[kotlin2cpg] Add support for KtCallableReferenceExpression by SuperUserDone · Pull Request #5775 · joernio/joern

SuperUserDone · 2026-01-21T14:01:57Z

No description provided.

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

SuperUserDone · 2026-02-10T08:15:49Z

The latest set of changes are major overhaul of the methodology of this PR. This now closely follows what the kotlin compiler does.

For unbound references to a global function ::globalFunction, it works similarly to the lambda method @johannescoetzee and I worked through for the javasrc2cpg case. It creates a MethodRef node, along with a dummy Type, TypeDecl and bindings for the method being overridden in the SAM Interface (Eg invoke for a function). If the SAM Interface is generic, an type-erased binding is also created.

For bound references to a companion object Type::function and to a regular method instance::method, a new Type and TypeDecl is created. The TypeDecl inherits from kotlin.jvm.internals.CallableReference. This class provides an this.receiver object. A constructor and implementation of the SAM Method is lowered into the CPG. The TypeDecl contains bindings for the method with concrete types, and if applicable a type-erased binding is also generated.

This does not work around kotlin compiler bug https://youtrack.jetbrains.com/issue/KT-54316, so the behavior is identical to the Kotlin compiler in the documented case. This only affects the companion case for assigned references.

This affects cases like this. This code won't compile because the Utils::validate ref has a broken signature of (Utils, Int) -> Boolean.

class Utils {
    companion object {
        fun validate(x: Int): Boolean = x > 0
    }
}

val ref: (Int) -> Boolean = Utils::validate

This case is fine tough and types are resolved correctly

class Utils {
    companion object {
        fun validate(x: Int): Boolean = x > 0
    }
}

fun bar(ref: (Int) -> Boolean) {}

bar(Utils::validate)

johannescoetzee

I've only checked the tests so far, but have left a few comments about the higher-level design and some nitpicks. I'll probably only get to reviewing the implementation tomorrow.

johannescoetzee · 2026-02-10T10:39:45Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+      val forwardedArgs = processCall.argument.isIdentifier.l
+      forwardedArgs.size shouldBe 2
+      forwardedArgs.map(_.typeFullName).toSet shouldBe Set("int", "java.lang.String")


With the way this is written, it's possible to miss non-identifier arguments or to have the correct arguments in the wrong order without the test catching it. It's a nitpick, but in my opinion it is better to test explicitly, so something like

processCall.argument.map(_.typeFullName).toList shouldBe List(<something>, "int", "java.lang.String")

or

inside(processCall.argument.l) { case List(<something>, intArg: Identifier, stringArg: Identifier) => intArg.typeFullName shouldBe "int" ... }

It's more cumbersome to write and can be harder to read, but is also occasionally useful for catching weird bugs

Please check that REF edges from the process arguments to the invoke parameters are being created correctly as well (in this method, but also wherever an Identifier node is added to the CPG). A lot of dataflow issues in the past were caused by missing REF edges (or REF edges referring to the wrong local/param) and testing it in the frontend AST tests is much faster than figuring it out through dataflow debugging

Have adjusted some of the tests to use this pattern where I thought it made sense. In most of the tests also added checks for the ref edges to the identifier nodes. There was a bug that I caught through that and resolved.

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

johannescoetzee · 2026-02-10T13:59:36Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+    }
+
+    "create a constructor call for the synthetic type with receiver as parameter" in {
+      val ctorCalls = cpg.call.nameExact("<init>").methodFullName(".*Function2Impl.*<init>.*").l


Suggested change

val ctorCalls = cpg.call.nameExact("<init>").methodFullName(".*Function2Impl.*<init>.*").l

val ctorCalls = cpg.call.methodFullName(".*Function2Impl.*<init>.*").l

should return the same, unless there's a type decl with <init> in the name. You could also use methodFullNameExact with the exact method full name to avoid any conflicts.

This is perhaps a stylistic thing, but I also prefer to write these in a way that gives more information about where the call occurs, for example cpg.method("test").call.... How far to take this depends on the complexity of the code in question though and here just finding the <init> directly is probably fine

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

…lib CallableReference implementation

ml86

So far I only reviewed the non test code. Once the comments are incorporated I will take a look at the tests.

ml86 · 2026-03-04T09:56:28Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+            None
+          }
+        }
+        .flatMap(paramDesc => Some(paramDesc.getType))


Extra flatMap seems superfluous. Just do the .getType in the above flatMap.

ml86 · 2026-03-04T10:06:15Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+  protected def createUnboundSamTypeDecl(samInfo: UnboundSamInfo): Ast = {
+    val samTypeDecl = typeDeclNode(
+      samInfo.expr,
+      samInfo.samImplClass.split('.').last,


Is this quaranteed to always have a '.'?

No, its not, but does String.split(..) not contain the original string as the only element of the array if so? Am I missing something?

