Type inference: Consistency check for escaping type parameters

Author: hvitved

rust/ql/lib/codeql/rust/internal/typeinference/Type.qll

@@ -401,6 +401,8 @@ abstract class TypeParameter extends Type {
   override TypeParameter getPositionalTypeParameter(int i) { none() }
 
   abstract ItemNode getDeclaringItem();
+
+  AstNode getScope() { result = this.getDeclaringItem() }
 }
 
 private class RawTypeParameter = @type_param or @trait or @type_alias or @impl_trait_type_repr;
@@ -583,6 +585,8 @@ class ImplTraitTypeParameter extends TypeParameter, TImplTraitTypeParameter {
 
   override ItemNode getDeclaringItem() { none() }
 
+  override AstNode getScope() { result = implTrait.getFunction() }
+
   override string toString() { result = "impl(" + typeParam.toString() + ")" }
 
   override Location getLocation() { result = typeParam.getLocation() }
@@ -633,6 +637,8 @@ class ImplTraitTypeTypeParameter extends ImplTraitType, TypeParameter {
 
   override ItemNode getDeclaringItem() { none() }
 
+  override AstNode getScope() { result = function }
+
   override Function getFunction() { result = function }
 
   override TypeParameter getPositionalTypeParameter(int i) { none() }

rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll

@@ -2272,7 +2272,11 @@ private module Input3 implements InputSig3 {
     BoolType() { this.getTypeItem() instanceof Builtins::Bool }
   }
 
-  class AstNode = Rust::AstNode;
+  class AstNode extends Rust::AstNode {
+    AstNode getParent() { result = this.getParentNode() }
+  }
+
+  AstNode getTypeParameterScope(TypeParameter tp) { result = tp.getScope() }
 
   final class Expr = ExprImpl;
 
@@ -2286,13 +2290,13 @@ private module Input3 implements InputSig3 {
     TypeMention getType() { result = this.getTypeRepr() }
   }
 
-  class Switch extends Rust::MatchExpr {
+  class Switch extends Expr, Rust::MatchExpr {
     Expr getExpr() { result = this.getScrutinee() }
 
     Case getCase(int index) { result = this.getArm(index) }
   }
 
-  class Case extends Rust::MatchArm {
+  class Case extends AstNode, Rust::MatchArm {
     AstNode getAPattern() { result = this.getPat() }
 
     AstNode getBody() { result = this.getExpr() }
@@ -2453,8 +2457,8 @@ private module Input3 implements InputSig3 {
       // mutual recursion; resolving fields requires resolving types and vice versa
       result =
         [
-          resolveStructFieldExpr(this, _).(AstNode),
-          resolveTupleFieldExpr(this, _)
+          resolveStructFieldExpr(this, _).(Field),
+          resolveTupleFieldExpr(this, _).(Field)
         ]
     }
   }
@@ -2484,7 +2488,7 @@ private module Input3 implements InputSig3 {
     )
   }
 
-  class Return extends ReturnExpr {
+  class Return extends Expr, ReturnExpr {
     Expr getExpr() { result = super.getExpr() }
   }
 
@@ -2587,15 +2591,15 @@ private module Input3 implements InputSig3 {
     override TypeItem getTypeItem() { result = this }
 
     override Parameter getParameter(int i) {
-      result = [super.getTupleField(i).(AstNode), super.getNthStructField(i)]
+      result = [super.getTupleField(i).(Parameter), super.getNthStructField(i).(Parameter)]
     }
   }
 
   private class VariantConstructor extends ConstructorImpl instanceof Variant {
     override TypeItem getTypeItem() { result = super.getEnum() }
 
     override Parameter getParameter(int i) {
-      result = [super.getTupleField(i).(AstNode), super.getNthStructField(i)]
+      result = [super.getTupleField(i).(Parameter), super.getNthStructField(i).(Parameter)]
     }
   }
 
@@ -3161,7 +3165,7 @@ module Consistency = M3::Consistency;
 
 module CachedStage = M3::CachedStage;
 
-private predicate typeTestAstNodeRepr(AstNode n, string repr) {
+private predicate typeTestAstNodeRepr(Input3::AstNode n, string repr) {
   repr = [n.toString(), n.(IdentPat).getName().getText()]
 }
 

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -2140,13 +2140,24 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
 
