closure

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -96,7 +96,7 @@ module SatisfiesBlanketConstraint<
 
     Type getTypeAt(TypePath path) {
       result = at.getTypeAt(blanketPath.appendInverse(path)) and
-      not result = TUnknownType()
+      not result instanceof UnknownType
     }
 
     string toString() { result = at.toString() + " [blanket at " + blanketPath.toString() + "]" }

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -329,7 +329,7 @@ module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunc
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
       result = substituteLookupTraits0(this.getEnclosingItemNode(), super.getTypeAt(path)) and
-      not result = TUnknownType()
+      not result instanceof UnknownType
     }
   }
 

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -37,6 +37,12 @@ newtype TType =
   TImplTraitType(ImplTraitTypeRepr impl) or
   TDynTraitType(Trait t) { t = any(DynTraitTypeRepr dt).getTrait() } or
   TUnknownType() or
+  TClosureParameterType(Param p) {
+    exists(ClosureExpr ce |
+      p = ce.getParam(_) and
+      not p.hasTypeRepr()
+    )
+  } or
   TTypeParamTypeParameter(TypeParam t) or
   TAssociatedTypeTypeParameter(Trait trait, AssocType typeAlias) {
     getTraitAssocType(trait) = typeAlias
@@ -346,6 +352,12 @@ class PtrConstType extends PtrType {
   override string toString() { result = "*const" }
 }
 
+abstract class PseudoType extends Type {
+  override TypeParameter getPositionalTypeParameter(int i) { none() }
+
+  override Location getLocation() { result instanceof EmptyLocation }
+}
+
 /**
  * A special pseudo type used to indicate that the actual type may have to be
  * inferred by propagating type information back into call arguments.
@@ -368,12 +380,18 @@ class PtrConstType extends PtrType {
  * into call arguments (including method call receivers), in order to avoid
  * combinatorial explosions.
  */
-class UnknownType extends Type, TUnknownType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
+class UnknownType extends PseudoType, TUnknownType {
+  override string toString() { result = "(unknown type)" }
+}
 
-  override string toString() { result = "(context typed)" }
+class ClosureParameterType extends PseudoType, TClosureParameterType {
+  private Param param;
 
-  override Location getLocation() { result instanceof EmptyLocation }
+  ClosureParameterType() { this = TClosureParameterType(param) }
+
+  Param getParam() { result = param }
+
+  override string toString() { result = "(closure parameter " + param + ")" }
 }
 
 /** A type parameter. */

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -38,6 +38,8 @@ private module Input1 implements InputSig1<Location> {
 
   class Type = T::Type;
 
+  class PseudoType = T::PseudoType;
+
   class UnknownType = T::UnknownType;
 
   class TypeParameter = T::TypeParameter;
@@ -645,7 +647,7 @@ private module Input3 implements InputSig3 {
         not tp = c.getParameterType(_, _) and
         // check that no explicit type arguments have been supplied for `tp`
         not exists(TypeArgumentPosition tapos |
-          this.getTypeArgument(tapos, _) != TUnknownType() and
+          this.getTypeArgument(tapos, _) = any(Type t | not t instanceof UnknownType) and
           TTypeParamTypeParameter(tapos.asTypeParam()) = tp
         )
       )
@@ -734,10 +736,16 @@ private module Input3 implements InputSig3 {
       path2 = TypePath::singleton(tt.getPositionalTypeParameter(i))
     )
     or
-    exists(ClosureExpr ce, int index |
-      n1 = ce.getParam(index).getPat() and
-      n2 = ce and
+    exists(ClosureExpr ce, int index, Param p |
       path1.isEmpty() and
+      p = ce.getParam(index)
+    |
+      n1 = p.getPat() and
+      n2 = p and
+      path2.isEmpty()
+      or
+      n1 = p and
+      n2 = ce and
       path2 = closureParameterPath(ce.getNumberOfParams(), index)
     )
   }
@@ -881,10 +889,6 @@ private module Input3 implements InputSig3 {
   Type inferType(AstNode n, TypePath path) {
     result = M3::inferType(n, path)
     or
-    isPanicMacroCall(n) and
-    path.isEmpty() and
-    result instanceof UnknownType
-    or
     result = inferAssignmentOperationType(n, path)
     or
     result = inferTryExprType(n, path)
@@ -904,6 +908,8 @@ private module Input3 implements InputSig3 {
     result = inferDeconstructionPatType(n, path)
     or
     result = inferUnknownType(n, path)
+    or
+    result = inferParamPatType(n, path)
   }
 }
 
