelfParameterMention)
+    or
+    exists(Static static |
+      n = static and
+      result = static.getTypeRepr()
+    )
+    or
+    exists(Const c |
+      n = c and
+      result = c.getTypeRepr()
+    )
   }
 
   class Expr = Rust::Expr;
@@ -342,13 +352,42 @@ private module Input3 implements InputSig3 {
 
   class ParenExpr = Rust::ParenExpr;
 
-  class Variable extends Rust::Variable {
+  private newtype TLocalVariable =
+    TVariableVariable(Rust::Variable v) or
+    TConstVariable(Const c) or
+    TStaticVariable(Static s)
+
+  class LocalVariable extends TLocalVariable {
+    Rust::Variable asVariable() { this = TVariableVariable(result) }
+
+    Const asConst() { this = TConstVariable(result) }
+
+    Static asStatic() { this = TStaticVariable(result) }
+
     AstNode getDefiningNode() {
-      result = this.getPat().getName() or
-      result = this.getParameter().(SelfParam)
+      result = this.asVariable().getPat().getName() or
+      result = this.asVariable().getParameter().(SelfParam) or
+      result = this.asConst() or
+      result = this.asStatic()
+    }
+
+    Expr getAnAccess() {
+      result = this.asVariable().getAnAccess()
+      or
+      result = this.asConst().getAnAccess()
+      or
+      result = this.asStatic().getAnAccess()
+    }
+
+    string toString() {
+      result = this.asVariable().toString()
+      or
+      result = this.asConst().toString()
+      or
+      result = this.asStatic().toString()
     }
 
-    Expr getAnAccess() { result = super.getAnAccess() }
+    Location getLocation() { result = this.getDefiningNode().getLocation() }
   }
 
   abstract class LetDeclaration extends AstNode {
@@ -395,6 +434,7 @@ private module Input3 implements InputSig3 {
   class Call extends FunctionCallMatchingInput::Access {
     /** Gets the target of this call. */
     Callable getTargetCertain() {
+      none() and
       exists(ImplOrTraitItemNodeOption i, FunctionDeclaration f, Path p |
         result.isFunction(i, f) and
         p = CallExprImpl::getFunctionPath(this) and
@@ -467,8 +507,8 @@ private module Input3 implements InputSig3 {
   }
 
   Type inferTypeCertainSpecific(AstNode n, TypePath path) {
-    result = inferFunctionBodyType(n, path)
-    or
+    // result = inferFunctionBodyType(n, path)
+    // or
     result = inferLiteralType(n, path, true)
     or
     result = inferRefPatType(n) and
@@ -498,16 +538,14 @@ private module Input3 implements InputSig3 {
     path.isEmpty() and
     result instanceof UnitType
     or
-    isPanicMacroCall(n) and
-    path.isEmpty() and
-    result instanceof NeverType
-    or
     n instanceof ClosureExpr and
     path.isEmpty() and
     result = closureRootType()
   }
 
   predicate inferStepSymmetric(AstNode n1, TypePath prefix1, AstNode n2, TypePath prefix2) {
+    // inferStepSymmetricCertain0(n1, prefix1, n2, prefix2)
+    // or
     prefix1.isEmpty() and
     prefix2.isEmpty() and
     (
@@ -619,9 +657,17 @@ private module Input3 implements InputSig3 {
       or
       result = inferOperationType(n, pos, path)
     )
+    or
+    result = inferFieldExprType(n, path, true)
   }
 
   Type inferTypeSpecific(AstNode n, TypePath path) {
+    // result = inferTypeCertainSpecific0(n, path)
+    // or
+    isPanicMacroCall(n) and
+    path.isEmpty() and
+    result instanceof UnknownType
+    or
     result = inferAssignmentOperationType(n, path)
     or
     exists(FunctionPosition pos | pos.isReturn() |
@@ -630,7 +676,7 @@ private module Input3 implements InputSig3 {
       result = inferOperationType(n, pos, path)
     )
     or
-    result = inferFieldExprType(n, path)
+    result = inferFieldExprType(n, path, false)
     or
     result = inferTryExprType(n, path)
     or
@@ -666,7 +712,7 @@ module Consistency {
 
   private Type inferTypeCertainAdj(AstNode n, TypePath path) {
     result = inferTypeCertain(n, path) and
-    not result = TNeverType()
+    not result = TUnknownType()
   }
 
   predicate nonUniqueCertainType(AstNode n, TypePath path, Type t) {
@@ -1127,17 +1173,14 @@ private module ContextTyping {
  */
 bindingset[path, type]
 private predicate isComplexRootStripped(TypePath path, Type type) {
-  (
-    path.isEmpty() and
-    not validSelfType(type)
-    or
-    exists(TypeParameter tp |
-      complexSelfRoot(_, tp) and
-      path = TypePath::singleton(tp) and
-      exists(type)
-    )
-  ) and
-  type != TNeverType()
+  path.isEmpty() and
+  not validSelfType(type)
+  or
+  exists(TypeParameter tp |
+    complexSelfRoot(_, tp) and
+    path = TypePath::singleton(tp) and
+    exists(type)
+  )
 }
 
 private newtype TBorrowKind =
@@ -1606,7 +1649,6 @@ private module AssocFunctionResolution {
       not this.hasReceiver() and
       exists(TypePath strippedTypePath, Type strippedType |
         strippedType = substituteLookupTraits(this, this.getTypeAt(selfPos, strippedTypePath)) and
-        strippedType != TNeverType() and
         strippedType != TUnknownType()
       |
         nonBlanketLikeCandidate(this, _, selfPos, _, _, strippedTypePath, strippedType)
@@ -1703,7 +1745,6 @@ private module AssocFunctionResolution {
       FunctionPosition selfPos, DerefChain derefChain, BorrowKind borrow, TypePath path
     ) {
       result = this.getSelfTypeAt(selfPos, derefChain, borrow, path) and
-      result != TNeverType() and
       result != TUnknownType()
     }
 
@@ -2343,7 +2384,6 @@ private module AssocFunctionResolution {
 
       Type getTypeAt(TypePath path) {
         result = substituteLookupTraits(afc, afc.getSelfTypeAtNoBorrow(selfPos, derefChain, path)) and
-        result != TNeverType() and
         result != TUnknownType()
       }
 
@@ -3313,7 +3353,7 @@ private module FieldExprMatching = Matching<FieldExprMatchingInput>;
  * the receiver of field expression call.
  */
 pragma[nomagic]
-private Type inferFieldExprType(AstNode n, TypePath path) {
+private Type inferFieldExprType(AstNode n, TypePath path, boolean topDown) {
   exists(
     FieldExprMatchingInput::Access a, FieldExprMatchingInput::AccessPosition apos, TypePath path0
   |
@@ -3322,6 +3362,7 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
   |
     if apos.isSelf()
     then
+      topDown = true and
       exists(Type receiverType | receiverType = inferType(n) |
         if receiverType instanceof RefType
         then
@@ -3331,7 +3372,9 @@ private Type inferFieldExprType(AstNode n, TypePath path) {
           path = TypePath::cons(getRefTypeParameter(_), path0)
         else path = path0
       )
-    else path = path0
+    else (
+      topDown = false and path = path0
+    )
   )
 }
 
@@ -3437,7 +3480,7 @@ private DynTraitTypeParameter getDynFutureOutputTypeParameter() {
 pragma[nomagic]
 predicate isUnitBlockExpr(BlockExpr be) {
   not be.getStmtList().hasTailExpr() and
-  not be = any(Callable c).getBody() and
+  // not be = any(Callable c).getBody() and
   not be.hasLabel()
 }
 

rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll

@@ -676,7 +676,7 @@ private module MkTypeMention<getAdditionalPathTypeAtSig/2 getAdditionalPathTypeA
   }
 
   class NeverTypeReprMention extends TypeMentionImpl, NeverTypeRepr {
-    override Type getTypeAt(TypePath path) { result = TNeverType() and path.isEmpty() }
+    override Type getTypeAt(TypePath path) { result = TUnknownType() and path.isEmpty() }
   }
 
   class PtrTypeReprMention extends TypeMentionImpl instanceof PtrTypeRepr {

rust/ql/test/library-tests/dataflow/sources/web_frameworks/CONSISTENCY/TypeInferenceConsistency.expected

@@ -1,5 +1,4 @@
 multipleResolvedTargets
 | main.rs:2223:9:2223:31 | ... .my_add(...) |
 | main.rs:2225:9:2225:29 | ... .my_add(...) |
-| main.rs:2740:13:2740:17 | x.f() |
 | regressions.rs:179:17:179:27 | ... + ... |