wip

Author: hvitved

shared/typeinference/codeql/typeinference/internal/TypeInference.qll

@@ -3006,6 +3006,11 @@ module Make1<LocationSig Location, InputSig1<Location> Input1> {
             exists(e)
           }
 
+          private Type getInferredType0(AccessEnvironment e, AccessPosition apos, TypePath path) {
+            result = this.getInferredType(e, apos, path) and
+            exists(this.getTarget(e))
+          }
+
           Declaration getTarget(AccessEnvironment e) { result = super.getTarget(e) }
         }
       }

swift/ql/test/library-tests/type-inference/basics.swift

@@ -1,71 +1,71 @@
-var topLevelDecl : Int = 0
+var topLevelDecl: Int = 0
 0
-topLevelDecl + 1 // $ type=topLevelDecl:Int
+topLevelDecl + 1  // $ type=topLevelDecl:Int
 
 class C {
-  var myInt : Int
+  var myInt: Int
   // C.init
   init(n: Int) {
-    myInt = n // $ type=n:Int
+    myInt = n  // $ type=n:Int
   }
 
   // C.getMyInt
   func getMyInt() -> Int {
-    return myInt // $ type=.myInt:Int
+    return myInt  // $ type=.myInt:Int
   }
 }
 
-class Derived : C {
+class Derived: C {
   // Derived.init
   init() {
-    super.init(n: 0) // $ type=super:C target=C.init
+    super.init(n: 0)  // $ type=super:C target=C.init
   }
 
   // Derived.callGetMyInt
   func callGetMyInt() -> Int {
-    let x = getMyInt(); // $ type=x:Int target=C.getMyInt
+    let x = getMyInt()  // $ type=x:Int target=C.getMyInt
     return x
   }
 }
 
 class Generic<T> {
-  var value : T
+  var value: T
   // Generic.init
   init(v: T) {
-    value = v // $ type=v:T
+    value = v  // $ type=v:T
   }
 
   // Generic.getValue
   func getValue() -> T {
-    return value // $ type=.value:T
+    return value  // $ type=.value:T
   }
 }
 
-class GenericDerived : Generic<Int> {
+class GenericDerived: Generic<Int> {
   // GenericDerived.init
   init() {
-    super.init(v: 0) // $ type=super@Generic<T>:Int target=Generic.init
+    super.init(v: 0)  // $ type=super@Generic<T>:Int target=Generic.init
   }
 }
 
 func testGeneric() {
-  let g = Generic(v: 42) // $ type=g@Generic<T>:Int target=Generic.init
-  let x = g.getValue() // $ type=x:Int target=Generic.getValue
+  let g = Generic(v: 42)  // $ type=g@Generic<T>:Int target=Generic.init
+  let x = g.getValue()  // $ type=x:Int target=Generic.getValue
 
-  let gd = GenericDerived() // $ type=gd:GenericDerived target=GenericDerived.init
-  let y = gd.getValue() // $ type=y:Int target=Generic.getValue
+  let gd = GenericDerived()  // $ type=gd:GenericDerived target=GenericDerived.init
+  let y = gd.getValue()  // $ type=y:Int target=Generic.getValue
 }
 
 // --- Extensions ---
 
 extension C {
   // C.doubled
   func doubled() -> Int {
-    return myInt * 2 // $ type=.myInt:Int
+    return myInt * 2  // $ type=.myInt:Int
   }
 }
 
 func testExtension() {
-  let obj = C(n: 10) // $ target=C.init
-  let d = obj.doubled() // $ type=d:Int target=C.doubled
+  let obj = C(n: 10)  // $ target=C.init
+  let d = obj.doubled()  // $ type=d:Int target=C.doubled
 }

unified/ql/lib/codeql/unified/internal/dataflow/CallGraph.qll

@@ -1,16 +1,7 @@
 private import unified
 private import AllDataFlow
-private import codeql.unified.internal.NameBinding as N
-
-private Callable getCallableFromNameBinding(NameBinding binding) {
-  binding = result.(FunctionDeclaration).getNameNode()
-}
+private import codeql.unified.internal.typeinference.TypeInference as T
 
 DataFlowCallable viableCallable(DataFlowCall c) {
-  exists(CallExpr call, Callable callable, NameBinding target |
-    c.asExplicitCall() = call and
-    target = N::getStaticBindingTarget(N::getIdentifierFromRef(call.getCallee())) and
-    callable = getCallableFromNameBinding(target) and
-    result.asSourceCallable() = callable
-  )
+  result.asSourceCallable() = T::resolveCallTarget(c.asExplicitCall(), _)
 }

unified/ql/lib/codeql/unified/internal/typeinference/TypeInference.qll

@@ -107,7 +107,7 @@ import M2
 private module Input3 implements InputSig3 {
   private import unified as Unified
 
-  predicate cacheRevRef() { exists(resolveCallTarget(_)) implies any() }
+  predicate cacheRevRef() { exists(lookupMember(_)) implies any() }
 
   predicate inferTypeForDefaults = M3::inferType/2;
 
@@ -478,6 +478,8 @@ private module Input3 implements InputSig3 {
 
     abstract Expr getArgument(int i);
 
