Rust: Type inference 2.0

Author: hvitved

rust/ql/lib/codeql/rust/internal/CachedStages.qll

@@ -30,6 +30,8 @@ import rust
  * The `backref` predicate starts with `1 = 1 or` to ensure that the predicate will be optimized down to a constant by the optimizer.
  */
 module Stages {
+  private import codeql.rust.internal.typeinference.TypeInference as TypeInference
+
   /**
    * The abstract syntex tree (AST) stage.
    */
@@ -126,35 +128,7 @@ module Stages {
   /**
    * The type inference stage.
    */
-  cached
-  module TypeInferenceStage {
-    private import codeql.rust.internal.typeinference.Type
-    private import codeql.rust.internal.typeinference.TypeInference
-    private import codeql.rust.dataflow.internal.ModelsAsData
-
-    /**
-     * Always holds.
-     * Ensures that a predicate is evaluated as part of the type inference stage.
-     */
-    cached
-    predicate ref() { 1 = 1 }
-
-    /**
-     * DO NOT USE!
-     *
-     * Contains references to each predicate that use the above `ref` predicate.
-     */
-    cached
-    predicate backref() {
-      1 = 1
-      or
-      exists(Type t)
-      or
-      exists(inferType(_))
-      or
-      mayInvokeCallback(_, _)
-    }
-  }
+  module TypeInferenceStage = TypeInference::CachedStage;
 
   /**
    * The data flow stage.

rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll

@@ -96,8 +96,7 @@ module SatisfiesBlanketConstraint<
 
     Type getTypeAt(TypePath path) {
       result = at.getTypeAt(blanketPath.appendInverse(path)) and
-      not result = TNeverType() and
-      not result = TUnknownType()
+      not result instanceof PseudoType
     }
 
     string toString() { result = at.toString() + " [blanket at " + blanketPath.toString() + "]" }

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -329,8 +329,7 @@ module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunc
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
       result = substituteLookupTraits0(this.getEnclosingItemNode(), super.getTypeAt(path)) and
-      not result = TNeverType() and
-      not result = TUnknownType()
+      not result instanceof PseudoType
     }
   }
 

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -36,8 +36,13 @@ newtype TType =
   TTrait(Trait t) or
   TImplTraitType(ImplTraitTypeRepr impl) or
   TDynTraitType(Trait t) { t = any(DynTraitTypeRepr dt).getTrait() } or
-  TNeverType() or
   TUnknownType() or
+  TClosureParameterPseudoType(Param p) {
+    exists(ClosureExpr ce |
+      p = ce.getParam(_) and
+      not p.hasTypeRepr()
+    )
+  } or
   TTypeParamTypeParameter(TypeParam t) or
   TAssociatedTypeTypeParameter(Trait trait, AssocType typeAlias) {
     getTraitAssocType(trait) = typeAlias
@@ -326,14 +331,6 @@ TypeParamTypeParameter getSliceTypeParameter() {
   result = any(SliceType t).getPositionalTypeParameter(0)
 }
 
-class NeverType extends Type, TNeverType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "!" }
-
-  override Location getLocation() { result instanceof EmptyLocation }
-}
-
 abstract class PtrType extends StructType { }
 
 pragma[nomagic]
@@ -355,6 +352,10 @@ class PtrConstType extends PtrType {
   override string toString() { result = "*const" }
 }
 
+abstract class PseudoType extends Type {
+  override TypeParameter getPositionalTypeParameter(int i) { none() }
+}
+
 /**
  * A special pseudo type used to indicate that the actual type may have to be
  * inferred by propagating type information back into call arguments.
@@ -377,14 +378,24 @@ class PtrConstType extends PtrType {
  * into call arguments (including method call receivers), in order to avoid
  * combinatorial explosions.
  */
-class UnknownType extends Type, TUnknownType {
-  override TypeParameter getPositionalTypeParameter(int i) { none() }
-
-  override string toString() { result = "(context typed)" }
+class UnknownType extends PseudoType, TUnknownType {
+  override string toString() { result = "(unknown type)" }
 
   override Location getLocation() { result instanceof EmptyLocation }
 }
 
+class ClosureParameterPseudoType extends PseudoType, TClosureParameterPseudoType {
+  private Param param;
+
+  ClosureParameterPseudoType() { this = TClosureParameterPseudoType(param) }
+
+  Param getParam() { result = param }
+
+  override string toString() { result = "(closure parameter " + param + ")" }
+
+  override Location getLocation() { result = param.getLocation() }
+}
+
 /** A type parameter. */
 abstract class TypeParameter extends Type {
   override TypeParameter getPositionalTypeParameter(int i) { none() }