From 92f2976399dfceddf0fa87917352136aaebb7b0e Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@github.com>
Date: Thu, 18 Aug 2022 14:50:26 +0200
Subject: [PATCH] Java: Improve unification check for wildcards with lower
 bounds.

---
 .../semmle/code/java/dispatch/Unification.qll | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/java/ql/lib/semmle/code/java/dispatch/Unification.qll b/java/ql/lib/semmle/code/java/dispatch/Unification.qll
index ac7b03ca768..b7ff8d7cec5 100644
--- a/java/ql/lib/semmle/code/java/dispatch/Unification.qll
+++ b/java/ql/lib/semmle/code/java/dispatch/Unification.qll
@@ -48,6 +48,12 @@ module MkUnification<unificationTarget/1 targetLeft, unificationTarget/1 targetR
     arg2 = t2.getTypeArgument(pos)
   }
 
+  private RefType getUpperBound(RefType t) {
+    if t instanceof BoundedType
+    then result = t.(BoundedType).getAnUltimateUpperBoundType()
+    else result = t
+  }
+
   /**
    * Holds if `t1` and `t2` are not unifiable.
    *
@@ -84,6 +90,28 @@ module MkUnification<unificationTarget/1 targetLeft, unificationTarget/1 targetR
         notHaveIntersection(upperbound1, upperbound2)
       )
       or
+      exists(RefType lowerbound, RefType upperbound |
+        t1.(Wildcard).getLowerBoundType().(RefType).getSourceDeclaration() = lowerbound and
+        getUpperBound(t2).getSourceDeclaration() = upperbound and
+        not lowerbound instanceof BoundedType
+        or
+        t2.(Wildcard).getLowerBoundType().(RefType).getSourceDeclaration() = lowerbound and
+        getUpperBound(t1).getSourceDeclaration() = upperbound and
+        not lowerbound instanceof BoundedType
+      |
+        not lowerbound.getASourceSupertype*() = upperbound
+      )
+      or
+      exists(BoundedType lowerbound, RefType upperbound |
+        t1.(Wildcard).getLowerBoundType() = lowerbound and
+        getUpperBound(t2) = upperbound
+        or
+        t2.(Wildcard).getLowerBoundType() = lowerbound and
+        getUpperBound(t1) = upperbound
+      |
+        notHaveIntersection(lowerbound.getUpperBoundType(), upperbound)
+      )
+      or
       not (
         t1 instanceof Array and t2 instanceof Array
         or