Remap conditional expressions through constant string concat-assigns

`$var .= '<single constant string>'` used to invalidate every
conditional-expression holder mentioning $var, so a format string built
across `if (!empty($target))` lost its correlation with $target and a later
`empty($target)` re-check could not select the matching string. Appending a
fixed suffix is injective, so holders whose target or condition on $var is a
single constant string are remapped through the append instead; everything
else still falls back to invalidation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA

Author: ondrejmirtes

src/Analyser/ExprHandler/AssignHandler.php

@@ -68,6 +68,7 @@
 use PHPStan\Node\VariableAssignNode;
 use PHPStan\Node\VirtualNode;
 use PHPStan\Php\PhpVersion;
+use PHPStan\Reflection\InitializerExprTypeResolver;
 use PHPStan\Rules\Properties\PropertyReflectionFinder;
 use PHPStan\ShouldNotHappenException;
 use PHPStan\TrinaryLogic;
@@ -107,6 +108,7 @@
 use function is_nan;
 use function is_string;
 use function spl_object_id;
+use function str_contains;
 
 /**
  * @implements ExprHandler<Assign|AssignRef>
@@ -138,6 +140,7 @@ public function __construct(
 		private StaticPropertyFetchHandler $staticPropertyFetchHandler,
 		private MethodThrowPointHelper $methodThrowPointHelper,
 		private PropertyHookThrowPointsResolver $propertyHookThrowPointsResolver,
+		private InitializerExprTypeResolver $initializerExprTypeResolver,
 	)
 	{
 	}
@@ -1296,7 +1299,23 @@ public function applyWrite(
 				}
 
 				$nodeScopeResolver->callNodeCallback($nodeCallback, new VariableAssignNode($var, $assignedExpr), $scopeBeforeAssignEval, $storage);
-
+				$remappedConditionalExpressions = [];
+				if (
+					// only the concat-assign's own write remaps - an enclosing plain
+					// assignment of the same variable (`$s = $s .= 'x'`) sees the
+					// already-remapped holders and would remap them a second time
+					$isAssignOp
+					&& $assignedExpr instanceof AssignOp\Concat
+					&& $assignedExpr->var instanceof Variable
+					&& $assignedExpr->var->name === $var->name
+					&& $scope->getConditionalExpressions() !== []
+				) {
+					$remappedConditionalExpressions = $this->remapConditionalExpressionsThroughConcatAssign(
+						$scope->getConditionalExpressions(),
+						'$' . $var->name,
+						$valueResult->getType(),
+					);
+				}
 				$nativeType = $this->readAssignedValueType($nodeScopeResolver, $storedAssignedExprResult, $assignedExpr, $scope->doNotTreatPhpDocTypesAsCertain());
 				$scope = $scope->assignVariable(
 					$var->name,
@@ -1305,6 +1324,9 @@ public function applyWrite(
 					TrinaryLogic::createYes(),
 					[],
 				);
+				foreach ($remappedConditionalExpressions as $exprString => $holders) {
+					$scope = $scope->addConditionalExpressions((string) $exprString, $holders); // @phpstan-ignore cast.useless
+				}
 				foreach ($conditionalExpressions as $exprString => $holders) {
 					$scope = $scope->addConditionalExpressions((string) $exprString, $holders);
 				}
@@ -2014,6 +2036,100 @@ private function processSureNotTypesForConditionalExpressionsAfterAssign(NodeSco
 		return $conditionalExpressions;
 	}
 