You are right. For whatever reason I was thinking that split returns an empty array if the character is not contained in the string.

ml86 · 2026-03-04T10:11:28Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+
+    val samMethodFullName = s"${samInfo.methodRefName}:${samInfo.signature}"
+
+    val methodRefBinding =


Reused createBindingInfo

ml86 · 2026-03-04T10:12:04Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+  protected def createBoundSamTypeDecl(samInfo: BoundSamInfo): Ast = {
+    val samTypeDecl = typeDeclNode(
+      samInfo.expr,
+      samInfo.samImplClass.split('.').last,


Garanteed to have .?

Same as above. Please ignore.

ml86 · 2026-03-04T10:21:11Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+  ): Unit = {
+    val binding = bindingNode(methodName, signature, methodFullName)
+    bindingInfoQueue.prepend(
+      BindingInfo(binding, Seq((typeDecl, binding, EdgeTypes.BINDS), (binding, methodNode, EdgeTypes.REF)))


The edge meta data for the REF edge is superfluous as long as it points to the same method as indicated by methodFullName. The backend will create the edge.

Good to know. Was one of the pain points as it was not possible to get a ref to the method node here, hence the duplication here: #5775 (comment)

ml86 · 2026-03-04T10:45:56Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+        val identNode =
+          identifierNode(samInfo.expr, paramName, paramName, registerType(paramType)).argumentIndex(idx + 1)
+        paramAst.root
+          .collect { case p: NewMethodParameterIn =>


Avoid single letter variable names.

ml86 · 2026-03-04T10:50:30Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+        val identNode =
+          identifierNode(samInfo.expr, paramName, paramName, registerType(paramType)).argumentIndex(idx + 1)
+        paramAst.root
+          .collect { case p: NewMethodParameterIn =>


Best to have valueParameterAsts be not yet Ast wrapped NewMethodParameterIn nodes. That way you can avoid the collect.

ml86 · 2026-03-04T10:54:25Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+    samMethodName: String,
+    samMethodSig: String,
+    samGenericMethodSig: Option[String],
+    receiverParam: (Ast, String),


The second tuple value seems never to be used.

ml86 · 2026-03-04T10:57:05Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+      parameterInNode(samInfo.expr, "this", "this", 0, false, EvaluationStrategies.BY_SHARING, samInfo.samImplClass)
+        .dynamicTypeHintFullName(IndexedSeq(samInfo.samImplClass))
+    val receiverParamName =
+      samInfo.receiverParam._1.root.collect { case expr: ExpressionNew => expr.code }.getOrElse("receiver")


If expr is e.g. a call expression this will result in strange looking parameter names. I suggest you just always name the parameter receiver.

ml86 · 2026-03-04T11:04:43Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

+    }
+  }
+
+  private def extractReturnTypeFromSignature(signature: String): String = {


The method signature you pass into this function was at some point composed from a return type and the parameter types and now you parse it in order to extract the return type again. Please avoid that and propagated the not yet combined return and parameter types.

ml86 · 2026-03-06T07:31:46Z

joern-cli/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstCreator.scala

      samInfo.expr,
-      receiverParamName,
-      receiverParamName,
+      "receiver",


Use constant for "receiver" string.

ml86 · 2026-03-06T07:35:16Z

...i/frontends/kotlin2cpg/src/main/scala/io/joern/kotlin2cpg/ast/AstForExpressionsCreator.scala

+            .getContributedDescriptors(DescriptorKindFilter.FUNCTIONS, _ => true)
+            .asScala
+            .collectFirst {
+              case functionDescriptor: FunctionDescriptor if functionDescriptor.getModality.toString == "ABSTRACT" =>


I suspect that we can avoid using .toString and instead check the modality directly?

That is correct. Will change that. I cannot remember why I wrote it like this.

ml86 · 2026-03-06T07:45:30Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+    val syntheticTypeDecl = cpg.typeDecl.fullName(".*Function2Impl.*").head
+    val invokeMethod      = syntheticTypeDecl.method.name("invoke").head


All code outside of an actual concrete test that references cpg must be evaluated lazily because it will otherwise trigger the CPG generation even if none of theses tests are selected. The cpg value itself is an exception and does not need to be lazily evaluated because the CPG is only created open first us of cpg. For details look into the KotlinCode2CpgFixture and its super classes.

ml86 · 2026-03-06T07:58:13Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+      receiverAccess.ast.isIdentifier
+        .name("this")
+        .head
+        .typeFullName shouldBe "kotlin.jvm.internal.CallableReference"


Static type of this should be the name of the generated wrapper class.

In order to test the field identifier and the this identifier better use receiverAccess.argument(2).asInstanceOf[FieldIdentifier]... and receiverAccess.argument(1).asInstanceOf[Identifier].... That way you encode the expected positions and check that these are really direct AST children of the call instead of being somewhere in the AST below it.

ml86 · 2026-03-06T08:06:58Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+      ctorCalls.size shouldBe 1
+
+      val ctorCall = ctorCalls.head
+      ctorCall.methodFullName shouldBe "com.test.Handler.process$kotlin.jvm.functions.Function2Impl.invoke:boolean(int,java.lang.String).<init>:void(com.test.Handler)"


Fullname seems longer than necessary. Seems like .invoke:boolean(int,java.langString) can be omitted without the danger of a naming collisions.

