Rust: Data flow through variants

[hvitved]

This PR adds support for tracking data flow through construction and deconstruction of enum variants. For example, we can now identify flow in cases such as

enum MyEnum {
    A(i64),
    B(i64),
}

let s1 = MyEnum::A(source());
match s1 {
    MyEnum::A(n) => sink(n), // flow
    MyEnum::B(n) => sink(n), // no flow
}

Commit-by-commit review is suggested.

[paldepind]

Looks really great 🎉 . I've just left a few questions and suggestions.

[paldepind]

Love how much more readable this got after @redsun82's PR.

[paldepind]

Suggested change

	* A reference contained in an object. For example a field in a struct.
	* A path to a value contained in an object. For example a field name of a struct.

[paldepind]

I think we'd get a lot of mileage out of also special casing Result here.

[paldepind]

Suggested change

	private class SingletonContentSet extends ContentSet, TSingletonContentSet {
	final private class SingletonContentSet extends ContentSet, TSingletonContentSet {

[hvitved]

It's not super important, as the class is not exposed, but ok.

[paldepind]

If DataFlowCall had this getResolvable predicate then this line could be (could also be a private predicate if we don't want a member predicate on DataFlowCall):

Suggested change

	callResolveExtendedCanonicalPath(call.asCallBaseExprCfgNode().getExpr(), crate, path)
	resolveExtendedCanonicalPath(call.getResolvable(), crate, path)

And callResolveExtendedCanonicalPath could be deleted. That seems simpler and factors out "get resolveable" from "call resolveExtendedCanonicalPath" which are currently together inresolveExtendedCanonicalPath.

[paldepind]

Suggested change

	final class ContentApprox = Content; // todo
	final class ContentApprox = Content; // TODO: Implement content approximation.

[paldepind]

What about using exists instead (also below)? I find that easier to read.

Suggested change

	node1.asPat() =
	any(TupleStructPatCfgNode pat, int pos |
	tupleVariantDestruction(pat.getPat(), c.(TupleVariantContent).getVariantCanonicalPath(pos)) and
	node2.asPat() = pat.getField(pos)
	|
	pat
	)
	exists(TupleStructPatCfgNode pat, int pos |
	node1.asPat() = pat and
	tupleVariantDestruction(pat.getPat(), c.(TupleVariantContent).getVariantCanonicalPath(pos)) and
	node2.asPat() = pat.getField(pos)
	)

[paldepind]

What about naming this TupleVariantPosContent to emphasize that its content stored in a specific position in a specific variant. I initially thought it was only the latter. Similarly, RecordVariantContent could be RecordVariantFieldContent.

[paldepind]

Question: I've noticed that in QL predicates sometimes take more parameters than I would think necessary. Like here where name only depends on v and nothing else. Is that for performance reasons or because it's just convenient to have one relation with all the things and then use it with _?

[hvitved]

It can be both, here it is mainly for convenience.