Merge pull request #18385 from michaelnebel/csharp/allowsrefstruct

michaelnebel · web-flow · commit c68b55b957f4 · 2025-01-13T16:04:03.000+01:00
C# 13: Allows ref struct.
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameterConstraints.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameterConstraints.cs
@@ -40,6 +40,12 @@ public override void Populate(TextWriter trapFile)
             if (Symbol.ReferenceTypeConstraintNullableAnnotation == NullableAnnotation.Annotated)
                 trapFile.general_type_parameter_constraints(this, 5);
 
+            if (Symbol.HasNotNullConstraint)
+                trapFile.general_type_parameter_constraints(this, 6);
+
+            if (Symbol.AllowsRefLikeType)
+                trapFile.general_type_parameter_constraints(this, 7);
+
             foreach (var abase in Symbol.GetAnnotatedTypeConstraints())
             {
                 var t = Type.Create(Context, abase.Symbol);
diff --git a/csharp/ql/lib/change-notes/2025-01-03-allow-ref-struct.md b/csharp/ql/lib/change-notes/2025-01-03-allow-ref-struct.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 13: Added extractor support and call dispatch logic (data flow) for the (negative) type parameter constraint `allows ref struct`. Added extractor support for the type parameter constraint `notnull`.
diff --git a/csharp/ql/lib/semmle/code/csharp/Conversion.qll b/csharp/ql/lib/semmle/code/csharp/Conversion.qll
@@ -649,11 +649,14 @@ predicate convBoxing(Type fromType, Type toType) {
 }
 
 private predicate convBoxingValueType(ValueType fromType, Type toType) {
-  toType instanceof ObjectType
-  or
-  toType instanceof DynamicType
-  or
-  toType instanceof SystemValueTypeClass
+  (
+    toType instanceof ObjectType
+    or
+    toType instanceof DynamicType
+    or
+    toType instanceof SystemValueTypeClass
+  ) and
+  not fromType.isRefLikeType()
   or
   toType = fromType.getABaseInterface+()
 }
diff --git a/csharp/ql/lib/semmle/code/csharp/Generics.qll b/csharp/ql/lib/semmle/code/csharp/Generics.qll
@@ -287,6 +287,12 @@ class TypeParameterConstraints extends Element, @type_parameter_constraints {
   /** Holds if these constraints include a nullable reference type constraint. */
   predicate hasNullableRefTypeConstraint() { general_type_parameter_constraints(this, 5) }
 
+  /** Holds if these constraints include a notnull type constraint. */
+  predicate hasNotNullTypeConstraint() { general_type_parameter_constraints(this, 6) }
+
+  /** Holds if these constraints include a `allows ref struct` constraint. */
+  predicate hasAllowRefLikeTypeConstraint() { general_type_parameter_constraints(this, 7) }
+
   /** Gets a textual representation of these constraints. */
   override string toString() { result = "where " + this.getTypeParameter().getName() + ": ..." }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/Type.qll b/csharp/ql/lib/semmle/code/csharp/Type.qll
@@ -48,6 +48,13 @@ class Type extends Member, TypeContainer, @type {
 
   /** Holds if this type is a value type, or a type parameter that is a value type. */
   predicate isValueType() { none() }
+
+  /**
+   * Holds if this type is a ref like type.
+   *
+   * Only `ref struct` types are considered ref like types.
+   */
+  predicate isRefLikeType() { none() }
 }
 
 pragma[nomagic]
@@ -704,15 +711,36 @@ class Enum extends ValueType, @enum_type {
  * ```
  */
 class Struct extends ValueType, @struct_type {
-  /** Holds if this `struct` has a `ref` modifier. */
-  predicate isRef() { this.hasModifier("ref") }
+  /**
+   * DEPRECATED: Use `instanceof RefStruct` instead.
+   *
+   * Holds if this `struct` has a `ref` modifier.
+   */
+  deprecated predicate isRef() { this.hasModifier("ref") }
 
   /** Holds if this `struct` has a `readonly` modifier. */
   predicate isReadonly() { this.hasModifier("readonly") }
 
   override string getAPrimaryQlClass() { result = "Struct" }
 }
 
+/**
+ * A `ref struct`, for example
+ *
+ * ```csharp
+ * ref struct S {
+ *  ...
+ * }
+ * ```
+ */
+class RefStruct extends Struct {
+  RefStruct() { this.hasModifier("ref") }
+
+  override string getAPrimaryQlClass() { result = "RefStruct" }
+
+  override predicate isRefLikeType() { any() }
+}
+
 /**
  * A `record struct`, for example
  * ```csharp
diff --git a/csharp/ql/lib/semmle/code/csharp/Unification.qll b/csharp/ql/lib/semmle/code/csharp/Unification.qll
@@ -522,16 +522,21 @@ module Gvn {
 
