raw

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -1020,6 +1020,12 @@ private module Input3 implements InputSig3 {
   }
 
   predicate inferStep(AstNode n1, TypePath path1, AstNode n2, TypePath path2) {
+    // When `n2` is `*n1` propagate type information from a raw pointer type
+    // parameter at `n1` (all other deref expressions are handled as calls)
+    n1 = n2.(DerefExpr).getExpr() and
+    path1 = TypePath::singleton(getPtrTypeParameter()) and
+    path2.isEmpty()
+    or
     path1.isEmpty() and
     (
       n1 = n2.(ArrayListExpr).getAnExpr() and
@@ -1110,8 +1116,6 @@ private module Input3 implements InputSig3 {
     or
     result = inferAwaitExprType(n, path)
     or
-    result = inferDereferencedExprPtrType(n, path)
-    or
     result = inferForLoopExprType(n, path)
     or
     result = inferArgList(n, path)
@@ -3108,30 +3112,6 @@ private Type inferArrayExprType(ArrayExpr ae) { exists(ae) and result instanceof
 pragma[nomagic]
 private Type inferRangeExprType(RangeExpr re) { result = TDataType(getRangeType(re)) }
 
-pragma[nomagic]
-private Type getInferredDerefType(DerefExpr de, TypePath path) { result = inferType(de, path) }
-
-pragma[nomagic]
-private PtrType getInferredDerefExprPtrType(DerefExpr de) { result = inferType(de.getExpr()) }
-
-/**
- * Gets the inferred type of `n` at `path` when `n` occurs in a dereference
- * expression `*n` and when `n` is known to have a raw pointer type.
- */
-private Type inferDereferencedExprPtrType(AstNode n, TypePath path) {
-  exists(DerefExpr de, PtrType type, TypePath suffix |
-    de.getExpr() = n and
-    type = getInferredDerefExprPtrType(de) and
-    result = getInferredDerefType(de, suffix) and
-    path = TypePath::cons(type.getPositionalTypeParameter(0), suffix)
-  )
-  or
-  exists(TypePath path0 |
-    result = inferType(n.(DerefExpr).getExpr(), path0) and
-    path0.isCons(getPtrTypeParameter(), path)
-  )
-}
-
 /**
  * A matching configuration for resolving types of deconstruction patterns like
  * `let Foo { bar } = ...` or `let Some(x) = ...`.

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -2778,18 +2778,42 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
         private Type inferTypeContextualCand(AstNode n, TypePath prefix, TypePath path) {
           result = inferTypeContextualCand(n, path) and
           hasUnknownType(n) and
-          prefix = path.getAPrefix()
+          prefix = path.getAPrefix() and
+          // no need to propagate `UnknownType`s contextually; `n` must already have an
+          // `UnknownType` at some prefix of `path`
+          not result instanceof UnknownType
+        }
+
+        pragma[nomagic]
+        private Type inferTypeContextual0(AstNode n, TypePath path) {
+          exists(TypePath prefix |
+            result = inferTypeContextualCand(n, prefix, path) and
+            hasUnknownTypeAt(n, prefix)
+          )
+        }
+
+        pragma[nomagic]
+        private predicate isValidContextualNonEmptyPath(AstNode n, TypePath path) {
+          hasUnknownType(n) and
+          exists(TypePath prefix, TypeParameter tp |
+            tp = inferType(n, prefix).getATypeParameter() and
+            path = TypePath::snoc(prefix, tp)
+          )
         }
 
         /**
          * Gets the contextually inferred type of `n` at `path`, if any. This is only
-         * allowed when `n` has `UnknownType` at some prefix of `path`.
+         * allowed when `n` has `UnknownType` at some prefix of `path`, and furthermore
+         * if `path` is non-empty, then it must be compatible with an already inferred
+         * type (contextually or not).
          */
         pragma[nomagic]
         Type inferTypeContextual(AstNode n, TypePath path) {
-          exists(TypePath prefix |
-            result = inferTypeContextualCand(n, prefix, path) and
-            hasUnknownTypeAt(n, prefix)
+          result = inferTypeContextual0(n, path) and
+          (
+            path.isEmpty()
+            or
+            isValidContextualNonEmptyPath(n, path)
           )
         }
       }

shared/util/codeql/util/UnboundList.qll

@@ -191,5 +191,12 @@ module Make<LocationSig Location, InputSig<Location> Input> {
      */
     bindingset[suffix]
     UnboundList cons(Element e, UnboundList suffix) { result = singleton(e).append(suffix) }
+
+    /**
+     * Gets the list obtained by appending the singleton list `e`
+     * after `prefix`.
+     */
+    bindingset[prefix]
+    UnboundList snoc(UnboundList prefix, Element e) { result = prefix.append(singleton(e)) }
   }
 }