Merge pull request #20973 from hvitved/rust/type-inference-distinguish-mut-ref

Rust: Distinguish `&mut T` from `&T` in type inference

Author: hvitved

rust/ql/lib/codeql/rust/dataflow/internal/Node.qll

@@ -230,7 +230,7 @@ final class ExprArgumentNode extends ArgumentNode, ExprNode {
   ExprArgumentNode() {
     isArgumentForCall(n, call_, pos_) and
     not TypeInference::implicitDeref(n) and
-    not TypeInference::implicitBorrow(n)
+    not TypeInference::implicitBorrow(n, _)
   }
 
   override predicate isArgumentOf(DataFlowCall call, RustDataFlow::ArgumentPosition pos) {
@@ -579,7 +579,7 @@ newtype TNode =
     TypeInference::implicitDeref(n) and
     borrow = false
     or
-    TypeInference::implicitBorrow(n) and
+    TypeInference::implicitBorrow(n, _) and
     borrow = true
   } or
   TDerefOutNode(DerefExpr de, Boolean isPost) or

rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll

@@ -30,6 +30,7 @@ module Impl {
       op = "!" and path = "core::ops::bit::Not" and method = "not" and borrows = 0
       or
       // Dereference
+      // todo: handle `core::ops::deref::DerefMut`
       op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
     )
     or

rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll

@@ -162,15 +162,20 @@ class ArrayType extends BuiltinType {
   override string getDisplayName() { result = "[;]" }
 }
 
-/** The builtin reference type `&T`. */
-class RefType extends BuiltinType {
-  RefType() { this.getName() = "Ref" }
+/** A builtin reference type `&T` or `&mut T`. */
+abstract private class RefTypeImpl extends BuiltinType { }
+
+final class RefType = RefTypeImpl;
+
+/** The builtin shared reference type `&T`. */
+class RefSharedType extends RefTypeImpl {
+  RefSharedType() { this.getName() = "Ref" }
 
   override string getDisplayName() { result = "&" }
 }
 
-/** The builtin reference type `&mut T`. */
-class RefMutType extends BuiltinType {
+/** The builtin mutable reference type `&mut T`. */
+class RefMutType extends RefTypeImpl {
   RefMutType() { this.getName() = "RefMut" }
 
   override string getDisplayName() { result = "&mut" }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr) {
   tr instanceof ArrayTypeRepr and
   result instanceof Builtins::ArrayType
   or
-  tr instanceof RefTypeRepr and
-  result instanceof Builtins::RefType
+  tr =
+    any(RefTypeRepr rtr |
+      if rtr.isMut()
+      then result instanceof Builtins::RefMutType
+      else result instanceof Builtins::RefSharedType
+    )
   or
   tr.(PtrTypeRepr).isConst() and
   result instanceof Builtins::PtrConstType

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -224,21 +224,30 @@ TypeParamTypeParameter getArrayTypeParameter() {
   result = any(ArrayType t).getPositionalTypeParameter(0)
 }
 
-/**
- * A reference type.
- *
- * Reference types like `& i64` are modeled as normal generic types
- * with a single type argument.
- */
-class RefType extends StructType {
-  RefType() { this.getStruct() instanceof Builtins::RefType }
+abstract class RefType extends StructType { }
+
+class RefMutType extends RefType {
+  RefMutType() { this.getStruct() instanceof Builtins::RefMutType }
+
+  override string toString() { result = "&mut" }
+}
+
+class RefSharedType extends RefType {
+  RefSharedType() { this.getStruct() instanceof Builtins::RefSharedType }
 
   override string toString() { result = "&" }
 }
 
 pragma[nomagic]
-TypeParamTypeParameter getRefTypeParameter() {
-  result = any(RefType t).getPositionalTypeParameter(0)
+RefType getRefType(boolean isMutable) {
+  isMutable = true and result instanceof RefMutType
+  or
+  isMutable = false and result instanceof RefSharedType
+}
+
+pragma[nomagic]
+TypeParamTypeParameter getRefTypeParameter(boolean isMutable) {
+  result = getRefType(isMutable).getPositionalTypeParameter(0)
 }
 
 /**