 /** Provides definitions related to type unification. */
 module Unification {
-  /** A type parameter that is compatible with any type. */
+  /** A type parameter that is compatible with any type except `ref struct`. */
   class UnconstrainedTypeParameter extends TypeParameter {
-    UnconstrainedTypeParameter() { not exists(getATypeConstraint(this)) }
+    UnconstrainedTypeParameter() {
+      not exists(getATypeConstraint(this)) and not exists(getANegativeTypeConstraint(this))
+    }
   }
 
   /** A type parameter that is constrained. */
   class ConstrainedTypeParameter extends TypeParameter {
     int constraintCount;
 
-    ConstrainedTypeParameter() { constraintCount = strictcount(getATypeConstraint(this)) }
+    ConstrainedTypeParameter() {
+      constraintCount = count(getATypeConstraint(this)) + count(getANegativeTypeConstraint(this)) and
+      constraintCount > 0
+    }
 
     /**
      * Holds if this type parameter is unifiable with type `t`.
@@ -559,29 +564,31 @@ module Unification {
     bindingset[this]
     pragma[inline_late]
     override predicate unifiable(Type t) {
-      exists(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
+      forall(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
         ttc = TRefTypeConstraint() and
         t.isRefType()
         or
         ttc = TValueTypeConstraint() and
         t.isValueType()
         or
         typeConstraintUnifiable(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
 
     bindingset[this]
     pragma[inline_late]
     override predicate subsumes(Type t) {
-      exists(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
+      forall(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
         ttc = TRefTypeConstraint() and
         t.isRefType()
         or
         ttc = TValueTypeConstraint() and
         t.isValueType()
         or
         typeConstraintSubsumes(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
   }
 
@@ -603,7 +610,8 @@ module Unification {
         t.isValueType()
         or
         typeConstraintUnifiable(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
 
     bindingset[this]
@@ -617,7 +625,8 @@ module Unification {
         t.isValueType()
         or
         typeConstraintSubsumes(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
   }
 
@@ -632,6 +641,9 @@ module Unification {
         not t instanceof TypeParameter
       }
 
+    cached
+    newtype TTypeParameterNegativeConstraint = TAllowRefTypeConstraint()
+
     cached
     TTypeParameterConstraint getATypeConstraint(TypeParameter tp) {
       exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
@@ -650,6 +662,14 @@ module Unification {
       )
     }
 
+    cached
+    TTypeParameterNegativeConstraint getANegativeTypeConstraint(TypeParameter tp) {
+      exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
+        tpc.hasAllowRefLikeTypeConstraint() and
+        result = TAllowRefTypeConstraint()
+      )
+    }
+
     cached
     predicate typeConstraintUnifiable(TTypeConstraint ttc, Type t) {
       exists(Type t0 | ttc = TTypeConstraint(t0) | implicitConversionRestricted(t, t0))
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -703,7 +703,7 @@ module LocalFlow {
       or
       t = any(TypeParameter tp | not tp.isValueType())
       or
-      t.(Struct).isRef()
+      t.isRefLikeType()
     ) and
     not exists(getALastEvalNode(result))
   }
diff --git a/csharp/ql/test/library-tests/conversion/boxing/Boxing.cs b/csharp/ql/test/library-tests/conversion/boxing/Boxing.cs
@@ -45,3 +45,6 @@ void M()
         x1 = x15; // not a boxing conversion
     }
 }
+
+// Ref structs can't be converted to a dynamic, object or valuetype.
+ref struct S { }
diff --git a/csharp/ql/test/library-tests/csharp11/PrintAst.expected b/csharp/ql/test/library-tests/csharp11/PrintAst.expected
@@ -847,7 +847,7 @@ RequiredMembers.cs:
 #   40|         0: [Parameter] value
 Scoped.cs:
 #    1| [Struct] S1
-#    2| [Struct] S2
+#    2| [RefStruct] S2
 #    7| [Class] ScopedModifierTest
 #    9|   5: [Method] M1
 #    9|     -1: [TypeMention] int
@@ -1402,7 +1402,7 @@ Strings.cs:
 Struct.cs:
 #    1| [NamespaceDeclaration] namespace ... { ... }
 #    3|   1: [Class] MyEmptyClass
-#    5|   2: [Struct] RefStruct
+#    5|   2: [RefStruct] RefStruct
 #    7|     5: [Field] MyInt
 #    7|       -1: [TypeMention] int
 #    8|     6: [Field] MyByte
diff --git a/csharp/ql/test/library-tests/csharp7.2/PrintAst.expected b/csharp/ql/test/library-tests/csharp7.2/PrintAst.expected
@@ -30,8 +30,8 @@ csharp72.cs:
 #   26|           0: [FieldAccess] access to field s
 #   29|   7: [DelegateType] Del
 #   32| [Struct] ReadonlyStruct
-#   36| [Struct] RefStruct
-#   40| [Struct] ReadonlyRefStruct
+#   36| [RefStruct] RefStruct
+#   40| [RefStruct] ReadonlyRefStruct
 #   44| [Class] NumericLiterals
 #   46|   5: [Field] binaryValue
 #   46|     -1: [TypeMention] int
diff --git a/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql b/csharp/ql/test/library-tests/csharp7.2/RefStructs.ql
@@ -1,7 +1,5 @@
 import csharp
 
