Python: Enhance points-to to support type-hint analysis.

[markshannon]

Three changes to better track type hint objects during points-to.

1. Changes the handling of instantiation for classes that may return instances of other classes.
   • We now track the instance, but return "unknown class" from .getClass().
   • This remains correct, but allows us to track values with complex classes, like those in the typing module.
2. Track subscripts where the value being subscripted is likely to be a type-hint. That is, a class or a attribute of the typing module.
3. A couple of fixes to the object model that came to light during these changes.
   • Fix some toString() implementations
   • Fix super-type calculation where MRO is missing or broken.

[taus-semmle]

A few comments and questions, otherwise LGTM.

[taus-semmle]

Are these ClassObjectInternals guaranteed to have a ClassDecl? I'm wondering if we'll lose instances where TSpecificInstance(_, cls, _) exists, but cls.getClassDeclaration() fails (and where previously we would have used cls regardless).

[markshannon]

If it doesn't have a ClassDecl then we won't be able to compute an MRO. Currently that applies to DynamicallyCreatedClass. Potentially getASuperType() could be improved for those, but this makes things no worse in that case.

[taus-semmle]

I had to stare at this line for a while to convince myself that it was doing the right thing. Would it make more sense to do result = this.getBaseType(_).getASuperType() instead? This, at least, would make the recursion a bit more apparent (i.e. an improper supertype is either the class itself, one of its base classes, or an improper supertype of one of its base classes). I would also move result = this to be the first disjunct in that case.

[taus-semmle]

Alternatively, we could add getABaseType to ClassValue (same as what ClassObject has right now) and use getABaseType*().

[markshannon]

Done