If com.test.Handler.process is overloaded, it might cause a collision, so at the very least the .invoke can be omitted, but I think the signature should stay.

ml86 · 2026-03-06T08:10:49Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+    "have constructor body that assigns receiver field" in {
+      val constructor = syntheticTypeDecl.method.name("<init>").head
+
+      constructor.ast.isCall.name("<init>").methodFullName(".*CallableReference.*").l shouldBe List.empty


What is this supposed to test?

Sorry, was a leftover from #5775 (comment). Will remove.

ml86 · 2026-03-06T08:16:45Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+    val syntheticTypeDecl = cpg.typeDecl.fullName(".*Function1Impl.*").head
+    val invokeMethod      = syntheticTypeDecl.method.name("invoke").head


Again make these lazily evaluated.

ml86 · 2026-03-06T08:17:33Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+    val syntheticTypeDecl = cpg.typeDecl.fullName(".*Function1Impl.*").head
+    val invokeMethod      = syntheticTypeDecl.method.name("invoke").head
+
+    "use STATIC_DISPATCH without receiver access" in {


Validation of static call target is missing. Check call.methodFullName.

I would also like to see validation that the companion object is given as argument 0 to the validate call.

Will also explicitly set the argumentIndex in the implementation code to ensure this.

ml86 · 2026-03-06T08:24:57Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

+        .l
+        .filter(_.bindingTypeDecl.fullName.contains("globalFunction"))
+        .sortBy(_.methodFullName)
+      bindings.size shouldBe 2


Better to select the type decl you are interested in and than use .methodBinding.

ml86 · 2026-03-06T08:30:57Z

...rontends/kotlin2cpg/src/test/scala/io/joern/kotlin2cpg/querying/CallableReferenceTests.scala

 class CallableReferenceTests extends KotlinCode2CpgFixture(withOssDataflow = false) {

-  "CPG for code with simple callback usage" should {
+  "SAM implementation for bound instance method reference" should {


A binding table test for the generated type decl seems to be missing.

Yes, only for the unbound case currently exist. Will add for the bound case.

SuperUserDone requested a review from ml86 January 21, 2026 14:01

ml86 requested changes Jan 22, 2026

View reviewed changes

SuperUserDone mentioned this pull request Feb 5, 2026

[kotlin2cpg] Add missing type-erased binding for generic class methods #5806

Merged

SuperUserDone added 4 commits February 6, 2026 11:57

[kotlin2cpg] Add support for KtCallableReferenceExpression

c4305e8

Lower Bound method to CPG

19f05be

Work toward parity with manually lowered example

6e25ce7

Resolve lowering differences to manually defined class

705231c

SuperUserDone force-pushed the louis/kotlin2cpg-callablerefrences branch from 8d8282f to 47108a6 Compare February 10, 2026 07:46

Refactor and Resolve Dataflow tracing blockers

ee3e39e

SuperUserDone force-pushed the louis/kotlin2cpg-callablerefrences branch from 47108a6 to ee3e39e Compare February 10, 2026 07:50

SuperUserDone requested review from johannescoetzee and ml86 February 10, 2026 07:52

johannescoetzee requested changes Feb 10, 2026

View reviewed changes

SuperUserDone added 3 commits February 12, 2026 08:43

Resolve some comments from revie

0cb1916

Add Receiver Type directly to RecieverInfo

5416154

Remove uneeded Typedecl

f7b3f54

SuperUserDone requested a review from johannescoetzee February 19, 2026 07:34

Resolve issue where dataflow cannot track receiver due to missing std…

45d5514

…lib CallableReference implementation

ml86 requested changes Mar 4, 2026

View reviewed changes

Incorporate review comments

42a3b0a

ml86 requested changes Mar 6, 2026

View reviewed changes

Incorporate test review feedback

bb63d23

	val ctorCalls = cpg.call.nameExact("<init>").methodFullName(".Function2Impl.<init>.*").l
	val ctorCalls = cpg.call.methodFullName(".Function2Impl.<init>.*").l


		val samMethodFullName = s"${samInfo.methodRefName}:${samInfo.signature}"

		val methodRefBinding =

		val syntheticTypeDecl = cpg.typeDecl.fullName(".Function2Impl.").head
		val invokeMethod = syntheticTypeDecl.method.name("invoke").head

Conversation

SuperUserDone commented Jan 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SuperUserDone commented Feb 10, 2026

Uh oh!

johannescoetzee left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ml86 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SuperUserDone Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

SuperUserDone Mar 6, 2026 •

edited

Loading