+    abstract int getNumberOfArguments();
+
     abstract Callable getTarget(InvocationResolutionContext c);
 
     abstract Callable getATargetForTypeQualifierMatching();
@@ -498,15 +500,28 @@ private module Input3 implements InputSig3 {
 
     override Type getTypeArgument(int pos, TypePath path) { none() }
 
+    override int getNumberOfArguments() {
+      exists(Unified::Callable target, boolean isFunctionExprInvoke |
+        target = resolveCallTarget(this, isFunctionExprInvoke) and
+        result = CallExpr.super.getNumberOfArguments() + 1
+      )
+    }
+
     override Expr getArgument(int i) {
-      i = 0 and
-      result = CallExpr.super.getCallee().(MemberAccessExpr).getBase()
-      or
-      result = CallExpr.super.getArgument(i - 1).getValue()
+      exists(Unified::Callable target, boolean isFunctionExprInvoke |
+        target = resolveCallTarget(this, isFunctionExprInvoke)
+      |
+        i = 0 and
+        if isFunctionExprInvoke = true
+        then result = CallExpr.super.getCallee()
+        else result = CallExpr.super.getCallee().(MemberAccessExpr).getBase()
+        or
+        result = CallExpr.super.getArgument(i - 1).getValue()
+      )
     }
 
     override Callable getTarget(InvocationResolutionContext c) {
-      result.getAstNode() = resolveCallTarget(this) and
+      result.getAstNode() = resolveCallTarget(this, _) and
       exists(c)
     }
 
@@ -517,11 +532,27 @@ private module Input3 implements InputSig3 {
     Invocation invocation, InvocationResolutionContext ctx, int i, TypePath path
   ) {
     exists(ctx) and
-    (
-      result = inferType(invocation.getArgument(i), path)
-      or
-      i = 0 and
-      result = getImplicitReceiverType(invocation.(CallExpr).getCallee(), path)
+    exists(boolean isFunctionExprInvoke |
+      exists(resolveCallTarget(invocation, isFunctionExprInvoke))
+    |
+      if isFunctionExprInvoke = true
+      then
+        exists(Type t | exists(getInvokeTarget(invocation, t)) |
+          i = 0 and
+          result = inferType(invocation.(CallExpr).getCallee(), path)
+          or
+          exists(TypePath prefix, TypePath suffix, int j |
+            functionInvokeSignature(t, invocation.getNumberOfArguments() - 1, j, i, prefix) and
+            result = inferType(invocation.getArgument(j + 1), suffix) and
+            path = prefix.append(suffix)
+          )
+        )
+      else (
+        result = inferType(invocation.getArgument(i), path)
+        or
+        i = 0 and
+        result = getImplicitReceiverType(invocation.(CallExpr).getCallee(), path)
+      )
     )
   }
 
@@ -543,29 +574,40 @@ private module Input3 implements InputSig3 {
     Parameter getParameter() { result = TExplicitDeclaration(this.getParam()) }
   }
 
-  bindingset[c]
+  pragma[nomagic]
   Type getClosureType(Closure c) { result = getFunctionExprType(c.getAstNode()) }
 
   pragma[nomagic]
   TypePath getClosureParameterTypePath(Parameter p) {
-    exists(FunctionExpr fe, int i |
+    exists(FunctionExpr fe, Type t, int i |
       p = TExplicitDeclaration(fe.getParameter(i)) and
-      result = getFunctionExprParameterTypePath(fe, i)
+      t = getFunctionExprType(fe) and
+      result = getFunctionExprParameterTypePath(t, fe.getNumberOfParameters(), i)
     )
   }
 
-  bindingset[c]
+  pragma[nomagic]
   TypePath getClosureReturnTypePath(Closure c) {
-    result = getFunctionExprReturnTypePath(c.getAstNode())
+    result = getFunctionExprReturnTypePath(getClosureType(c))
   }
 
   predicate stepLanguageSpecific(AstNode n1, TypePath prefix1, AstNode n2, TypePath prefix2) {
-    none()
+    n1 = n2.(Block).getLastStmt() and
+    prefix1.isEmpty() and
+    prefix2.isEmpty()
   }
 
   Type inferTypeLanguageSpecific(AstNode n, TypePath path) {
     result = Plugin::inferType(n, path)
     or
+    n instanceof BooleanLiteral and
+    result instanceof BoolType and
+    path.isEmpty()
+    or
+    n instanceof IntLiteral and
+    result instanceof IntType and
+    path.isEmpty()
+    or
     exists(ClassLikeDeclaration c |
       c = n.(SuperExpr).getEnclosingClass() and
       result = c.getBaseType(0).getType().(TypeMention).getTypeAt(path)
@@ -602,18 +644,31 @@ Identifier lookupMember(MemberAccessExpr mae) {
   )
 }
 
-Callable resolveCallTarget(CallExpr ce) {
+pragma[nomagic]
+private Callable getInvokeTarget(CallExpr ce, Type t) {
+  t = inferType(ce.getCallee()) and
+  result = getFunctionInvoke(t)
+}
+
+// Does not yet take overloading into account
+Callable resolveCallTarget(CallExpr ce, boolean isFunctionExprInvoke) {
   exists(NameBinding b | b = getStaticBindingTarget(ce.getCallee()) |
+    // object creation
     exists(ClassLikeDeclaration cls, ConstructorDeclaration init |
       cls.getNameNode() = b and
       init = cls.getAMember() and
       result = init
     )
     or
     result.(FunctionDeclaration).getNameNode() = b
-  )
+  ) and
+  isFunctionExprInvoke = false
+  or
+  result.(Input3::AstDeclaration::Declaration).getNameNode() = lookupMember(ce.getCallee()) and
+  isFunctionExprInvoke = false
   or
-  result.(Input3::AstDeclaration::Declaration).getNameNode() = lookupMember(ce.getCallee())
+  result = getInvokeTarget(ce, _) and
+  isFunctionExprInvoke = true
 }
 
 VariableDeclaration resolveFieldAccess(MemberAccessExpr mae) {