Skip to content

Go: Only output origin constraints for methods - #11

Open
anurag6569201 wants to merge 1 commit into
qa/agent-github-codeql/pr-11-22399/basefrom
qa/agent-github-codeql/pr-11-22399/head
Open

anurag6569201 wants to merge 1 commit into
qa/agent-github-codeql/pr-11-22399/basefrom
qa/agent-github-codeql/pr-11-22399/head

Conversation

@anurag6569201

Copy link
Copy Markdown

Addresses github#22042 (comment) by only outputting the origins of constraints on generic method and not instantiated constraints. This matches the behavior in other places where we have both instantiations and origins.

Source merge-base: 072b298c66bb0c085c3cc24319f00ccbfcf0c25a
Source head: 6a9e2d514f6c20b0fa0eeb91145b1fc236afacb1

@shipwright-agent

Copy link
Copy Markdown

✅ Shipwright · Approve

Recommendation: approve PR #11 · Tier T1
Checks: 0 total · 0 needing attention

Next step: ready to merge.

Findings (6)

  • HIGH The new helper populateTypeParamParentsAndOrigins does two unrelated things: it records parents and records origins. · go/extractor/extractor.go:1669
    • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
  • HIGH The new global maps typeParamParent and typeParamOrigin are protected by separate mutexes, but getTypeParamParentLabel and getTypeParamOrigin each acquire only their own lock. · go/extractor/extractor.go:41
    • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
  • HIGH getTypeParamOrigin falls back to returning the input type parameter when no origin is recorded. · go/extractor/extractor.go:2117
    • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
  • LOW The comment above typeParamOriginMutex incorrectly says 'typeParamMutex protects typeParamOrigin.' It should reference typeParamOriginMutex. · go/extractor/extractor.go:41
    • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
  • LOW The new code introduces additional global mutable state keyed by *types.TypeParam pointers. · go/extractor/extractor.go:38
    • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
  • LOW The comment for typeParamOriginMutex says 'typeParamMutex protects typeParamOrigin.' It should say 'typeParamOriginMutex protects typeParamOrigin.' This is a documentation defect i · go/extractor/extractor.go:41
    • Fix: Fix the review finding before release.

Fireworks usage: 12,289 input · 822 output · 13,111 total tokens · $0.0032 · 15s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

Comment thread go/extractor/extractor.go
signature := tp.Method(i).Type().(*types.Signature)
populateTypeParamParents(signature.TypeParams(), meth, false)
}
populateTypeParamParentsAndOrigins(tp.Method(i), meth)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The new helper populateTypeParamParentsAndOrigins does two unrelated things: it records parents and records origins.

Impact: The new helper populateTypeParamParentsAndOrigins does two unrelated things: it records parents and records origins. The name is a conjunction of two responsibilities, and the body immediately delegates to two separate functions. A future maintainer reading extractType will not know from the call site which side effects are essential for correctness and which are incidental. Splitting the call into populateTypeParam…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Comment thread go/extractor/extractor.go
isFromReceiver bool
}

// typeParamMutex protects typeParamParent.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The new global maps typeParamParent and typeParamOrigin are protected by separate mutexes, but getTypeParamParentLabel and getTypeParamOrigin each acquire only their own lock.

Impact: The new global maps typeParamParent and typeParamOrigin are protected by separate mutexes, but getTypeParamParentLabel and getTypeParamOrigin each acquire only their own lock. If any code path ever reads or writes both maps in a way that requires a consistent cross-map view, the separate locks provide no atomicity. More concretely, setTypeParamParent and setTypeParamOrigin are called from populateTypeParamParentsAnd…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Comment thread go/extractor/extractor.go
}
}
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

getTypeParamOrigin falls back to returning the input type parameter when no origin is recorded.

Impact: getTypeParamOrigin falls back to returning the input type parameter when no origin is recorded. This silently masks missing-origin bugs: if populateTypeParamOrigins is not called for some instantiated method, extraction proceeds with the instantiated constraint instead of the origin constraint, producing subtly wrong database rows rather than failing loudly. The existing getTypeParamParentLabel uses log.Fatalf for a…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Comment thread go/extractor/extractor.go
isFromReceiver bool
}

// typeParamMutex protects typeParamParent.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · LOW

The comment above typeParamOriginMutex incorrectly says 'typeParamMutex protects typeParamOrigin.' It should reference typeParamOriginMutex.

Impact: The comment above typeParamOriginMutex incorrectly says 'typeParamMutex protects typeParamOrigin.' It should reference typeParamOriginMutex. This is a small but real documentation defect that can mislead someone reasoning about lock ownership.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Comment thread go/extractor/extractor.go
isFromReceiver bool
}

// typeParamMutex protects typeParamParent.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · LOW

The comment for typeParamOriginMutex says 'typeParamMutex protects typeParamOrigin.' It should say 'typeParamOriginMutex protects typeParamOrigin.' This is a documentation defect i

Impact: The comment for typeParamOriginMutex says 'typeParamMutex protects typeParamOrigin.' It should say 'typeParamOriginMutex protects typeParamOrigin.' This is a documentation defect introduced by the diff.

Suggested fix: Fix the review finding before release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant