rustc_lint/ferrocene/

thir.rs

//! Run a pre-mono THIR pass on the current crate.
//! In THIR, all operator overloads have been resolved to a function call, but we still may have
//! uninstantiated generic functions.
//!
//! This exists to give useful diagnostics without having to wait all the way until monomorphization
//! to give any feedback at all. This matters a lot for core, which has a bunch of generic
//! functions.
//!
//! This pass works an item-at-a-time, with little shared state.

use std::ops::ControlFlow;

use rustc_hir::def_id::{DefId, LocalDefId};
use rustc_hir::{HirId, LangItem, OwnerId};
use rustc_middle::thir::visit::Visitor as _;
use rustc_middle::thir::{self, Thir};
use rustc_middle::ty::adjustment::PointerCoercion;
use rustc_middle::ty::{
    self, Binder, ExistentialTraitRef, GenericArgs, Instance, Ty, TyCtxt, TypeSuperVisitable as _,
    TypeVisitable as _, TypeVisitor, TypingEnv,
};
use rustc_span::Span;
use tracing::{debug, info};

use crate::ferrocene::{InstantiateResult, LintState, UnvalidatedImplCause, Use, UseKind};

pub(super) struct LintThir<'thir, 'tcx> {
    thir: &'thir Thir<'tcx>,
    linter: LintState<'tcx>,
    owner: OwnerId,
}

impl<'thir, 'tcx: 'thir> thir::visit::Visitor<'thir, 'tcx> for LintThir<'thir, 'tcx> {
    fn thir(&self) -> &'thir Thir<'tcx> {
        self.thir
    }

    fn visit_expr(&mut self, expr: &'thir thir::Expr<'tcx>) {
        let use_ = match self.find_unvalidated_use(expr) {
            None => return,
            // Didn't have all the generic parameters in scope.
            // This will be caught later by the post-mono pass.
            Some(Use {
                kind: UseKind::TraitObjectCast(UnvalidatedImplCause::UnresolvedGenericImpl(..), _),
                ..
            }) => return,
            Some(use_) => use_,
        };
        let hir_id = HirId { owner: self.owner, local_id: expr.temp_scope_id };
        debug!("id={hir_id:?}, kind={:?}", expr.kind);
        self.linter.check_use(hir_id, use_);
    }
}

impl<'thir, 'tcx: 'thir> LintThir<'thir, 'tcx> {
    /// Entrypoint.
    ///
    /// We need a separate `owner` to be able to synthesize `HirId`s from expression IDs.
    /// `item` might not be an owner if it's a closure.
    pub(super) fn check_item(tcx: TyCtxt<'tcx>, owner: OwnerId, item: LocalDefId) -> Option<()> {
        tracing::trace!("checking {item:?}");

        if tcx.sess.opts.test
            && tcx.entry_fn(()).and_then(|(id, _)| id.as_local()) == Some(owner.def_id)
        {
            // We don't lint `main` functions if they're a shim generated by the `--test` machinery.
            info!("treating libtest main function as unvalidated");
            return None;
        }

        let linter = LintState::new(tcx, item)?;
        // thir_body can return ErrorGuaranteed if this is a const block that failed evaluation.
        let body = tcx.thir_body(item).ok();
        if body.is_none() {
            info!("skipping item {item:?} without body");
        }
        let thir = &body?.0.borrow();
        let mut visitor = LintThir { linter, thir, owner };
        for expr in &*thir.exprs {
            visitor.visit_expr(expr);
        }

        Some(())
    }

    fn find_unvalidated_use(&mut self, expr: &thir::Expr<'tcx>) -> Option<Use<'tcx>> {
        let tcx = self.linter.tcx;
        let mut span = expr.span;

        let mut try_instantiate = |def_id, args| self.try_instantiate(def_id, args, span);

        let use_kind = match expr.kind {
            thir::ExprKind::NamedConst { def_id, .. }
            | thir::ExprKind::StaticRef { def_id, .. } => {
                // Statics and constants have bodies, but they are always evaluated at compile time.
                // We argue to our assessor that means that the correct behavior is
                // validated whenever the const/static is used in a runtime function, so the
                // functions that generate the constant don't need to be tested separately.
                // The constants themselves execute no code at runtime, so mentioning them is ok.
                let unknown_fn = contains_unknown_fn(expr.ty)?;
                // However, it's possible for runtime code to access an unknown function type from
                // this constant. Ensure that it's marked with `prevalidated` so that its body gets
                // checked.
                UseKind::ContainsFnPtr(def_id, unknown_fn)
            }
            thir::ExprKind::Call { ty, .. } => {
                let instance = self.instance_of_ty_ignoring_validated(ty, expr.span)?;
                // we use a custom narrowed span here. it's the receiver that's unvalidated, not the
                // arguments.
                span = tcx.sess.source_map().span_until_char(expr.span, '(');

