Merge pull request #19995 from hvitved/rust/disambiguate-assoc-function-calls

Rust: Disambiguate associated function calls

Author: hvitved

rust/ql/lib/change-notes/2025-07-10-assoc-func-disambiguation.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Call resolution for calls to associated functions has been improved, so it now disambiguates the targets based on type information at the call sites (either type information about the arguments or about the expected return types).

rust/ql/lib/codeql/rust/elements/internal/CallExprBaseImpl.qll

@@ -13,6 +13,7 @@ private import codeql.rust.elements.Resolvable
  */
 module Impl {
   private import rust
+  private import codeql.rust.internal.TypeInference as TypeInference
 
   pragma[nomagic]
   Resolvable getCallResolvable(CallExprBase call) {
@@ -27,7 +28,7 @@ module Impl {
    */
   class CallExprBase extends Generated::CallExprBase {
     /** Gets the static target of this call, if any. */
-    Callable getStaticTarget() { none() } // overridden by subclasses, but cannot be made abstract
+    final Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     override Expr getArg(int index) { result = this.getArgList().getArg(index) }
   }

rust/ql/lib/codeql/rust/elements/internal/CallExprImpl.qll

@@ -14,7 +14,6 @@ private import codeql.rust.elements.PathExpr
 module Impl {
   private import rust
   private import codeql.rust.internal.PathResolution as PathResolution
-  private import codeql.rust.internal.TypeInference as TypeInference
 
   pragma[nomagic]
   Path getFunctionPath(CallExpr ce) { result = ce.getFunction().(PathExpr).getPath() }
@@ -37,15 +36,6 @@ module Impl {
   class CallExpr extends Generated::CallExpr {
     override string toStringImpl() { result = this.getFunction().toAbbreviatedString() + "(...)" }
 
-    override Callable getStaticTarget() {
-      // If this call is to a trait method, e.g., `Trait::foo(bar)`, then check
-      // if type inference can resolve it to the correct trait implementation.
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      not exists(TypeInference::resolveMethodCallTarget(this)) and
-      result = getResolvedFunction(this)
-    }
-
     /** Gets the struct that this call resolves to, if any. */
     Struct getStruct() { result = getResolvedFunction(this) }
 

rust/ql/lib/codeql/rust/elements/internal/CallImpl.qll

@@ -40,6 +40,9 @@ module Impl {
     /** Gets the trait targeted by this call, if any. */
     abstract Trait getTrait();
 
+    /** Holds if this call targets a trait. */
+    predicate hasTrait() { exists(this.getTrait()) }
+
     /** Gets the name of the method called if this call is a method call. */
     abstract string getMethodName();
 
@@ -59,12 +62,7 @@ module Impl {
     Expr getReceiver() { result = this.getArgument(TSelfArgumentPosition()) }
 
     /** Gets the static target of this call, if any. */
-    Function getStaticTarget() {
-      result = TypeInference::resolveMethodCallTarget(this)
-      or
-      not exists(TypeInference::resolveMethodCallTarget(this)) and
-      result = this.(CallExpr).getStaticTarget()
-    }
+    Function getStaticTarget() { result = TypeInference::resolveCallTarget(this) }
 
     /** Gets a runtime target of this call, if any. */
     pragma[nomagic]
@@ -78,23 +76,44 @@ module Impl {
     }
   }
 
+  private predicate callHasQualifier(CallExpr call, Path path, Path qualifier) {
+    path = call.getFunction().(PathExpr).getPath() and
+    qualifier = path.getQualifier()
+  }
+
+  private predicate callHasTraitQualifier(CallExpr call, Trait qualifier) {
+    exists(RelevantPath qualifierPath |
+      callHasQualifier(call, _, qualifierPath) and
+      qualifier = resolvePath(qualifierPath) and
+      // When the qualifier is `Self` and resolves to a trait, it's inside a
+      // trait method's default implementation. This is not a dispatch whose
+      // target is inferred from the type of the receiver, but should always
+      // resolve to the function in the trait block as path resolution does.
+      not qualifierPath.isUnqualified("Self")
+    )
+  }
+
   /** Holds if the call expression dispatches to a method. */
-  private predicate callIsMethodCall(CallExpr call, Path qualifier, string methodName) {
+  private predicate callIsMethodCall(
+    CallExpr call, Path qualifier, string methodName, boolean selfIsRef
+  ) {
     exists(Path path, Function f |
-      path = call.getFunction().(PathExpr).getPath() and
+      callHasQualifier(call, path, qualifier) and
       f = resolvePath(path) and
-      f.getParamList().hasSelfParam() and
-      qualifier = path.getQualifier() and
-      path.getSegment().getIdentifier().getText() = methodName
+      path.getSegment().getIdentifier().getText() = methodName and
+      exists(SelfParam self |
+        self = f.getParamList().getSelfParam() and
+        if self.isRef() then selfIsRef = true else selfIsRef = false
+      )
     )
   }
 
-  private class CallExprCall extends Call instanceof CallExpr {
-    CallExprCall() { not callIsMethodCall(this, _, _) }
+  class CallExprCall extends Call instanceof CallExpr {
+    CallExprCall() { not callIsMethodCall(this, _, _, _) }
 
     override string getMethodName() { none() }
 
-    override Trait getTrait() { none() }
+    override Trait getTrait() { callHasTraitQualifier(this, result) }
 
     override predicate implicitBorrowAt(ArgumentPosition pos, boolean certain) { none() }
 
@@ -103,22 +122,23 @@ module Impl {
     }
   }
 
-  private class CallExprMethodCall extends Call instanceof CallExpr {
+  class CallExprMethodCall extends Call instanceof CallExpr {
     Path qualifier;
     string methodName;
+    boolean selfIsRef;
+
+    CallExprMethodCall() { callIsMethodCall(this, qualifier, methodName, selfIsRef) }
 
-    CallExprMethodCall() { callIsMethodCall(this, qualifier, methodName) }
+    /**
+     * Holds if this call must have an explicit borrow for the `self` argument,
+     * because the corresponding parameter is `&self`. Explicit borrows are not
+     * needed when using method call syntax.
+     */
+    predicate hasExplicitSelfBorrow() { selfIsRef = true }
 
     override string getMethodName() { result = methodName }
 
-    override Trait getTrait() {
-      result = resolvePath(qualifier) and
-      // When the qualifier is `Self` and resolves to a trait, it's inside a
-      // trait method's default implementation. This is not a dispatch whose
-      // target is inferred from the type of the receiver, but should always
-      // resolve to the function in the trait block as path resolution does.
-      qualifier.toString() != "Self"
-    }
+    override Trait getTrait() { callHasTraitQualifier(this, result) }
 
     override predicate implicitBorrowAt(ArgumentPosition pos, boolean certain) { none() }
 

rust/ql/lib/codeql/rust/elements/internal/MethodCallExprImpl.qll

@@ -6,8 +6,6 @@
 
 private import rust
 private import codeql.rust.elements.internal.generated.MethodCallExpr
-private import codeql.rust.internal.PathResolution
-private import codeql.rust.internal.TypeInference
 
 /**
  * INTERNAL: This module contains the customizable definition of `MethodCallExpr` and should not
@@ -23,8 +21,6 @@ module Impl {
    * ```
    */
   class MethodCallExpr extends Generated::MethodCallExpr {
-    override Function getStaticTarget() { result = resolveMethodCallTarget(this) }
-
     private string toStringPart(int index) {
       index = 0 and
       result = this.getReceiver().toAbbreviatedString()

rust/ql/lib/codeql/rust/internal/Type.qll

@@ -425,6 +425,8 @@ final class TraitTypeAbstraction extends TypeAbstraction, Trait {
     result.(TypeParamTypeParameter).getTypeParam() = this.getGenericParamList().getATypeParam()
     or
     result.(AssociatedTypeTypeParameter).getTrait() = this
+    or
+    result.(SelfTypeParameter).getTrait() = this
   }
 }