@@ -1318,7 +1324,7 @@ private module ContextualTyping {
     abstract Type getTypeArgument(TypeArgumentPosition apos, TypePath path);
 
     predicate hasTypeArgument(TypeArgumentPosition apos) {
-      this.getTypeArgument(apos, _) != TUnknownType()
+      this.getTypeArgument(apos, _) = any(Type t | not t instanceof UnknownType)
     }
 
     /**
@@ -1829,7 +1835,7 @@ private module AssocFunctionResolution {
       not this.hasReceiver() and
       exists(TypePath strippedTypePath, Type strippedType |
         strippedType = substituteLookupTraits(this, this.getTypeAt(selfPos, strippedTypePath)) and
-        strippedType != TUnknownType()
+        not strippedType instanceof UnknownType
       |
         nonBlanketLikeCandidate(this, _, selfPos, _, _, strippedTypePath, strippedType)
         or
@@ -1925,7 +1931,7 @@ private module AssocFunctionResolution {
       FunctionPosition selfPos, DerefChain derefChain, BorrowKind borrow, TypePath path
     ) {
       result = this.getSelfTypeAt(selfPos, derefChain, borrow, path) and
-      result != TUnknownType()
+      not result instanceof UnknownType
     }
 
     pragma[nomagic]
@@ -2584,7 +2590,7 @@ private module AssocFunctionResolution {
 
       Type getTypeAt(TypePath path) {
         result = substituteLookupTraits(afc, afc.getSelfTypeAtNoBorrow(selfPos, derefChain, path)) and
-        result != TUnknownType()
+        not result instanceof UnknownType
       }
 
       string toString() { result = afc + " [" + derefChain.toString() + "]" }
@@ -3144,12 +3150,43 @@ private Type inferUnknownType(AstNode n, TypePath path) {
     or
     n.(Input3::Construction).hasUnknownReturnTypeAt(path)
     or
-    exists(Param p |
-      not p.hasTypeRepr() and
-      n = p.getPat() and
-      path.isEmpty()
+    // non-`self` parameters without type annotations always belong to closures, so
+    // we want
+    n = any(Param p | not p.hasTypeRepr()) and
+    path.isEmpty()
+    or
+    isPanicMacroCall(n) and
+    path.isEmpty()
+  )
+}
+
+private Type inferParamPatType(AstNode n, TypePath path) {
+  exists(ClosureExpr ce, Param p | p = ce.getAParam() |
+    n = p.getPat() and
+    path.isEmpty() and
+    result = TClosureParameterType(p)
+    or
+    exists(TypePath ret | inferType(ce, ret) = TClosureParameterType(p) |
+      n = ce and
+      path = ret and
+      result = TUnknownType()
+      or
+      inferType(ce, ret.appendInverse(path)) = result and
+      n = p
+    )
+    or
+    exists(AstNode n0, TypePath prefix |
+      inferType(n0, prefix) = TClosureParameterType(p) and
+      result = inferTypeCertain(n0, prefix.appendInverse(path)) and
+      n = p
     )
   )
+  or
+  n =
+    any(Param p |
+      result = inferType(p, path) and
+      not result instanceof UnknownType
+    ).getPat()
 }
 
 pragma[nomagic]

rust/ql/test/library-tests/type-inference/type-inference.ql

@@ -10,18 +10,19 @@ private predicate relevantNode(AstNode n) {
   not n.isFromMacroExpansion() and
   not n instanceof IdentPat and // avoid overlap in the output with the underlying `Name` node
   not n instanceof LiteralPat and // avoid overlap in the output with the underlying `Literal` node
-  (n instanceof TypeMention implies n instanceof SelfParam)
+  (n instanceof TypeMention implies n instanceof SelfParam) and
+  not n instanceof Param
 }
 
 query predicate inferCertainType(AstNode n, TypePath path, Type t) {
   t = TypeInference::inferTypeCertain(n, path) and
-  t != TUnknownType() and
+  not t instanceof PseudoType and
   relevantNode(n)
 }
 
 query predicate inferType(AstNode n, TypePath path, Type t) {
   t = TypeInference::inferType(n, path) and
-  t != TUnknownType() and
+  not t instanceof PseudoType and
   relevantNode(n)
 }
 

