Rust: Take additional type parameter constraints into account

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/AstNodeImpl.qll

@@ -48,6 +48,17 @@ module Impl {
       )
     }
 
+    /** Gets the immediately enclosing function of this node, if any. */
+    pragma[nomagic]
+    Function getEnclosingFunction() {
+      result = this.getEnclosingCallable()
+      or
+      exists(Callable c | c = this.getEnclosingCallable() |
+        not c instanceof Function and
+        result = c.getEnclosingFunction()
+      )
+    }
+
     /** Gets the CFG scope that encloses this node, if any. */
     cached
     CfgScope getEnclosingCfgScope() {

rust/ql/lib/codeql/rust/elements/internal/TypeParamImpl.qll

@@ -32,7 +32,8 @@ module Impl {
      * Gets the `index`th type bound of this type parameter, if any.
      *
      * This includes type bounds directly on this type parameter and bounds from
-     * any `where` clauses for this type parameter.
+     * any `where` clauses for this type parameter, but restricted to `where`
+     * clauses from the item that declares this type parameter.
      */
     TypeBound getTypeBound(int index) {
       result =
@@ -43,13 +44,36 @@ module Impl {
      * Gets a type bound of this type parameter.
      *
      * This includes type bounds directly on this type parameter and bounds from
-     * any `where` clauses for this type parameter.
+     * any `where` clauses for this type parameter, but restricted to `where`
+     * clauses from the item that declares this type parameter.
      */
     TypeBound getATypeBound() { result = this.getTypeBound(_) }
 
     /** Holds if this type parameter has at least one type bound. */
     predicate hasTypeBound() { exists(this.getATypeBound()) }
 
+    /**
+     * Gets the `index`th additional type bound of this type parameter,
+     * which applies to `constrainingItem`, if any.
+     *
+     * For example, in
+     *
+     * ```rust
+     * impl<T> SomeType<T> where T: Clone {
+     *     fn foo() where T: Debug { }
+     * }
+     * ```
+     *
+     * The constraint `Debug` additionally applies to `T` in `foo`.
+     */
+    TypeBound getAdditionalTypeBound(Item constrainingItem, int index) {
+      result =
+        rank[index + 1](int i, int j |
+          |
+          this.(TypeParamItemNode).getAdditionalTypeBoundAt(constrainingItem, i, j) order by i, j
+        )
+    }
+
     override string toAbbreviatedString() { result = this.getName().getText() }
 
     override string toStringImpl() { result = this.getName().getText() }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -1162,21 +1162,39 @@ private Path getWherePredPath(WherePred wp) { result = wp.getTypeRepr().(PathTyp
 final class TypeParamItemNode extends NamedItemNode, TypeItemNode instanceof TypeParam {
   /** Gets a where predicate for this type parameter, if any */
   pragma[nomagic]
-  private WherePred getAWherePred() {
+  private WherePred getAWherePred(ItemNode constrainingItem, boolean isAdditional) {
     exists(ItemNode declaringItem |
+      this = declaringItem.getTypeParam(_) and
       this = resolvePath(getWherePredPath(result)) and
-      result = declaringItem.getADescendant() and
-      this = declaringItem.getADescendant()
+      result = constrainingItem.getADescendant()
+    |
+      constrainingItem = declaringItem and
+      isAdditional = false
+      or
+      constrainingItem = declaringItem.getADescendant() and
+      isAdditional = true
     )
   }
 
   pragma[nomagic]
   TypeBound getTypeBoundAt(int i, int j) {
     exists(TypeBoundList tbl | result = tbl.getBound(j) |
-      tbl = super.getTypeBoundList() and i = 0
+      tbl = super.getTypeBoundList() and
+      i = 0
       or
       exists(WherePred wp |
-        wp = this.getAWherePred() and
+        wp = this.getAWherePred(_, false) and
+        tbl = wp.getTypeBoundList() and
+        wp = any(WhereClause wc).getPredicate(i)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  TypeBound getAdditionalTypeBoundAt(Item constrainingItem, int i, int j) {
+    exists(TypeBoundList tbl | result = tbl.getBound(j) |
+      exists(WherePred wp |
+        wp = this.getAWherePred(constrainingItem, true) and
         tbl = wp.getTypeBoundList() and
         wp = any(WhereClause wc).getPredicate(i)
       )
@@ -1197,6 +1215,15 @@ final class TypeParamItemNode extends NamedItemNode, TypeItemNode instanceof Typ
 
   ItemNode resolveABound() { result = resolvePath(this.getABoundPath()) }
 
+  pragma[nomagic]
+  ItemNode resolveAdditionalBound(ItemNode constrainingItem) {
+    result =
+      resolvePath(this.getAdditionalTypeBoundAt(constrainingItem, _, _)
+            .getTypeRepr()
+            .(PathTypeRepr)
+            .getPath())
+  }
+
   override string getName() { result = TypeParam.super.getName().getText() }
 
   override Namespace getNamespace() { result.isType() }

rust/ql/lib/codeql/rust/internal/typeinference/FunctionType.qll

@@ -203,7 +203,7 @@ class AssocFunctionType extends MkAssocFunctionType {
 }
 
 pragma[nomagic]
-Trait getALookupTrait(Type t) {
+private Trait getALookupTrait(Type t) {
   result = t.(TypeParamTypeParameter).getTypeParam().(TypeParamItemNode).resolveABound()
   or
   result = t.(SelfTypeParameter).getTrait()
@@ -213,23 +213,40 @@ Trait getALookupTrait(Type t) {
   result = t.(DynTraitType).getTrait()
 }
 
