Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions rust/ql/lib/codeql/rust/frameworks/stdlib/Builtins.qll
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,13 @@ private class BuiltinsTypesFile extends File {
}
}

private class BuiltinsImplsFile extends File {
BuiltinsImplsFile() {
this.getBaseName() = "impls.rs" and
this.getParentContainer() instanceof BuiltinsFolder
}
}

/**
* A builtin type, such as `bool` and `i32`.
*
Expand Down Expand Up @@ -221,3 +228,8 @@ class TupleType extends BuiltinType {
)
}
}

/** A builtin implementation. */
class BuiltinImpl extends Impl {
BuiltinImpl() { this.getFile() instanceof BuiltinsImplsFile }
}
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
*/

private import rust
private import codeql.rust.frameworks.stdlib.Builtins as Builtins
private import codeql.rust.frameworks.stdlib.Stdlib
private import codeql.rust.internal.PathResolution
private import Type
private import TypeAbstraction
Expand Down Expand Up @@ -94,6 +96,14 @@ private module MkSiblingImpls<resolveTypeMentionAtSig/2 resolveTypeMentionAt> {
not t1 instanceof TypeParameter or
not t2 instanceof TypeParameter
)
or
// todo: handle blanket/non-blanket siblings in `implSiblings`
trait =
any(IndexTrait it |
implSiblingCandidate(impl, it, _, _) and
impl instanceof Builtins::BuiltinImpl and
path = TypePath::singleton(TAssociatedTypeTypeParameter(trait, it.getOutputType()))
)
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3663,43 +3663,6 @@ private Type inferArrayExprType(ArrayExpr ae) { exists(ae) and result instanceof
pragma[nomagic]
private Type inferRangeExprType(RangeExpr re) { result = TDataType(getRangeType(re)) }

/**
* According to [the Rust reference][1]: _"array and slice-typed expressions
* can be indexed with a `usize` index ... For other types an index expression
* `a[b]` is equivalent to *std::ops::Index::index(&a, b)"_.
*
* The logic below handles array and slice indexing, but for other types it is
* currently limited to `Vec`.
*
* [1]: https://doc.rust-lang.org/reference/expressions/array-expr.html#r-expr.array.index
*/
pragma[nomagic]
private Type inferIndexExprType(IndexExpr ie, TypePath path) {
// TODO: Method resolution to the `std::ops::Index` trait can handle the
// `Index` instances for slices and arrays.
exists(TypePath exprPath, Builtins::BuiltinType t |
TDataType(t) = inferType(ie.getIndex()) and
(
// also allow `i32`, since that is currently the type that we infer for
// integer literals like `0`
t instanceof Builtins::I32
or
t instanceof Builtins::Usize
) and
result = inferType(ie.getBase(), exprPath)
|
// todo: remove?
exprPath.isCons(TTypeParamTypeParameter(any(Vec v).getElementTypeParam()), path)
or
exprPath.isCons(getArrayTypeParameter(), path)
or
exists(TypePath path0 |
exprPath.isCons(getRefTypeParameter(_), path0) and
path0.isCons(getSliceTypeParameter(), path)
)
)
}

pragma[nomagic]
private Type getInferredDerefType(DerefExpr de, TypePath path) { result = inferType(de, path) }

Expand Down Expand Up @@ -3902,7 +3865,8 @@ private module Cached {
i instanceof ImplItemNode and dispatch = false
|
result = call.(AssocFunctionResolution::AssocFunctionCall).resolveCallTarget(i, _, _, _) and
not call instanceof CallExprImpl::DynamicCallExpr
not call instanceof CallExprImpl::DynamicCallExpr and
not i instanceof Builtins::BuiltinImpl
)
}

Expand Down Expand Up @@ -4004,8 +3968,6 @@ private module Cached {
or
result = inferAwaitExprType(n, path)
or
result = inferIndexExprType(n, path)
or
result = inferDereferencedExprPtrType(n, path)
or
result = inferForLoopExprType(n, path)
Expand Down
134 changes: 134 additions & 0 deletions rust/tools/builtins/impls.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
/// Contains type-specialized versions of
///
/// ```
/// impl<T, I, const N: usize> Index<I> for [T; N]
/// where
/// [T]: Index<I>,
/// {
/// type Output = <[T] as Index<I>>::Output;
/// ...
/// }
/// ```
///
/// and
///
/// ```
/// impl<T, I> ops::Index<I> for [T]
/// where
/// I: SliceIndex<[T]>,
/// {
/// type Output = I::Output;
/// ...
/// }
/// ```
///
/// and
/// ```
/// impl<T, I: SliceIndex<[T]>, A: Allocator> Index<I> for Vec<T, A> {
/// type Output = I::Output;
/// ...
/// }
/// ```
///
/// (as well as their `IndexMut` counterparts), which the type inference library
/// cannot currently handle (we fail to resolve the `Output` types).
mod index_impls {
use std::alloc::Allocator;
use std::ops::Index;

impl<T, const N: usize> Index<i32> for [T; N] {
type Output = T;

fn index(&self, index: i32) -> &Self::Output {
panic!()
}
}

impl<T, const N: usize> IndexMut<i32> for [T; N] {
type Output = T;

fn index_mut(&mut self, index: i32) -> &mut Self::Output {
panic!()
}
}

impl<T, const N: usize> Index<usize> for [T; N] {
type Output = T;

fn index(&self, index: usize) -> &Self::Output {
panic!()
}
}
Comment on lines +39 to +61
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Type inference resolves a[b] to Index::index or IndexMut::index_mut based on whether the index expression is used mutably (e.g. a[b] = ...). These builtins only add Index<...> for arrays, so mutable array indexing may still lack a resolvable Output type. Add corresponding IndexMut<i32>/IndexMut<usize> impls for [T; N] with type Output = T.

This issue also appears in the following locations of the same file:

  • line 55
  • line 71

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch.


impl<T, const N: usize> IndexMut<usize> for [T; N] {
type Output = T;

fn index_mut(&mut self, index: usize) -> &mut Self::Output {
panic!()
}
}

impl<T> Index<i32> for [T] {
type Output = T;

fn index(&self, index: i32) -> &Self::Output {
panic!()
}
}

impl<T> IndexMut<i32> for [T] {
type Output = T;

fn index_mut(&mut self, index: i32) -> &mut Self::Output {
panic!()
}
}

impl<T> Index<usize> for [T] {
type Output = T;

fn index(&self, index: usize) -> &Self::Output {
panic!()
}
}

impl<T> IndexMut<usize> for [T] {
type Output = T;

fn index_mut(&mut self, index: usize) -> &mut Self::Output {
panic!()
}
}

impl<T, A: Allocator> Index<i32> for Vec<T, A> {
type Output = T;

fn index(&self, index: i32) -> &Self::Output {
panic!()
}
}

impl<T, A: Allocator> IndexMut<i32> for Vec<T, A> {
type Output = T;

fn index_mut(&mut self, index: i32) -> &mut Self::Output {
panic!()
}
}

impl<T, A: Allocator> Index<usize> for Vec<T, A> {
type Output = T;

fn index(&self, index: usize) -> &Self::Output {
panic!()
}
}

impl<T, A: Allocator> IndexMut<usize> for Vec<T, A> {
type Output = T;

fn index_mut(&mut self, index: usize) -> &mut Self::Output {
panic!()
}
}
}
Loading