                debug!("saw call to {instance:?}");
                UseKind::Called(instance)
            }
            // We assume all closure definitions in this function are also validated.
            // However, we still need to check the closure body to make sure it doesn't call
            // unvalidated functions.
            thir::ExprKind::Closure(ref expr) => {
                // Closures are never an owner, so we need to hang onto the original owner so that
                // our synthesized HirIds are valid.
                LintThir::check_item(tcx, self.owner, expr.closure_id);
                return None;
            }
            thir::ExprKind::PointerCoercion {
                // NOTE: we intentionally don't check closure casts.
                cast: PointerCoercion::ReifyFnPointer(_),
                source,
                ..
            } => {
                let source_ty = self.thir[source].ty;
                let fn_ptr_trait = tcx.require_lang_item(LangItem::FnPtrTrait, expr.span);
                let trait_ref = Binder::dummy(ExistentialTraitRef::new_from_args(
                    tcx,
                    fn_ptr_trait,
                    GenericArgs::empty(),
                ));
                self.linter.check_fn_ptr_coercion(
                    source_ty,
                    trait_ref.with_self_ty(tcx, source_ty),
                    &mut try_instantiate,
                    expr.span,
                )?
            }
            thir::ExprKind::PointerCoercion { cast: PointerCoercion::Unsize, source, .. } => {
                let source_ty = self.thir[source].ty;
                self.linter.check_dyn_trait_coercion(
                    expr.ty,
                    source_ty,
                    self.typing_env(),
                    &mut try_instantiate,
                    span,
                )?
            }
            // Nothing to check.
            _ => return None,
        };

        Some(Use { kind: use_kind, span, from_instantiation: None })
    }

    fn instance_of_ty_ignoring_validated(
        &self,
        ty: Ty<'tcx>,
        span: Span,
    ) -> Option<Instance<'tcx>> {
        let mut try_instantiate = |def_id, args| self.try_instantiate(def_id, args, span);

        self.linter.instance_of_ty(ty, None, &mut try_instantiate, span).filter(|instance| {
            // Skip trait functions. These happen when we're calling the vtable of a `dyn` unsized
            // object. This case is caught below in `PointerCoercion::Unsize`.
            if matches!(instance.def, ty::InstanceKind::Virtual(..)) {
                info!("skipping dyn assoc item {instance:?}");
                false
            } else {
                true
            }
        })
    }

    fn try_instantiate(
        &self,
        def_id: DefId,
        args: &'tcx GenericArgs<'tcx>,
        span: Span,
    ) -> InstantiateResult<'tcx> {
        let tcx = self.linter.tcx;
        match Instance::try_resolve(tcx, self.typing_env(), def_id, args) {
            Err(_) => {
                // this happens when we hit the
                // [type length limit](https://doc.rust-lang.org/reference/attributes/limits.html#the-type_length_limit-attribute)
                tcx.dcx().span_delayed_bug(
                    span,
                    format!("could not resolve instance ({def_id:?}, {args:?})"),
                );
                InstantiateResult::Err
            }
            Ok(None) => InstantiateResult::Indeterminate,
            Ok(Some(instance)) => InstantiateResult::Resolved(instance),
        }
    }

    fn typing_env(&self) -> TypingEnv<'tcx> {
        use rustc_middle::ty::TypingMode;
        let tcx = self.linter.tcx;

        let typing_mode = TypingMode::typeck_for_body(tcx, self.linter.item);
        let param_env = tcx.param_env(self.linter.item);
        TypingEnv::new(param_env, typing_mode)
    }
}

/// Used to check whether a `const` or `static` has a function pointer callable at runtime.
///
/// c.f. Ty::contains_closure
fn contains_unknown_fn<'tcx>(ty: Ty<'tcx>) -> Option<Ty<'tcx>> {
    struct ContainsUnknownFnVisitor;

    impl<'tcx> TypeVisitor<TyCtxt<'tcx>> for ContainsUnknownFnVisitor {
        type Result = ControlFlow<Ty<'tcx>>;

        fn visit_ty(&mut self, t: Ty<'tcx>) -> Self::Result {
            match t.kind() {
                ty::Dynamic(..) | ty::FnPtr(_, _) => ControlFlow::Break(t),
                _ => t.super_visit_with(self),
            }
        }
    }

    let cf = ty.visit_with(&mut ContainsUnknownFnVisitor);
    cf.break_value()
}