-/**
- * Gets the type obtained by substituting in relevant traits in which to do function
- * lookup, or `t` itself when no such trait exist.
- */
 pragma[nomagic]
-Type substituteLookupTraits(Type t) {
+private Trait getAdditionalLookupTrait(Type t, Function f) {
+  result = t.(TypeParamTypeParameter).getTypeParam().(TypeParamItemNode).resolveAdditionalBound(f)
+}
+
+bindingset[n, t]
+Trait getALookupTrait(AstNode n, Type t) {
+  result = getALookupTrait(t)
+  or
+  result = getAdditionalLookupTrait(t, n.getEnclosingFunction())
+}
+
+bindingset[f, t]
+private Type substituteLookupTraits0(Function f, Type t) {
   not exists(getALookupTrait(t)) and
+  not exists(getAdditionalLookupTrait(t, f)) and
   result = t
   or
   result = TTrait(getALookupTrait(t))
+  or
+  result = TTrait(getAdditionalLookupTrait(t, f))
 }
 
 /**
- * Gets the `n`th `substituteLookupTraits` type for `t`, per some arbitrary order.
+ * Gets the type obtained by substituting in relevant traits in which to do function
+ * lookup, or `t` itself when no such trait exist, in the context of AST node `n`.
  */
+bindingset[n, t]
+Type substituteLookupTraits(AstNode n, Type t) {
+  result = substituteLookupTraits0(n.getEnclosingFunction(), t)
+}
+
 pragma[nomagic]
-Type getNthLookupType(Type t, int n) {
+private Type getNthLookupType(Type t, int n) {
   not exists(getALookupTrait(t)) and
   result = t and
   n = 0
@@ -244,24 +261,64 @@ Type getNthLookupType(Type t, int n) {
 }
 
 /**
- * Gets the index of the last `substituteLookupTraits` type for `t`.
+ * Gets the `n`th `substituteLookupTraits` type for `t`, per some arbitrary order,
+ * in the context of AST node `node`.
  */
+bindingset[node, t]
+Type getNthLookupType(AstNode node, Type t, int n) {
+  exists(Function f | f = node.getEnclosingFunction() |
+    if exists(getAdditionalLookupTrait(t, f))
+    then
+      result =
+        TTrait(rank[n + 1](Trait trait, int i |
+            trait = [getALookupTrait(t), getAdditionalLookupTrait(t, f)] and
+            i = idOfTypeParameterAstNode(trait)
+          |
+            trait order by i
+          ))
+    else result = getNthLookupType(t, n)
+  )
+}
+
 pragma[nomagic]
-int getLastLookupTypeIndex(Type t) { result = max(int n | exists(getNthLookupType(t, n))) }
+private int getLastLookupTypeIndex(Type t) { result = max(int n | exists(getNthLookupType(t, n))) }
+
+/**
+ * Gets the index of the last `substituteLookupTraits` type for `t`,
+ * in the context of AST node `node`.
+ */
+bindingset[node, t]
+int getLastLookupTypeIndex(AstNode node, Type t) {
+  if exists(getAdditionalLookupTrait(t, node))
+  then result = max(int n | exists(getNthLookupType(node, t, n)))
+  else result = getLastLookupTypeIndex(t)
+}
+
+signature class ArgSig {
+  /** Gets the type of this argument at `path`. */
+  Type getTypeAt(TypePath path);
+
+  /** Gets the enclosing function of this argument. */
+  Function getEnclosingFunction();
+
+  /** Gets a textual representation of this argument. */
+  string toString();
+
+  /** Gets the location of this argument. */
+  Location getLocation();
+}
 
 /**
  * A wrapper around `IsInstantiationOf` which ensures to substitute in lookup
  * traits when checking whether argument types are instantiations of function
  * types.
  */
-module ArgIsInstantiationOf<
-  HasTypeTreeSig Arg, IsInstantiationOfInputSig<Arg, AssocFunctionType> Input>
-{
+module ArgIsInstantiationOf<ArgSig Arg, IsInstantiationOfInputSig<Arg, AssocFunctionType> Input> {
   final private class ArgFinal = Arg;
 
   private class ArgSubst extends ArgFinal {
     Type getTypeAt(TypePath path) {
-      result = substituteLookupTraits(super.getTypeAt(path)) and
+      result = substituteLookupTraits0(this.getEnclosingFunction(), super.getTypeAt(path)) and
       not result = TNeverType() and
       not result = TUnknownType()
     }
@@ -318,6 +375,8 @@ signature module ArgsAreInstantiationsOfInputSig {
 
     Location getLocation();
 
+    Function getEnclosingFunction();
+
     Type getArgType(FunctionPosition pos, TypePath path);
 
     predicate hasTargetCand(ImplOrTraitItemNode i, Function f);
@@ -366,6 +425,8 @@ module ArgsAreInstantiationsOf<ArgsAreInstantiationsOfInputSig Input> {
 
     FunctionPosition getPos() { result = pos }
 
+    Function getEnclosingFunction() { result = call.getEnclosingFunction() }
+
     Location getLocation() { result = call.getLocation() }
 
     Type getTypeAt(TypePath path) { result = call.getArgType(pos, path) }