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -149,9 +149,11 @@ signature module InputSig1<LocationSig Location> {
     Location getLocation();
   }
 
+  class PseudoType extends Type;
+
   /**
    * A special pseudo type used to represent cases where the actual type needs
-   * to be inferred from the context in a top-down manner. For example, in
+   * to be inferred using contextual information. For example, in
    *
    * ```rust
    * let x = Vec::new();
@@ -161,7 +163,7 @@ signature module InputSig1<LocationSig Location> {
    * the element type of `x` is assigned an unknown type, which allows for type
    * information to flow into `x` from the call to `push`.
    */
-  class UnknownType extends Type;
+  class UnknownType extends PseudoType;
 
   /** A type parameter. */
   class TypeParameter extends Type;
@@ -662,7 +664,7 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
       private Type getNonPseudoTypeAt(App app, TypePath path) {
         result = app.getTypeAt(path) and
-        not result instanceof UnknownType
+        not result instanceof PseudoType
       }
 
       pragma[nomagic]
@@ -1383,7 +1385,7 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         exists(TypeArgumentPosition tapos |
           result = a.getTypeArgument(tapos, path) and
           tp = getDeclTypeParameter(target, tapos) and
-          not result instanceof UnknownType //and path.isEmpty())
+          not result instanceof PseudoType
         )
       }
 
@@ -2459,6 +2461,9 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
        */
       predicate inferStep(AstNode n1, TypePath path1, AstNode n2, TypePath path2);
 
+      bindingset[path]
+      default predicate prohibitContextualInference(AstNode n, TypePath path) { none() }
+
       /**
        * Gets the inferred certain type of `n` at `path`.
        *
@@ -2532,7 +2537,7 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
           ) and
           // type annotation may for example include unknown types, such as
           // `x : Vec<_>` in Rust
-          not result instanceof UnknownType
+          not result instanceof PseudoType
         }
 
         /**
@@ -2631,25 +2636,28 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
       pragma[nomagic]
       private Type inferTypeContextualCand(AstNode n, TypePath path) {
-        result = inferCallArgumentTypeContextual(n, path)
-        or
-        result = inferMemberAccessReceiverTypeContextual(n, path)
-        or
-        exists(Operation o, int pos |
-          n = o.getOperand(pos) and
-          result = OperationMatching::inferAccessType(o, pos, path)
-        )
-        or
-        exists(Construction c, int pos |
-          n = c.getArgument(pos) and
-          result = ConstructionMatching::inferAccessType(c, pos, path)
-        )
-        or
-        exists(TypePath path1, AstNode n2, TypePath path2, TypePath suffix |
-          result = inferType(n2, path2.appendInverse(suffix)) and
-          path = path1.append(suffix) and
-          step(n, path1, n2, path2)
-        )
+        (
+          result = inferCallArgumentTypeContextual(n, path)
+          or
+          result = inferMemberAccessReceiverTypeContextual(n, path)
+          or
+          exists(Operation o, int pos |
+            n = o.getOperand(pos) and
+            result = OperationMatching::inferAccessType(o, pos, path)
+          )
+          or
+          exists(Construction c, int pos |
+            n = c.getArgument(pos) and
+            result = ConstructionMatching::inferAccessType(c, pos, path)
+          )
+          or
+          exists(TypePath path1, AstNode n2, TypePath path2, TypePath suffix |
+            result = inferType(n2, path2.appendInverse(suffix)) and
+            path = path1.append(suffix) and
+            step(n, path1, n2, path2)
+          )
+        ) and
+        not prohibitContextualInference(n, path)
       }
 
       // todo: share logic about `hasUnknownType`
@@ -2706,6 +2714,8 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
           prefix.isPrefixOf(path)
         |
           not Certain::certainTypeConflict(n, prefix, path, result)
+          or
+          result instanceof PseudoType and not result instanceof UnknownType // todo
         )
         or
         // If `n` has an explicitly unknown type at `prefix` and at the same time a certain