Merge pull request #18385 from michaelnebel/csharp/allowsrefstruct

C# 13: Allows ref struct.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameterConstraints.cs

@@ -40,6 +40,12 @@ public override void Populate(TextWriter trapFile)
             if (Symbol.ReferenceTypeConstraintNullableAnnotation == NullableAnnotation.Annotated)
                 trapFile.general_type_parameter_constraints(this, 5);
 
+            if (Symbol.HasNotNullConstraint)
+                trapFile.general_type_parameter_constraints(this, 6);
+
+            if (Symbol.AllowsRefLikeType)
+                trapFile.general_type_parameter_constraints(this, 7);
+
             foreach (var abase in Symbol.GetAnnotatedTypeConstraints())
             {
                 var t = Type.Create(Context, abase.Symbol);

csharp/ql/lib/change-notes/2025-01-03-allow-ref-struct.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 13: Added extractor support and call dispatch logic (data flow) for the (negative) type parameter constraint `allows ref struct`. Added extractor support for the type parameter constraint `notnull`.

csharp/ql/lib/semmle/code/csharp/Conversion.qll

@@ -649,11 +649,14 @@ predicate convBoxing(Type fromType, Type toType) {
 }
 
 private predicate convBoxingValueType(ValueType fromType, Type toType) {
-  toType instanceof ObjectType
-  or
-  toType instanceof DynamicType
-  or
-  toType instanceof SystemValueTypeClass
+  (
+    toType instanceof ObjectType
+    or
+    toType instanceof DynamicType
+    or
+    toType instanceof SystemValueTypeClass
+  ) and
+  not fromType.isRefLikeType()
   or
   toType = fromType.getABaseInterface+()
 }

csharp/ql/lib/semmle/code/csharp/Generics.qll

@@ -287,6 +287,12 @@ class TypeParameterConstraints extends Element, @type_parameter_constraints {
   /** Holds if these constraints include a nullable reference type constraint. */
   predicate hasNullableRefTypeConstraint() { general_type_parameter_constraints(this, 5) }
 
+  /** Holds if these constraints include a notnull type constraint. */
+  predicate hasNotNullTypeConstraint() { general_type_parameter_constraints(this, 6) }
+
+  /** Holds if these constraints include a `allows ref struct` constraint. */
+  predicate hasAllowRefLikeTypeConstraint() { general_type_parameter_constraints(this, 7) }
+
   /** Gets a textual representation of these constraints. */
   override string toString() { result = "where " + this.getTypeParameter().getName() + ": ..." }
 

csharp/ql/lib/semmle/code/csharp/Type.qll

@@ -48,6 +48,13 @@ class Type extends Member, TypeContainer, @type {
 
   /** Holds if this type is a value type, or a type parameter that is a value type. */
   predicate isValueType() { none() }
+
+  /**
+   * Holds if this type is a ref like type.
+   *
+   * Only `ref struct` types are considered ref like types.
+   */
+  predicate isRefLikeType() { none() }
 }
 
 pragma[nomagic]
@@ -704,15 +711,36 @@ class Enum extends ValueType, @enum_type {
  * ```
  */
 class Struct extends ValueType, @struct_type {
-  /** Holds if this `struct` has a `ref` modifier. */
-  predicate isRef() { this.hasModifier("ref") }
+  /**
+   * DEPRECATED: Use `instanceof RefStruct` instead.
+   *
+   * Holds if this `struct` has a `ref` modifier.
+   */
+  deprecated predicate isRef() { this.hasModifier("ref") }
 
   /** Holds if this `struct` has a `readonly` modifier. */
   predicate isReadonly() { this.hasModifier("readonly") }
 
   override string getAPrimaryQlClass() { result = "Struct" }
 }
 
+/**
+ * A `ref struct`, for example
+ *
+ * ```csharp
+ * ref struct S {
+ *  ...
+ * }
+ * ```
+ */
+class RefStruct extends Struct {
+  RefStruct() { this.hasModifier("ref") }
+
+  override string getAPrimaryQlClass() { result = "RefStruct" }
+
+  override predicate isRefLikeType() { any() }
+}
+
 /**
  * A `record struct`, for example
  * ```csharp

csharp/ql/lib/semmle/code/csharp/Unification.qll

@@ -522,16 +522,21 @@ module Gvn {
 
 /** Provides definitions related to type unification. */
 module Unification {
-  /** A type parameter that is compatible with any type. */
+  /** A type parameter that is compatible with any type except `ref struct`. */
   class UnconstrainedTypeParameter extends TypeParameter {
-    UnconstrainedTypeParameter() { not exists(getATypeConstraint(this)) }
+    UnconstrainedTypeParameter() {
+      not exists(getATypeConstraint(this)) and not exists(getANegativeTypeConstraint(this))
+    }
   }
 
