Rust: Restrict type propagation into arguments #20683

hvitved · 2025-10-23T14:04:20Z

No description provided.

rust/ql/lib/codeql/rust/internal/TypeInference.qll

+          tp instanceof TSelfTypeParameter and
+          exists(getCallExprTypeQualifier(a, _))
+        )
+      ) and


Before ``` Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@ada3a07w was evaluated in 801 iterations totaling 31ms (delta sizes total: 182871). 50151 ~1% {4} r1 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.0, In.2, In.3, In.4 39574 ~0% {5} | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 36996 ~0% {3} | SCAN OUTPUT In.0, In.2, In.1 36102333 ~0% {4} r2 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.0, In.2, In.3, In.4 90175 ~1% {5} | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 65014 ~1% {3} | SCAN OUTPUT In.0, In.2, In.1 50151 ~1% {5} r3 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.2, In.0, In.1, In.3, In.4 24208 ~1% {4} | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4 95022 ~0% {9} | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _ {6} | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6 93919 ~1% {7} | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _ {6} | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6 81298 ~1% {5} | SCAN OUTPUT In.1, In.4, _, In.0, In.3 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 64110 ~1% {3} | SCAN OUTPUT In.0, In.2, In.1 36102333 ~0% {5} r4 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.2, In.0, In.1, In.3, In.4 17473531 ~0% {4} | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4 47409 ~1% {9} | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _ {6} | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6 29885 ~0% {7} | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _ {6} | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6 16952 ~1% {5} | SCAN OUTPUT In.1, In.4, _, In.0, In.3 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 16829 ~0% {3} | SCAN OUTPUT In.0, In.2, In.1 182949 ~1% {3} r5 = r1 UNION r2 UNION r3 UNION r4 182949 ~1% {3} | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3) return r5 ``` After ``` Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@31ee547w was evaluated in 801 iterations totaling 19ms (delta sizes total: 182946). 81298 ~0% {5} r1 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 64110 ~1% {3} | SCAN OUTPUT In.0, In.2, In.1 39574 ~0% {5} r2 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 36996 ~0% {3} | SCAN OUTPUT In.0, In.2, In.1 16952 ~0% {5} r3 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 16829 ~0% {3} | SCAN OUTPUT In.0, In.2, In.1 90175 ~0% {5} r4 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2 {3} | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3 65014 ~0% {3} | SCAN OUTPUT In.0, In.2, In.1 182949 ~1% {3} r5 = r1 UNION r2 UNION r3 UNION r4 182949 ~1% {3} | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3) return r5 ```

Before ``` Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@31ee5u2w was evaluated in 821 iterations totaling 1057ms (delta sizes total: 689971). 416937 ~1% {6} r1 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5 222757 ~2% {8} r2 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 164360 ~3% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 315350783 ~1% {6} r3 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5 593815 ~1% {8} r4 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 342226 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 826517 ~0% {8} r5 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 345294 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 73715 ~0% {8} r6 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 47802 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 899682 ~5% {6} r7 = r2 UNION r4 UNION r5 UNION r6 711040 ~6% {6} | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6) return r7 ``` After ``` Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@ad458u2w was evaluated in 821 iterations totaling 374ms (delta sizes total: 691168). 222757 ~2% {8} r1 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 164360 ~3% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 593815 ~1% {8} r2 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 342226 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 826517 ~0% {8} r3 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 345294 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 73715 ~0% {8} r4 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3 {6} | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6 47802 ~1% {6} | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3 899682 ~5% {6} r5 = r1 UNION r2 UNION r3 UNION r4 711095 ~6% {6} | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6) return r5 ```

rust/ql/lib/codeql/rust/internal/TypeInference.qll

+ * argument/receiver of a method call.
+ */
+pragma[nomagic]
+private Type inferMethodCallType(AstNode n, TypePath path) {


rust/ql/lib/codeql/rust/internal/TypeInference.qll

-        methodCallBlanketCandidate(mc, m, i, selfType, _, _) and
-        ReceiverSatisfiesBlanketConstraint::satisfiesBlanketConstraint(mcc, i)
+        potentialInstantiationOf1(mcc, i, trait, selfType, mc, m, name, arity, strippedTypePath,
+          strippedType) and


rust/ql/lib/codeql/rust/internal/TypeInference.qll

-        methodCallBlanketCandidate(mc, m, i, selfType, _, _) and
-        ReceiverSatisfiesBlanketConstraint::satisfiesBlanketConstraint(mcc, i)
+        potentialInstantiationOf1(mcc, i, trait, selfType, mc, m, name, arity, strippedTypePath,
+          strippedType) and


github-actions bot added the Rust Pull requests that update Rust code label Oct 23, 2025

github-advanced-security bot found potential problems Oct 23, 2025

View reviewed changes

hvitved force-pushed the rust/type-inference-arg-target-typed branch 2 times, most recently from fdfd6ea to b39acb1 Compare October 23, 2025 14:53

hvitved added 2 commits October 24, 2025 11:37

Rust: More type inference tests

2a43a95

Rust: Compute incompatible blanket implementations

0e885e9

hvitved force-pushed the rust/type-inference-arg-target-typed branch from b39acb1 to 8933e71 Compare October 27, 2025 10:28

Rust: Add more type inference tests

46d0506

hvitved force-pushed the rust/type-inference-arg-target-typed branch from 8933e71 to 9097870 Compare October 27, 2025 11:24

hvitved added 3 commits October 27, 2025 13:41

Rust: Restrict type propagation into arguments

d4b55c7

hvitved force-pushed the rust/type-inference-arg-target-typed branch from 9097870 to a5e8fdb Compare October 27, 2025 12:41

github-advanced-security bot found potential problems Oct 27, 2025

View reviewed changes

hvitved added 3 commits October 27, 2025 19:56

Rust: More type inference tests

63d9b71

dbg

f2e71fd

dbg2

40f17d0

github-advanced-security bot found potential problems Oct 27, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Rust: Restrict type propagation into arguments #20683

Rust: Restrict type propagation into arguments #20683

Uh oh!

hvitved commented Oct 23, 2025

Uh oh!

Check warning

Check warning

Check warning

Check warning

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Rust: Restrict type propagation into arguments #20683

Are you sure you want to change the base?

Rust: Restrict type propagation into arguments #20683

Uh oh!

Conversation

hvitved commented Oct 23, 2025

Uh oh!

Check warning

Uh oh!

Check warning

Uh oh!

Check warning

Uh oh!

Check warning

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant