Consult a Composer replacement before the static source locators

collectNewAutoloadFunctions() splits the autoloaders a bootstrap file
registers at Composer's position in the spl_autoload queue. When no
Composer ClassLoader instance is left in that queue there is no boundary
to split on, and every collected loader went to the appended bucket -
consulted only after the static source locators.

A bootstrap that unregisters [$composerLoader, 'loadClass'] and registers
a wrapper delegating to it, as typo3/class-alias-loader does, produces
exactly that queue. Its loader carries Composer's runtime priority, so it
belongs before the static locators, which is where it sat until 2.2.9.
Falling back to prepended restores that order and leaves the split
untouched whenever Composer's own loader is still registered.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: SanderMuller

src/autoloadFunctions.php

@@ -40,6 +40,14 @@ function autoloadFunctionsPrependedToComposer(): array // phpcs:ignore Squiz.Fun
  * same order relative to Composer as PHP does at runtime, instead of always
  * invoking them before (or after) the static Composer source locators.
  *
+ * When no Composer ClassLoader instance is left in the queue there is no
+ * boundary to split on: a bootstrap file has taken Composer's place, so its
+ * loader carries Composer's runtime priority and belongs before the static
+ * source locators. Bucketing those as appended would demote a loader that
+ * actually resolves the class first, which is what
+ * https://github.com/phpstan/phpstan/issues/15102 reported for
+ * typo3/class-alias-loader.
+ *
  * @param list<mixed>|false $autoloadFunctionsBefore
  * @param list<mixed>|false $autoloadFunctionsAfter
  * @return array{prepended: list<mixed>, appended: list<mixed>}
@@ -85,7 +93,7 @@ function collectNewAutoloadFunctions($autoloadFunctionsBefore, $autoloadFunction
 			}
 		}
 
-		if ($composerIndex !== null && $index < $composerIndex) {
+		if ($composerIndex === null || $index < $composerIndex) {
 			$prepended[] = $after;
 		} else {
 			$appended[] = $after;

tests/PHPStan/CollectNewAutoloadFunctionsTest.php

@@ -40,7 +40,14 @@ public function testAutoloadersAreSplitByComposerPosition(): void
 		$this->assertSame([$appended], $result['appended']);
 	}
 
-	public function testWithoutComposerEverythingIsAppended(): void
+	/**
+	 * With no Composer ClassLoader instance in the queue there is no boundary to split on -
+	 * a bootstrap loader has taken Composer's place and resolves the class first at runtime,
+	 * so it belongs before the static source locators.
+	 *
+	 * @see https://github.com/phpstan/phpstan/issues/15102
+	 */
+	public function testWithoutComposerEverythingIsPrepended(): void
 	{
 		$first = static function (string $class): void {
 		};
@@ -49,8 +56,33 @@ public function testWithoutComposerEverythingIsAppended(): void
 
 		$result = collectNewAutoloadFunctions([], [$first, $second]);
 
-		$this->assertSame([], $result['prepended']);
-		$this->assertSame([$first, $second], $result['appended']);
+		$this->assertSame([$first, $second], $result['prepended']);
+		$this->assertSame([], $result['appended']);
+	}
+
+	/**
+	 * The shape typo3/class-alias-loader creates: the bootstrap unregisters
+	 * [$composerLoader, 'loadClass'] and registers a wrapper that delegates to it. The
+	 * wrapper is not a ClassLoader instance, so the queue holds no Composer entry to
+	 * split on and everything collected has to be consulted first.
+	 */
+	public function testComposerReplacementAndItsBootstrapAreBothPrepended(): void
+	{
+		$replacement = new class {
+
+			public function loadClass(string $class): void
+			{
+			}
+
+		};
+		$wrapper = [$replacement, 'loadClass'];
+		$bootstrap = static function (string $class): void {
+		};
+
+		$result = collectNewAutoloadFunctions([], [$wrapper, $bootstrap]);
+
+		$this->assertSame([$wrapper, $bootstrap], $result['prepended']);
+		$this->assertSame([], $result['appended']);
 	}
 
 	public function testComposerAndPharAutoloaderAndPreexistingAreExcluded(): void