   /** A type parameter that is constrained. */
   class ConstrainedTypeParameter extends TypeParameter {
     int constraintCount;
 
-    ConstrainedTypeParameter() { constraintCount = strictcount(getATypeConstraint(this)) }
+    ConstrainedTypeParameter() {
+      constraintCount = count(getATypeConstraint(this)) + count(getANegativeTypeConstraint(this)) and
+      constraintCount > 0
+    }
 
     /**
      * Holds if this type parameter is unifiable with type `t`.
@@ -559,29 +564,31 @@ module Unification {
     bindingset[this]
     pragma[inline_late]
     override predicate unifiable(Type t) {
-      exists(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
+      forall(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
         ttc = TRefTypeConstraint() and
         t.isRefType()
         or
         ttc = TValueTypeConstraint() and
         t.isValueType()
         or
         typeConstraintUnifiable(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
 
     bindingset[this]
     pragma[inline_late]
     override predicate subsumes(Type t) {
-      exists(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
+      forall(TTypeParameterConstraint ttc | ttc = getATypeConstraint(this) |
         ttc = TRefTypeConstraint() and
         t.isRefType()
         or
         ttc = TValueTypeConstraint() and
         t.isValueType()
         or
         typeConstraintSubsumes(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
   }
 
@@ -603,7 +610,8 @@ module Unification {
         t.isValueType()
         or
         typeConstraintUnifiable(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
 
     bindingset[this]
@@ -617,7 +625,8 @@ module Unification {
         t.isValueType()
         or
         typeConstraintSubsumes(ttc, t)
-      )
+      ) and
+      (t.isRefLikeType() implies getANegativeTypeConstraint(this) = TAllowRefTypeConstraint())
     }
   }
 
@@ -632,6 +641,9 @@ module Unification {
         not t instanceof TypeParameter
       }
 
+    cached
+    newtype TTypeParameterNegativeConstraint = TAllowRefTypeConstraint()
+
     cached
     TTypeParameterConstraint getATypeConstraint(TypeParameter tp) {
       exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
@@ -650,6 +662,14 @@ module Unification {
       )
     }
 
+    cached
+    TTypeParameterNegativeConstraint getANegativeTypeConstraint(TypeParameter tp) {
+      exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
+        tpc.hasAllowRefLikeTypeConstraint() and
+        result = TAllowRefTypeConstraint()
+      )
+    }
+
     cached
     predicate typeConstraintUnifiable(TTypeConstraint ttc, Type t) {
       exists(Type t0 | ttc = TTypeConstraint(t0) | implicitConversionRestricted(t, t0))

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -703,7 +703,7 @@ module LocalFlow {
       or
       t = any(TypeParameter tp | not tp.isValueType())
       or
-      t.(Struct).isRef()
+      t.isRefLikeType()
     ) and
     not exists(getALastEvalNode(result))
   }

csharp/ql/test/library-tests/conversion/boxing/Boxing.cs

@@ -45,3 +45,6 @@ void M()
         x1 = x15; // not a boxing conversion
     }
 }
+
+// Ref structs can't be converted to a dynamic, object or valuetype.
+ref struct S { }

csharp/ql/test/library-tests/csharp11/PrintAst.expected

@@ -847,7 +847,7 @@ RequiredMembers.cs:
 #   40|         0: [Parameter] value
 Scoped.cs:
 #    1| [Struct] S1
-#    2| [Struct] S2
+#    2| [RefStruct] S2
 #    7| [Class] ScopedModifierTest
 #    9|   5: [Method] M1
 #    9|     -1: [TypeMention] int
@@ -1402,7 +1402,7 @@ Strings.cs:
 Struct.cs:
 #    1| [NamespaceDeclaration] namespace ... { ... }
 #    3|   1: [Class] MyEmptyClass
-#    5|   2: [Struct] RefStruct
+#    5|   2: [RefStruct] RefStruct
 #    7|     5: [Field] MyInt
 #    7|       -1: [TypeMention] int
 #    8|     6: [Field] MyByte

csharp/ql/test/library-tests/csharp7.2/PrintAst.expected

@@ -30,8 +30,8 @@ csharp72.cs:
 #   26|           0: [FieldAccess] access to field s
 #   29|   7: [DelegateType] Del
 #   32| [Struct] ReadonlyStruct
-#   36| [Struct] RefStruct
-#   40| [Struct] ReadonlyRefStruct
+#   36| [RefStruct] RefStruct
+#   40| [RefStruct] ReadonlyRefStruct
 #   44| [Class] NumericLiterals
 #   46|   5: [Field] binaryValue
 #   46|     -1: [TypeMention] int