Method call resolution in QL

Author: hvitved

swift/ql/lib/codeql/swift/typeinference/TypeInference.qll

@@ -123,7 +123,7 @@ import M2
 private module Input3 implements InputSig3 {
   private import swift as Swift
 
-  predicate cachedStageRevRef() { none() }
+  predicate cachedStageRevRef() { MethodCallResolution::resolveMethodCall(_, _) implies any() }
 
   predicate inferType = M3::inferType/2;
 
@@ -135,6 +135,8 @@ private module Input3 implements InputSig3 {
 
   TypeMention getTypeAnnotation(AstNode n) {
     result.(ParamDeclTypeMention).getDecl() = n
+    or
+    result.(TypedPatternTypeMention).getPattern() = n
     // todo: more cases, like local variables with explicit type annotations and casts
   }
 
@@ -264,9 +266,8 @@ private module Input3 implements InputSig3 {
     Callable getTargetCertain() { none() }
 
     Callable getTarget(CallResolutionContext ctx) {
-      // todo: implement in QL
-      result = this.getStaticTarget() and
-      exists(ctx)
+      exists(ctx) and
+      result = getCallTarget(this)
     }
   }
 
@@ -278,8 +279,13 @@ private module Input3 implements InputSig3 {
     result = M3::inferCallArgumentTypeTopDown(_, _, _, n, path)
   }
 
-  predicate inferStepSymmetric(AstNode n1, TypePath prefix1, AstNode n2, TypePath prefix2) {
-    none()
+  predicate inferStepSymmetric(AstNode n1, TypePath path1, AstNode n2, TypePath path2) {
+    path1.isEmpty() and
+    path2.isEmpty() and
+    exists(Variable v |
+      n1 = v.getParentPattern() and
+      n2 = v.getDefiningNode()
+    )
   }
 
   predicate inferStep(AstNode n1, TypePath path1, AstNode n2, TypePath path2) {
@@ -318,6 +324,68 @@ predicate inferType = M3::inferType/2;
 
 predicate inferTypeCertain = M3::inferTypeCertain/2;
 
+private module MethodCallResolution {
+  private class MethodCall extends MethodCallExpr {
+    pragma[nomagic]
+    predicate hasInfo(string name, int arity) {
+      name =
+        this.getFunction()
+            .(MethodLookupExpr)
+            .getMethodRef()
+            .(DeclRefExpr)
+            .getDecl()
+            .(Method)
+            .getName() and
+      arity = this.getNumberOfArguments()
+    }
+
+    Type getTypeAt(TypePath path) { result = inferType(this.getQualifier(), path) }
+  }
+
+  pragma[nomagic]
+  private predicate methodInfo(Method m, string name, int arity, ParamDeclTypeMention selfType) {
+    name = m.getName() and
+    arity = m.getNumberOfParams() and
+    selfType.getDecl() = m.getSelfParam()
+  }
+
+  private module MethodCallQualifierSatisfiesSelfTypeInput implements
+    SatisfiesConstraintInputSig<MethodCall, TypeMention>
+  {
+    pragma[nomagic]
+    predicate relevantConstraint(MethodCall call, TypeMention constraint) {
+      exists(string name, int arity |
+        call.hasInfo(name, arity) and
+        methodInfo(_, name, arity, constraint)
+      )
+    }
+  }
+
+  private module MethodCallQualifierSatisfiesSelfType =
+    SatisfiesConstraint<MethodCall, TypeMention, MethodCallQualifierSatisfiesSelfTypeInput>;
+
+  cached
+  predicate resolveMethodCall(MethodCallExpr call, Method m) {
+    M3::CachedStage::ref() and
+    exists(ParamDeclTypeMention selfType |
+      MethodCallQualifierSatisfiesSelfType::satisfiesConstraint(call, selfType, _, _) and
+      methodInfo(m, _, _, selfType)
+    )
+  }
+}
+
+Callable getCallTarget(CallExpr call) {
+  MethodCallResolution::resolveMethodCall(call, result)
+  or
+  // todo: implement in QL
+  result = call.getStaticTarget() and
+  (
+    not call instanceof MethodCallExpr
+    or
+    result instanceof Initializer
+  )
+}
+
 module Consistency {
   import M2::Consistency
 }

swift/ql/lib/codeql/swift/typeinference/TypeMention.qll

@@ -45,7 +45,8 @@ newtype TTypeMention =
   TTypeDeclBaseTypeMention(TypeDecl decl, int i) { exists(decl.getInheritedType(i)) } or
   TExtensionDeclBaseTypeMention(ExtensionDecl decl, int i) { exists(decl.getProtocol(i)) } or
   TParamDeclTypeMention(ParamDecl decl) or
-  TCallableReturnTypeMention(Callable c)
+  TCallableReturnTypeMention(Callable c) or
+  TTypedPatternTypeMention(TypedPattern p)
 
 /** An AST node that may mention a type. */
 abstract private class TypeMentionImpl extends TTypeMention {
@@ -164,3 +165,17 @@ class CallableReturnTypeMention extends TypeMentionImpl, TCallableReturnTypeMent
 
   override Location getLocation() { result = c.getLocation() }
 }
+
+class TypedPatternTypeMention extends TypeMentionImpl, TTypedPatternTypeMention {
+  TypedPattern p;
+
+  TypedPatternTypeMention() { this = TTypedPatternTypeMention(p) }
+
+  TypedPattern getPattern() { result = p }
+
+  override Type getTypeAt(TypePath path) { result = getTypeAt(p.getType(), path) }
+
+  override string toString() { result = p.toString() + " [pattern type]" }
+
+  override Location getLocation() { result = p.getLocation() }
+}

swift/ql/test/library-tests/type-inference/Common.qll

@@ -20,32 +20,12 @@ private SingleLineComment getPrecedingComment(Decl d) {
   )
 }
 
-module ResolveTest implements TestSig {
-  string getARelevantTag() { result = "target" }
-
-  private predicate declHasName(Decl c, string value) {
-    exists(string s |
-      s = getPrecedingComment(c).getText() and
-      value = s.substring(3, s.length() - 1)
-    )
-    or
-    not exists(getPrecedingComment(c)) and
-    value = [c.(EnumElementDecl).getName(), c.(Function).getName()]
-  }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(AstNode source, Decl target |
-      location = source.getLocation() and
-      element = source.toString() and
-      target =
-        [
-          source.(CallExpr).getStaticTarget().(Decl), source.(MethodLookupExpr).getMember(),
-          source.(EnumElementPattern).getElement()
-        ] and
-      declHasName(target, value) and
-      tag = "target" and
-      toBeTested(source) and
-      toBeTested(target)
-    )
-  }
+predicate declHasName(Decl c, string value) {
+  exists(string s |
+    s = getPrecedingComment(c).getText() and
+    value = s.substring(3, s.length() - 1)
+  )
+  or
+  not exists(getPrecedingComment(c)) and
+  value = [c.(EnumElementDecl).getName(), c.(Function).getName()]
 }