rapx 0.7.39

A static analysis platform for Rust program analysis and verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

use crate::helpers::fn_info::get_adt_def_id_by_adt_method;
use crate::helpers::mir_scan::{collect_global_local_pairs, get_rawptr_deref, get_unsafe_callees};
use crate::helpers::mir_utils::{has_rapx_attr, is_trait_unsafe};
use rustc_hir::{BodyId, def_id::DefId};
use rustc_middle::{mir::Local, ty::TyCtxt};
use rustc_span::Symbol;
use std::collections::HashSet;

use super::hir_visitor::ContainsUnsafe;

/// Kind of unsafe operation found in a function body.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum UnsafeOpKind {
    CallsUnsafeFn,
    DerefsRawPtr,
    AccessesStaticMut,
}

/// A function that contains unsafe operations — an "unsafe root".
///
/// This is the unified entry point for both the safetyflow analysis and the
/// verify module to determine whether a function needs safety verification.
#[derive(Debug, Clone)]
pub struct UnsafeRoot {
    pub def_id: DefId,
    pub kinds: Vec<UnsafeOpKind>,
    pub unsafe_callees: HashSet<DefId>,
    pub raw_ptr_locals: HashSet<Local>,
    pub static_muts: HashSet<DefId>,
}

/// Fast HIR-level pre-check: does this function contain `unsafe` blocks
/// or is it declared `unsafe fn`?
///
/// This is a cheap check that can quickly filter out functions that are
/// entirely safe and have no unsafe operations of any kind.
pub fn hir_contains_unsafe(tcx: TyCtxt<'_>, body_id: BodyId) -> bool {
    let (fn_unsafe, block_unsafe) = ContainsUnsafe::contains_unsafe(tcx, body_id);
    fn_unsafe || block_unsafe
}

/// Check if a struct has `#[rapx::invariant(...)]` annotations.
///
/// This is a cheap HIR attribute scan — it only checks for the presence of
/// the attribute path, without parsing the annotation arguments.
pub fn has_struct_invariant(tcx: TyCtxt<'_>, struct_def_id: DefId) -> bool {
    let Some(local_def_id) = struct_def_id.as_local() else {
        return false;
    };
    has_rapx_attr(tcx, local_def_id, Symbol::intern("invariant"))
}

/// Quick check: does this function's owning struct have invariants?
pub fn function_has_struct_invariant(tcx: TyCtxt<'_>, def_id: DefId) -> bool {
    get_adt_def_id_by_adt_method(tcx, def_id)
        .map(|struct_def_id| has_struct_invariant(tcx, struct_def_id))
        .unwrap_or(false)
}

/// Quick check: does this function's containing impl implement an `unsafe trait`?
///
/// This is a fast HIR-level pre-filter similar to [`function_has_struct_invariant`].
pub fn function_has_trait_ensurance(tcx: TyCtxt<'_>, def_id: DefId) -> bool {
    let Some(assoc_item) = tcx.opt_associated_item(def_id) else {
        return false;
    };
    let Some(impl_id) = assoc_item.impl_container(tcx) else {
        return false;
    };
    let Some(trait_ref) = tcx.impl_opt_trait_ref(impl_id) else {
        return false;
    };
    is_trait_unsafe(tcx, trait_ref.skip_binder().def_id)
}

/// Full MIR-level detection: scan the function body for all unsafe operations.
///
/// Returns `None` if the function has no unsafe callees, no raw pointer
/// dereferences, and no static mutable accesses.
pub fn scan_mir(tcx: TyCtxt<'_>, def_id: DefId) -> Option<UnsafeRoot> {
    if !tcx.is_mir_available(def_id) {
        return None;
    }

    let unsafe_callees = get_unsafe_callees(tcx, def_id);
    let raw_ptr_locals = get_rawptr_deref(tcx, def_id);
    let global_locals = collect_global_local_pairs(tcx, def_id);
    let static_muts: HashSet<DefId> = global_locals.keys().copied().collect();

    let global_locals_set: HashSet<Local> = global_locals.values().flatten().copied().collect();
    let raw_ptr_locals: HashSet<Local> = raw_ptr_locals
        .difference(&global_locals_set)
        .copied()
        .collect();

    if unsafe_callees.is_empty() && raw_ptr_locals.is_empty() && static_muts.is_empty() {
        return None;
    }

    let mut kinds = Vec::new();
    if !unsafe_callees.is_empty() {
        kinds.push(UnsafeOpKind::CallsUnsafeFn);
    }
    if !raw_ptr_locals.is_empty() {
        kinds.push(UnsafeOpKind::DerefsRawPtr);
    }
    if !static_muts.is_empty() {
        kinds.push(UnsafeOpKind::AccessesStaticMut);
    }

    Some(UnsafeRoot {
        def_id,
        kinds,
        unsafe_callees,
        raw_ptr_locals,
        static_muts,
    })
}