fix some inconsistencies related to primitive types

Author: erik-krogh

ql/src/codeql_ql/ast/Ast.qll

@@ -1551,7 +1551,7 @@ class ExprAggregate extends TExprAggregate, Aggregate {
 
   override Type getType() {
     exists(PrimitiveType prim | prim = result |
-      kind.regexpMatch("(strict)?count|sum|min|max|rank") and
+      kind.regexpMatch("(strict)?count") and
       result.getName() = "int"
       or
       kind.regexpMatch("(strict)?concat") and
@@ -1615,16 +1615,16 @@ class FullAggregate extends TFullAggregate, Aggregate {
 
   override Type getType() {
     exists(PrimitiveType prim | prim = result |
-      kind.regexpMatch("(strict)?(count|sum|min|max|rank)") and
+      kind = ["count", "strictcount"] and
       result.getName() = "int"
       or
       kind.regexpMatch("(strict)?concat") and
       result.getName() = "string"
     )
     or
-    kind = ["any", "min", "max", "unique"] and
+    kind = ["any", "min", "max", "unique", "rank", "sum", "strictsum"] and
     not exists(this.getExpr(_)) and
-    result = this.getArgument(0).getTypeExpr().getResolvedType()
+    result = this.getArgument(0).getType()
     or
     not kind = ["count", "strictcount"] and
     result = this.getExpr(0).getType()
@@ -1910,11 +1910,18 @@ private Expr exprOfPrimitiveAddType(PrimitiveType t) {
   result.getType() = getASubTypeOfAddPrimitive(t)
 }
 
+/**
+ * Gets a subtype of the given primitive type `prim`.
+ * This predicate does not consider float to be a supertype of int.
+ */
 private Type getASubTypeOfAddPrimitive(PrimitiveType prim) {
   result = prim and
   result.getName() = ["int", "string", "float"]
   or
-  result.getASuperType() = getASubTypeOfAddPrimitive(prim)
+  exists(Type superType | superType = getASubTypeOfAddPrimitive(prim) |
+    result.getASuperType() = superType and
+    not (result.getName() = "int" and superType.getName() = "float")
+  )
 }
 
 /**
@@ -1957,15 +1964,18 @@ class MulDivModExpr extends TMulDivModExpr, BinOpExpr {
     this.getLeftOperand().getType() = result and
     this.getRightOperand().getType() = result
     or
-    // Both operands are subtypes of `int`
-    result.getName() = "int" and
-    result = this.getLeftOperand().getType().getASuperType*() and
-    result = this.getRightOperand().getType().getASuperType*()
+    // Both operands are subtypes of `int`/`float`
+    result.getName() = ["int", "float"] and
+    exprOfPrimitiveAddType(result) = this.getLeftOperand() and
+    exprOfPrimitiveAddType(result) = this.getRightOperand()
     or
     // Coercion from `int` to `float`
     exists(PrimitiveType i | result.getName() = "float" and i.getName() = "int" |
-      this.getAnOperand().getType() = result and
-      this.getAnOperand().getType().getASuperType*() = i
+      this.getLeftOperand() = exprOfPrimitiveAddType(result) and
+      this.getRightOperand() = exprOfPrimitiveAddType(i)
+      or
+      this.getRightOperand() = exprOfPrimitiveAddType(result) and
+      this.getLeftOperand() = exprOfPrimitiveAddType(i)
     )
   }
 

ql/src/codeql_ql/ast/internal/Type.qll

@@ -340,6 +340,12 @@ module TyConsistency {
     resolveTypeExpr(te, t)
   }
 
+  query predicate multiplePrimitives(TypeExpr te, int c, PrimitiveType t) {
+    c = strictcount(PrimitiveType t0 | resolveTypeExpr(te, t0)) and
+    c > 1 and
+    resolveTypeExpr(te, t)
+  }
+
   query predicate varDefNoType(VarDef def) {
     not exists(def.getType()) and
     not def.getLocation()
@@ -360,4 +366,10 @@ module TyConsistency {
         .getAbsolutePath()
         .regexpMatch(".*/(test|examples|ql-training|recorded-call-graph-metrics)/.*")
   }
+
+  query predicate multiplePrimitivesExpr(Expr e, int c, PrimitiveType t) {
+    c = strictcount(PrimitiveType t0 | t0 = e.getType()) and
+    c > 1 and
+    t = e.getType()
+  }
 }

ql/src/queries/diagnostics/EmptyConsistencies.ql

@@ -21,12 +21,15 @@ where
   or
   PredConsistency::noResolvePredicateExpr(node) and msg = "PredConsistency::noResolvePredicateExpr"
   or
-  TypeConsistency::noResolve(node) and msg = "TypeConsistency::noResolve"
-  or
   TypeConsistency::exprNoType(node) and msg = "TypeConsistency::exprNoType"
   or
   TypeConsistency::varDefNoType(node) and msg = "TypeConsistency::varDefNoType"
   or
+  TypeConsistency::multiplePrimitives(node, _, _) and msg = "TypeConsistency::multiplePrimitives"
+  or
+  TypeConsistency::multiplePrimitivesExpr(node, _, _) and
+  msg = "TypeConsistency::multiplePrimitivesExpr"
+  or
   //or // has 1 result, but the CodeQL compiler also can't figure out that one. I suppoed the file is never imported.
   //TypeConsistency::noResolve(node) and msg = "TypeConsistency::noResolve"
   //or // has 1 result, but the CodeQL compiler also can't figure out that one. Same file as above.

ql/test/type/Test.qll

@@ -25,3 +25,6 @@ class Sub extends Base {
 
   int bar2() { result = super.foo() }
 }
+
+bindingset[result, a, b]
+int integerMul(int a, int b) { result = a * b }

ql/test/type/type.expected

@@ -52,3 +52,7 @@
 | Test.qll:26:16:26:21 | result | file://:0:0:0:0 | int |
 | Test.qll:26:25:26:29 | Super | Test.qll:15:1:19:1 | Base |
 | Test.qll:26:25:26:35 | MemberCall | file://:0:0:0:0 | int |
+| Test.qll:30:32:30:37 | result | file://:0:0:0:0 | int |
+| Test.qll:30:41:30:41 | a | file://:0:0:0:0 | int |
+| Test.qll:30:41:30:45 | MulExpr | file://:0:0:0:0 | int |
+| Test.qll:30:45:30:45 | b | file://:0:0:0:0 | int |