Rust: Fix context-based type inference explosion #21217
Draft
+152
−116
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
71ee1c9 to
38929dd
Compare
38929dd to
50ce393
Compare
hvitved
commented
Jan 27, 2026
Comment on lines
+1002
to
1003
| hasTypeConstraint(tt, constraint) and | ||
| t = getTypeAt(tt, path) |
Contributor
Author
There was a problem hiding this comment.
This conjunction has non-linear recursion, hence the magic'ed version of hasTypeConstraint.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a type inference explosion issue in Rust queries by correcting two bugs in the type inference implementation:
- Path resolution bug: Changed
getASuccessor(_)togetAnAssocItem()to correctly resolve trait functions only from the trait itself, not from sub-traits - Context-based return type checking: Enhanced the logic to only use return type for disambiguation when all argument positions are trivially satisfied
Changes:
- Fixed trait function resolution to prevent matching sub-trait implementations
- Added logic to check return type matches calling context for polymorphic functions
- Refactored Input modules into a unified structure
- Added regression test for the
Default::default()andFrom::from()pattern
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| shared/typeinference/codeql/typeinference/internal/TypeInference.qll | Added helper predicate with pragma[nomagic] to optimize type constraint checking |
| rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll | Fixed getASuccessor → getAnAssocItem bug, merged Input modules, fixed parameter ordering in context typing |
| rust/ql/lib/codeql/rust/internal/typeinference/FunctionOverloading.qll | Split predicate and added return type disambiguation logic |
| rust/ql/test/library-tests/type-inference/main.rs | Added regression test for from_default module |
| rust/ql/test/library-tests/type-inference/type-inference.expected | Updated expected test output |
| rust/ql/test/query-tests/security/CWE-312/CONSISTENCY/PathResolutionConsistency.expected | Removed spurious multiple resolution error |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following simple program would make our type inference implementation explode:
Firstly, because of a
getSuccessorvsgetAssocItembug,From::fromwould allow for any sub trait ofFrom, for example theInttrait, which meant thatxcould be inferred to have typebool. Secondly, since manyfromimplementations are polymorphic in their argument, we should really be checking that the return type matches the type of the calling context.This PR makes those two adjustments, and adds the regression test.
DCA looks good; we loose some call edges, but nothing too serious.