unified: Associate a type with a variable

Previously type inference assumed that UnqualifiedMemberAccess could only be qualified by a receiver parameter, which bypasses the abstraction set up in prior phases.

Author: asgerf

unified/ql/lib/codeql/unified/internal/mad/LegacyMaD.qll

@@ -142,9 +142,7 @@ private predicate classMatchesType(ClassLikeDeclaration cls, string type, boolea
  * type `cls`.
  */
 pragma[nomagic]
-private predicate propertyAccessSelector(
-  MemberAccess access, ClassLikeDeclaration cls, string name
-) {
+private predicate propertyAccessSelector(MemberAccess access, ClassLikeDeclaration cls, string name) {
   name = access.getMemberName() and
   name = any(Selector s).getPropertyName() and
   not access = any(CallExpr call).getCallee() and

unified/ql/lib/codeql/unified/internal/typeinference/TypeInference.qll

@@ -331,14 +331,19 @@ module Input3 implements InputSig3 {
     }
   }
 
-  private Type getImplicitReceiverType(UnqualifiedMemberAccess uma, TypePath path) {
-    exists(Parameter p, Unified::Callable c |
-      p.getParameterEx().isImplicitReceiverParameter(c) and
-      c = uma.getImplicitQualifierVariable().getDeclaringCallable() and
-      result = p.getType().getTypeAt(path)
+  additional Type inferTypeFromVariable(LocalVariable v, TypePath path) {
+    result = inferType(v.getABinding(), path)
+    or
+    exists(Parameter param |
+      implicitParameterDecl(param, v) and
+      result = param.getType().getTypeAt(path)
     )
   }
 
+  private Type getImplicitReceiverType(UnqualifiedMemberAccess uma, TypePath path) {
+    result = inferTypeFromVariable(uma.getImplicitQualifierVariable(), path)
+  }
+
   private class UnqualifiedMemberAccessFieldAccess extends FieldAccess, UnqualifiedMemberAccess {
     override Expr getReceiver() { none() }
 
@@ -862,11 +867,14 @@ predicate inferTypeUnique = M3::inferTypeUnique/2;
 
 predicate inferTypeCertain = M3::inferTypeCertain/2;
 
+Type inferVariableType(LocalVariable variable) {
+  result = Input3::inferTypeFromVariable(variable, _)
+}
+
 Type inferBaseType(MemberAccess access) {
   result = inferType(access.(MemberAccessExpr).getBase())
   or
-  result.asClass().getAMemberIncludingExtensions() =
-    access.(UnqualifiedMemberAccess).getImplicitQualifierVariable().getDeclaringCallable()
+  result = inferVariableType(access.(UnqualifiedMemberAccess).getImplicitQualifierVariable())
 }
 
 module Consistency = M3::Consistency;