wip7

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -314,6 +314,9 @@ private module Input3 implements InputSig3 {
       n = c and
       result = c.getTypeRepr()
     )
+    or
+    coerceAnnotated(_, n) and
+    result = n
   }
 
   class Expr = Rust::Expr;
@@ -596,6 +599,11 @@ private module Input3 implements InputSig3 {
         not isPanicMacroCall(n2)
         or
         n1 = n2.(MacroPat).getMacroCall().getMacroCallExpansion()
+        or
+        // this step does not actually propagate type information from `n1` to `n2`, but
+        // it allows for reverse propagation of type information from `n2` to `n1` in the
+        // case where `n1` has an explicit unknown type
+        coerceAnnotated(n1, n2)
       )
     )
     or
@@ -623,6 +631,7 @@ private module Input3 implements InputSig3 {
     )
   }
 
+  pragma[inline]
   Type inferType(AstNode n, TypePath path) {
     result = M3::inferType(n, path)
     or
@@ -660,10 +669,6 @@ private module Input3 implements InputSig3 {
   }
 
   Type inferTypeTopDown(AstNode n, TypePath path) {
-    result = inferTypeFromAnnotationTopDown(n, path)
-    or
-    result = inferClosureExprBodyTypeTopDown(n, path)
-    or
     exists(FunctionPosition pos | not pos.isReturn() |
       result = inferConstructionType(n, pos, path)
       or
@@ -918,17 +923,17 @@ private Struct getRangeType(RangeExpr re) {
   result instanceof RangeToInclusiveStruct
 }
 
+/**
+ * Holds if `n` is a coercion site, and `tm` is a type annotation to which
+ * the type of `n` must be coerced.
+ */
 pragma[nomagic]
-private Type inferTypeFromAnnotationTopDown(AstNode n, TypePath path) {
-  // Normally, these are coercion sites, but in case a type is unknown we
-  // allow for type information to flow from the type annotation.
-  exists(TypeMention tm | result = tm.getTypeAt(path) |
-    tm = any(LetStmt let | identLetStmt(let, _, n)).getTypeRepr()
-    or
-    tm = any(ClosureExpr ce | n = ce.getBody()).getRetType().getTypeRepr()
-    or
-    tm = getReturnTypeMention(any(Function f | n = f.getBody()))
-  )
+private predicate coerceAnnotated(AstNode n, TypeMention tm) {
+  tm = any(LetStmt let | identLetStmt(let, _, n)).getTypeRepr()
+  or
+  tm = any(ClosureExpr ce | n = ce.getBody()).getRetType().getTypeRepr()
+  or
+  tm = getReturnTypeMention(any(Function f | n = f.getBody()))
 }
 
 pragma[nomagic]
@@ -3649,14 +3654,6 @@ private Type inferForLoopExprType(AstNode n, TypePath path) {
   )
 }
 
-pragma[nomagic]
-private Type inferClosureExprBodyTypeTopDown(AstNode n, TypePath path) {
-  exists(ClosureExpr ce |
-    n = ce.getClosureBody() and
-    result = inferType(ce, closureReturnPath().appendInverse(path))
-  )
-}
-
 pragma[nomagic]
 private Type inferClosureExprType(ClosureExpr ce, TypePath path) {
   path = TypePath::singleton(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam())) and

rust/ql/test/library-tests/type-inference/type-inference.ql

@@ -1,14 +1,16 @@
 import rust
 import utils.test.InlineExpectationsTest
 import codeql.rust.internal.typeinference.Type
+import codeql.rust.internal.typeinference.TypeMention
 import codeql.rust.internal.typeinference.TypeInference as TypeInference
 import TypeInference
 
 private predicate relevantNode(AstNode n) {
   n.fromSource() and
   not n.isFromMacroExpansion() and
   not n instanceof IdentPat and // avoid overlap in the output with the underlying `Name` node
-  not n instanceof LiteralPat // avoid overlap in the output with the underlying `Literal` node
+  not n instanceof LiteralPat and // avoid overlap in the output with the underlying `Literal` node
+  (n instanceof TypeMention implies n instanceof SelfParam)
 }
 
 query predicate inferCertainType(AstNode n, TypePath path, Type t) {

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -2213,7 +2213,12 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
          * Gets an additional type parameter constraint for the given type parameter,
          * which applies to this callable. For example, in Rust, a function can apply
          * additional constraints on type parameters belonging to the `impl` block
-         * that the function is defined in.
+         * that the function is defined in:
+         *
+         * ```rust
+         * impl<T> MyThing<T> {
+         *     fn foo(self) where T: MyTrait { ... }
+         * }
          */
         TypeMention getAdditionalTypeParameterConstraint(TypeParameter tp);