Skip to content

Rust: Distinguish &mut T from &T in type inference #20973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hvitved merged 2 commits into from
Dec 18, 2025
Merged

Rust: Distinguish &mut T from &T in type inference #20973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c6a757
Rust: Distinguish `&mut T` from `&T` in type inference
hvitved Dec 5, 2025
aae6cd9
Address review comments
hvitved Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rust/ql/lib/codeql/rust/dataflow/internal/Node.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ final class ExprArgumentNode extends ArgumentNode, ExprNode {
ExprArgumentNode() {
isArgumentForCall(n, call_, pos_) and
not TypeInference::implicitDeref(n) and
not TypeInference::implicitBorrow(n)
not TypeInference::implicitBorrow(n, _)
}

override predicate isArgumentOf(DataFlowCall call, RustDataFlow::ArgumentPosition pos) {
Expand Down Expand Up @@ -579,7 +579,7 @@ newtype TNode =
TypeInference::implicitDeref(n) and
borrow = false
or
TypeInference::implicitBorrow(n) and
TypeInference::implicitBorrow(n, _) and
borrow = true
} or
TDerefOutNode(DerefExpr de, Boolean isPost) or
Expand Down
1 change: 1 addition & 0 deletions rust/ql/lib/codeql/rust/elements/internal/OperationImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ module Impl {
op = "!" and path = "core::ops::bit::Not" and method = "not" and borrows = 0
or
// Dereference
// todo: handle `core::ops::deref::DerefMut`
op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
Comment on lines +33 to 34
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TODO comment indicates that core::ops::deref::DerefMut is not yet handled. Since this PR introduces distinction between mutable and shared borrows, the dereference operator for mutable references should also be handled to properly support the DerefMut trait, which is used when dereferencing &mut T types. Without this, type inference for operations on mutable references may be incomplete.

Suggested change
// todo: handle `core::ops::deref::DerefMut`
op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
op = "*" and path = "core::ops::deref::Deref" and method = "deref" and borrows = 1
or
op = "*" and path = "core::ops::deref::DerefMut" and method = "deref_mut" and borrows = 1

Copilot uses AI. Check for mistakes.
)
or
Expand Down
15 changes: 10 additions & 5 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,15 +162,20 @@ class ArrayType extends BuiltinType {
override string getDisplayName() { result = "[;]" }
}

/** The builtin reference type `&T`. */
class RefType extends BuiltinType {
RefType() { this.getName() = "Ref" }
/** A builtin reference type `&T` or `&mut T`. */
abstract private class RefTypeImpl extends BuiltinType { }

final class RefType = RefTypeImpl;

/** The builtin shared reference type `&T`. */
class RefSharedType extends RefTypeImpl {
RefSharedType() { this.getName() = "Ref" }

override string getDisplayName() { result = "&" }
}

/** The builtin reference type `&mut T`. */
class RefMutType extends BuiltinType {
/** The builtin mutable reference type `&mut T`. */
class RefMutType extends RefTypeImpl {
RefMutType() { this.getName() = "RefMut" }

override string getDisplayName() { result = "&mut" }
Expand Down
8 changes: 6 additions & 2 deletions rust/ql/lib/codeql/rust/internal/PathResolution.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -771,8 +771,12 @@ private TypeItemNode resolveBuiltin(TypeRepr tr) {
tr instanceof ArrayTypeRepr and
result instanceof Builtins::ArrayType
or
tr instanceof RefTypeRepr and
result instanceof Builtins::RefType
tr =
any(RefTypeRepr rtr |
if rtr.isMut()
then result instanceof Builtins::RefMutType
else result instanceof Builtins::RefSharedType
)
or
tr.(PtrTypeRepr).isConst() and
result instanceof Builtins::PtrConstType
Expand Down
29 changes: 19 additions & 10 deletions rust/ql/lib/codeql/rust/internal/Type.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,21 +224,30 @@ TypeParamTypeParameter getArrayTypeParameter() {
result = any(ArrayType t).getPositionalTypeParameter(0)
}

/**
* A reference type.
*
* Reference types like `& i64` are modeled as normal generic types
* with a single type argument.
*/
class RefType extends StructType {
RefType() { this.getStruct() instanceof Builtins::RefType }
abstract class RefType extends StructType { }

class RefMutType extends RefType {
RefMutType() { this.getStruct() instanceof Builtins::RefMutType }

override string toString() { result = "&mut" }
}

class RefSharedType extends RefType {
RefSharedType() { this.getStruct() instanceof Builtins::RefSharedType }

override string toString() { result = "&" }
}

pragma[nomagic]
TypeParamTypeParameter getRefTypeParameter() {
result = any(RefType t).getPositionalTypeParameter(0)
RefType getRefType(boolean isMutable) {
isMutable = true and result instanceof RefMutType
or
isMutable = false and result instanceof RefSharedType
}

pragma[nomagic]
TypeParamTypeParameter getRefTypeParameter(boolean isMutable) {
result = getRefType(isMutable).getPositionalTypeParameter(0)
}

/**
Expand Down
Loading
Loading