-from Struct s
-where
-  s.fromSource() and
-  s.isRef()
+from RefStruct s
+where s.fromSource()
 select s
diff --git a/csharp/ql/test/library-tests/dispatch/CallContext.expected b/csharp/ql/test/library-tests/dispatch/CallContext.expected
@@ -26,3 +26,4 @@ mayBenefitFromCallContext
 | ViableCallable.cs:576:18:576:22 | call to operator / |
 | ViableCallable.cs:579:26:579:30 | call to operator checked / |
 | ViableCallable.cs:585:9:585:15 | call to method M12 |
+| ViableCallable.cs:618:9:618:13 | call to method M |
diff --git a/csharp/ql/test/library-tests/dispatch/CallGraph.expected b/csharp/ql/test/library-tests/dispatch/CallGraph.expected
@@ -259,3 +259,6 @@
 | ViableCallable.cs:555:10:555:15 | Run`1 | ViableCallable.cs:550:40:550:40 | checked / |
 | ViableCallable.cs:555:10:555:15 | Run`1 | ViableCallable.cs:552:17:552:19 | M11 |
 | ViableCallable.cs:555:10:555:15 | Run`1 | ViableCallable.cs:553:17:553:19 | M12 |
+| ViableCallable.cs:609:17:609:23 | Run1`1 | ViableCallable.cs:601:21:601:21 | M |
+| ViableCallable.cs:615:17:615:23 | Run2`1 | ViableCallable.cs:601:21:601:21 | M |
+| ViableCallable.cs:615:17:615:23 | Run2`1 | ViableCallable.cs:606:21:606:21 | M |
diff --git a/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.expected b/csharp/ql/test/library-tests/dispatch/GetADynamicTarget.expected
@@ -505,3 +505,6 @@
 | ViableCallable.cs:585:9:585:15 | call to method M12 | C20.M12() |
 | ViableCallable.cs:585:9:585:15 | call to method M12 | I3<T>.M12() |
 | ViableCallable.cs:588:9:588:15 | call to method M13 | I3<T>.M13() |
+| ViableCallable.cs:612:9:612:13 | call to method M | C21+A1.M() |
+| ViableCallable.cs:618:9:618:13 | call to method M | C21+A1.M() |
+| ViableCallable.cs:618:9:618:13 | call to method M | C21+A2.M() |
diff --git a/csharp/ql/test/library-tests/dispatch/ViableCallable.cs b/csharp/ql/test/library-tests/dispatch/ViableCallable.cs
@@ -588,3 +588,33 @@ void Run<T>(T c) where T : I3<T>
         c.M13();
     }
 }
+
+public class C21
+{
+    public interface I
+    {
+        void M();
+    }
+
+    public class A1 : I
+    {
+        public void M() { }
+    }
+
+    public ref struct A2 : I
+    {
+        public void M() { }
+    }
+
+    public void Run1<T>(T t) where T : I
+    {
+        // Viable callable: A1.M()
+        t.M();
+    }
+
+    public void Run2<T>(T t) where T : I, allows ref struct
+    {
+        // Viable callable: {A1, A2}.M()
+        t.M();
+    }
+}
diff --git a/csharp/ql/test/library-tests/typeparameterconstraints/TypeParameterConstraints.cs b/csharp/ql/test/library-tests/typeparameterconstraints/TypeParameterConstraints.cs
@@ -0,0 +1,19 @@
+using System;
+using System.Collections.Generic;
+
+public class TestClass
+{
+    public void M1<T1>(T1 x) where T1 : class { }
+
+    public void M2<T2>(T2 x) where T2 : struct { }
+
+    public void M3<T3>(T3 x) where T3 : unmanaged { }
+
+    public void M4<T4>(T4 x) where T4 : new() { }
+
+    public void M5<T5>(T5 x) where T5 : notnull { }
+
+    public void M6<T6>(T6 x) where T6 : IList<object> { }
+