       /** An AST node. */
       class AstNode {
+        /** Gets the parent of this AST node, if any. */
+        AstNode getParent();
+
         /** Gets a textual representation of this AST node. */
         string toString();
 
         /** Gets the location of this AST node. */
         Location getLocation();
       }
 
+      /**
+       * Gets the scope of type parameter `tp`.
+       *
+       * Only used in a consistency check to ensure that type parameters do not
+       * escape their scope.
+       */
+      AstNode getTypeParameterScope(TypeParameter tp);
+
       /** An expression. */
       class Expr extends AstNode;
 
@@ -3754,6 +3765,11 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
           Input3::inferTypeForDefaults(n, path) = t and
           not inferType(n, path) = t
         }
+
+        query predicate typeParameterEscape(AstNode n, TypePath path, TypeParameter tp) {
+          tp = inferType(n, path) and
+          not n.getParent*() = getTypeParameterScope(tp)
+        }
       }
 
       /**

unified/ql/lib/codeql/unified/internal/typeinference/Type.qll

@@ -204,6 +204,8 @@ class ClosureParameterPseudoType extends PseudoType, TClosureParameterPseudoType
 
 /** A type parameter. */
 abstract class TypeParameter extends TypeImpl {
+  abstract AstNode getScope();
+
   override TypeParameter getPositionalTypeParameter(int i) { none() }
 
   abstract AstNode getDeclaringItem();
@@ -227,6 +229,12 @@ class TypeParameterType extends TypeParameter, TTypeParameterType {
 
   Unified::TypeParameter getTypeParameter() { result = typeParam }
 
+  override AstNode getScope() {
+    result = typeParam.getParent()
+    or
+    result.(ClassLikeDeclaration).resolve().getEnclosingClassResolved*() = typeParam.getParent()
+  }
+
   override ClassLikeDeclaration getDeclaringItem() { typeParam = result.getATypeParameter() }
 
   override Identifier getNameNode() { result = typeParam.getNameNode() }
@@ -248,6 +256,8 @@ class AssociatedTypeParameterType extends TypeParameter, TAssociatedTypeParamete
 
   Unified::AssociatedTypeDeclaration getAssociatedTypeDeclaration() { result = assocTypeDecl }
 
+  override AstNode getScope() { result.(ClassLikeDeclaration).resolve() = c }
+
   override ClassLikeDeclaration getDeclaringItem() { result = c }
 
   override Identifier getNameNode() { result = assocTypeDecl.getNameNode() }
@@ -295,6 +305,8 @@ class ParentTypeParameterType extends TypeParameter, TParentTypeParameterType {
 
   override Member getDeclaringItem() { result = m }
 
+  override AstNode getScope() { none() }
+
   override Identifier getNameNode() { none() }
 
   override string toString() { result = "(parent:" + m.getNameOrFallback() + ")" }
@@ -310,6 +322,8 @@ class UnknownTypeTypeParameter extends TypeParameter, TUnknownTypeTypeParameter
 
   UnknownTypeTypeParameter() { this = TUnknownTypeTypeParameter(i) }
 
+  override AstNode getScope() { none() }
+
   override AstNode getDeclaringItem() { none() }
 
   override Identifier getNameNode() { none() }

unified/ql/lib/codeql/unified/internal/typeinference/TypeInference.qll

@@ -143,6 +143,8 @@ module Input3 implements InputSig3 {
 
   class AstNode = Unified::AstNode;
 
+  AstNode getTypeParameterScope(TypeParameter tp) { result = tp.getScope() }
+
   class Expr extends Unified::Expr {
     Expr() {
       isInAssignmentContext(this, _) or

unified/ql/lib/codeql/unified/internal/typeinference/TypeInferenceConsistency.qll

@@ -10,10 +10,15 @@ import TypeInference::Consistency
 
 query predicate illFormedTypeMention(TypeMention tm) {
   Consistency::illFormedTypeMention(tm) and
+  // not tm.(AliasExprTypeMention).isTypeParameterAlias(_) and
   tm.fromSource()
 }
 
 query predicate nonUniqueCertainType(AstNode n, TypePath path) {
   Consistency::nonUniqueCertainType(n, path) and
   n.fromSource()
 }
+
+query predicate hasAliasType(AstNode n, TypePath path, AliasType alias) {
+  alias = inferType(n, path)
+}