+	/**
+	 * `$var .= <single constant string>` keeps the conditional-expression
+	 * holders about $var alive by remapping them through the append instead of
+	 * losing them to the write's invalidation. A consequence type about $var is
+	 * concatenated with the appended constant; a condition on $var is remapped
+	 * only when it is itself a single constant string - appending a fixed
+	 * suffix is injective, so the remapped condition selects exactly the states
+	 * the original condition did. Holders mentioning $var inside a composite
+	 * expression, with a non-Yes certainty about $var, or with a non-constant
+	 * condition on $var are left to the regular invalidation. This keeps e.g. a
+	 * format string built across `if (!empty($target))` correlated with
+	 * $target while further pieces are appended.
+	 *
+	 * @param array<string, ConditionalExpressionHolder[]> $conditionalExpressions
+	 * @return array<string, ConditionalExpressionHolder[]>
+	 */
+	private function remapConditionalExpressionsThroughConcatAssign(
+		array $conditionalExpressions,
+		string $varExprString,
+		Type $appendedType,
+	): array
+	{
+		$appendedConstantStrings = $appendedType->getConstantStrings();
+		if (count($appendedConstantStrings) !== 1 || !$appendedType->equals($appendedConstantStrings[0])) {
+			return [];
+		}
+		$appendedConstantString = $appendedConstantStrings[0];
+
+		$remapped = [];
+		foreach ($conditionalExpressions as $targetExprString => $holders) {
+			$targetExprString = (string) $targetExprString; // @phpstan-ignore cast.useless
+			$targetIsVar = $targetExprString === $varExprString;
+			if (!$targetIsVar && str_contains($targetExprString, $varExprString)) {
+				// a composite target containing the variable ($var[0], f($var), ...)
+				continue;
+			}
+
+			foreach ($holders as $holder) {
+				$holderTouchesVar = $targetIsVar;
+				$remappable = true;
+				$newConditions = [];
+				foreach ($holder->getConditionExpressionTypeHolders() as $conditionExprString => $conditionHolder) {
+					$conditionExprString = (string) $conditionExprString; // @phpstan-ignore cast.useless
+					if ($conditionExprString === $varExprString) {
+						$holderTouchesVar = true;
+						$conditionConstantStrings = $conditionHolder->getType()->getConstantStrings();
+						if (
+							!$conditionHolder->getCertainty()->yes()
+							|| count($conditionConstantStrings) !== 1
+							|| !$conditionHolder->getType()->equals($conditionConstantStrings[0])
+						) {
+							$remappable = false;
+							break;
+						}
+						$newConditions[$conditionExprString] = ExpressionTypeHolder::createYes(
+							$conditionHolder->getExpr(),
+							$conditionConstantStrings[0]->append($appendedConstantString),
+						);
+						continue;
+					}
+
+					if (str_contains($conditionExprString, $varExprString)) {
+						$remappable = false;
+						break;
+					}
+
+					$newConditions[$conditionExprString] = $conditionHolder;
+				}
+				if (!$remappable || !$holderTouchesVar) {
+					continue;
+				}
+
+				$typeHolder = $holder->getTypeHolder();
+				if ($targetIsVar) {
+					if (!$typeHolder->getCertainty()->yes()) {
+						// the append leaves the variable defined on every path -
+						// an undefined/maybe consequence cannot be carried over
+						continue;
+					}
+					$concatType = $this->initializerExprTypeResolver->resolveConcatType($typeHolder->getType(), $appendedType);
+					if ($concatType instanceof ErrorType) {
+						continue;
+					}
+					$typeHolder = ExpressionTypeHolder::createYes($typeHolder->getExpr(), $concatType);
+				}
+
+				$newHolder = new ConditionalExpressionHolder($newConditions, $typeHolder);
+				$remapped[$targetExprString][$newHolder->getKey()] = $newHolder;
+			}
+		}
+
+		return $remapped;
+	}
+
 	/**
 	 * Records "if the assigned variable has $variableType, the target variable is
 	 * certainly defined (with its branch-scope type)" holders for variables whose

tests/PHPStan/Analyser/nsrt/bug-9854.php

@@ -0,0 +1,22 @@
+<?php declare(strict_types = 1);
+
+namespace Bug9854;
+
+use function PHPStan\Testing\assertType;
+
+$url = 'testUrl';
+$linkText = 'testLinkText';
+
+$htmlLinkStructure = '<a href="%s"';
+if (!empty($target)) {
+	$htmlLinkStructure .= ' target="%s"';
+}
+$htmlLinkStructure .= ' class="link">%s</a>';
+
+if (empty($target)) {
+	assertType('\'<a href="%s" class="link">%s</a>\'', $htmlLinkStructure);
+	return sprintf($htmlLinkStructure, $url, $linkText);
+}
+
+assertType('\'<a href="%s" target="%s" class="link">%s</a>\'', $htmlLinkStructure);
+return sprintf($htmlLinkStructure, $url, $target, $linkText);

tests/PHPStan/Rules/Functions/PrintfParametersRuleTest.php

@@ -160,4 +160,9 @@ public function testBug14567(): void
 		$this->analyse([__DIR__ . '/data/bug-14567.php'], []);
 	}
 
+	public function testBug9854(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-9854.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Functions/data/bug-9854.php

@@ -0,0 +1,16 @@
+<?php declare(strict_types = 1);
+
+$url = 'testUrl';
+$linkText = 'testLinkText';
+
+$htmlLinkStructure = '<a href="%s"';
+if (!empty($target)) {
+	$htmlLinkStructure .= ' target="%s"';
+}
+$htmlLinkStructure .= ' class="link">%s</a>';
+
+if (empty($target)) {
+	return sprintf($htmlLinkStructure, $url, $linkText);
+}
+
+return sprintf($htmlLinkStructure, $url, $target, $linkText);