+    public void M7<T7>(T7 x) where T7 : allows ref struct { }
+}
diff --git a/csharp/ql/test/library-tests/typeparameterconstraints/typeParameterConstraints.expected b/csharp/ql/test/library-tests/typeparameterconstraints/typeParameterConstraints.expected
@@ -0,0 +1,24 @@
+typeParameterContraints
+| TypeParameterConstraints.cs:6:20:6:21 | T1 | file://:0:0:0:0 | where T1: ... |
+| TypeParameterConstraints.cs:8:20:8:21 | T2 | file://:0:0:0:0 | where T2: ... |
+| TypeParameterConstraints.cs:10:20:10:21 | T3 | file://:0:0:0:0 | where T3: ... |
+| TypeParameterConstraints.cs:12:20:12:21 | T4 | file://:0:0:0:0 | where T4: ... |
+| TypeParameterConstraints.cs:14:20:14:21 | T5 | file://:0:0:0:0 | where T5: ... |
+| TypeParameterConstraints.cs:16:20:16:21 | T6 | file://:0:0:0:0 | where T6: ... |
+| TypeParameterConstraints.cs:18:20:18:21 | T7 | file://:0:0:0:0 | where T7: ... |
+specificParameterConstraints
+| TypeParameterConstraints.cs:16:20:16:21 | T6 | IList<object> |
+hasConstructorConstraint
+| TypeParameterConstraints.cs:12:20:12:21 | T4 | file://:0:0:0:0 | where T4: ... |
+hasRefTypeConstraint
+| TypeParameterConstraints.cs:6:20:6:21 | T1 | file://:0:0:0:0 | where T1: ... |
+hasValueTypeConstraint
+| TypeParameterConstraints.cs:8:20:8:21 | T2 | file://:0:0:0:0 | where T2: ... |
+| TypeParameterConstraints.cs:10:20:10:21 | T3 | file://:0:0:0:0 | where T3: ... |
+hasUnmanagedTypeConstraint
+| TypeParameterConstraints.cs:10:20:10:21 | T3 | file://:0:0:0:0 | where T3: ... |
+hasNullableRefTypeConstraint
+hasNotNullConstraint
+| TypeParameterConstraints.cs:14:20:14:21 | T5 | file://:0:0:0:0 | where T5: ... |
+hasAllowRefLikeTypeConstraint
+| TypeParameterConstraints.cs:18:20:18:21 | T7 | file://:0:0:0:0 | where T7: ... |
diff --git a/csharp/ql/test/library-tests/typeparameterconstraints/typeParameterConstraints.ql b/csharp/ql/test/library-tests/typeparameterconstraints/typeParameterConstraints.ql
diff --git a/csharp/ql/test/library-tests/unification/Unification.cs b/csharp/ql/test/library-tests/unification/Unification.cs
diff --git a/csharp/ql/test/library-tests/unification/Unification.expected b/csharp/ql/test/library-tests/unification/Unification.expected

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: minorAnalysis
 +---
 +* C# 13: Added extractor support and call dispatch logic (data flow) for the (negative) type parameter constraint `allows ref struct`. Added extractor support for the type parameter constraint `notnull`.
Original file line number	Diff line number	Diff line change
`@@ -703,7 +703,7 @@ module LocalFlow {`
`703`	`703`	`or`
`704`	`704`	`t = any(TypeParameter tp \| not tp.isValueType())`
`705`	`705`	`or`
`706`		`- t.(Struct).isRef()`
	`706`	`+ t.isRefLikeType()`
`707`	`707`	`) and`
`708`	`708`	`not exists(getALastEvalNode(result))`
`709`	`709`	`}`
Original file line number	Diff line number	Diff line change
`@@ -45,3 +45,6 @@ void M()`
`45`	`45`	`x1 = x15; // not a boxing conversion`
`46`	`46`	`}`
`47`	`47`	`}`
	`48`	`+`
	`49`	`+// Ref structs can't be converted to a dynamic, object or valuetype.`
	`50`	`+ref struct S { }`