Drop the foreach value alias on dynamic-variable writes to the iteratee

The value-variable alias projected onto $array[$key] is only sound while the
loop body cannot mutate the iteratee at a foreign key. foreachAliasDesyncingTarget
flagged such writes only when their target base was a statically named Variable
equal to the iteratee, so a dynamic-variable base slipped through: $$name[$key + 1]
(with $name = 'data') resolves to the iteratee at runtime and desyncs the live
element from the snapshot value variable, yet the alias survived and projected a
narrowed int onto $data[$key] whose sound type is int|string.

Make the detector conservatively complete - the alias is a pure precision
optimization, so any write target that cannot be proven to be exactly the
iteratee at the current key (or a distinctly named non-iteratee location) drops
it. A dim fetch whose base is a Variable with a non-string (Expr) name - a
variable-variable ($$name[...]) or a curly dynamic variable (${'data'}[...]) -
now desyncs, as does a bare dynamic-variable write ($$name = ...) that may target
the key or value variable, and a dynamic global ($$name). The #7508 same-key
sub-offset write ($array[$key][0] = ...) stays kept.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA

Author: ondrejmirtes

src/Analyser/StmtHandler/ForeachHandler.php

@@ -695,7 +695,12 @@ private function foreachAliasDesyncingNode(Node $node, string $iterateeName, str
 
 		if ($node instanceof Stmt\Global_) {
 			foreach ($node->vars as $var) {
-				if ($var instanceof Variable && is_string($var->name) && $var->name === $iterateeName) {
+				if (!$var instanceof Variable) {
+					continue;
+				}
+				// `global $iteratee` rebinds the iteratee to the global; a dynamic
+				// `global $$name` may rebind it too - drop the alias in both cases
+				if (!is_string($var->name) || $var->name === $iterateeName) {
 					return true;
 				}
 			}
@@ -741,6 +746,15 @@ private function foreachAliasDesyncingNode(Node $node, string $iterateeName, str
 		return false;
 	}
 
+	/**
+	 * Conservatively complete: the value alias is a pure precision optimization,
+	 * so any write target the analyzer cannot PROVE is exactly $iteratee[$key]
+	 * (or a sub-offset of it) or a distinctly named non-iteratee location drops
+	 * the alias. In particular a dynamic-variable base ($$name / ${expr}) may
+	 * resolve to the iteratee, key or value variable at runtime, so it always
+	 * desyncs; only a same-key iteratee write ($iteratee[$key]...) and writes to
+	 * provably distinct plain variables / non-variable storage are kept.
+	 */
 	private function foreachAliasDesyncingTarget(Expr $target, string $iterateeName, string $keyName): bool
 	{
 		if ($target instanceof List_ || $target instanceof Array_) {
@@ -756,20 +770,40 @@ private function foreachAliasDesyncingTarget(Expr $target, string $iterateeName,
 			return false;
 		}
 
-		// whole-iteratee reassignment ($iteratee = ...)
-		if ($target instanceof Variable && is_string($target->name) && $target->name === $iterateeName) {
-			return true;
+		if ($target instanceof Variable) {
+			// a dynamic $$name / ${expr} write may target the iteratee (or the key
+			// or value variable) - we cannot prove otherwise, so drop the alias
+			if (!is_string($target->name)) {
+				return true;
+			}
+
+			// whole-iteratee reassignment ($iteratee = ...); a plain write to a
+			// differently named variable (including a static write to the key or
+			// value variable, which is severed through containment) does not desync
+			// across iterations
+			return $target->name === $iterateeName;
 		}
 
-		// a write into the iteratee is safe only when the outermost access on the
-		// iteratee variable uses exactly the current key ($iteratee[$key]...); any
-		// other offset, or an append ($iteratee[]), may hit a future iteration's
-		// element
+		// A write into an array offset is safe only when it provably targets the
+		// iteratee at exactly the current key ($iteratee[$key]...) - keeping the
+		// #7508 same-key sub-offset case - or provably targets a distinctly named
+		// plain variable. Peel the ArrayDimFetch layers to the base variable; a
+		// dynamic-variable base ($$name[...]) that may be the iteratee, or an
+		// iteratee write at any other offset / an append ($iteratee[]), drops the
+		// alias. A non-variable base (a property, etc.) cannot rebind the plain
+		// iteratee variable and is kept.
 		$node = $target;
 		while ($node instanceof ArrayDimFetch) {
 			$inner = $node->var;
-			if ($inner instanceof Variable && is_string($inner->name) && $inner->name === $iterateeName) {
-				return !($node->dim instanceof Variable && is_string($node->dim->name) && $node->dim->name === $keyName);
+			if ($inner instanceof Variable) {
+				if (!is_string($inner->name)) {
+					return true;
+				}
+				if ($inner->name === $iterateeName) {
+					return !($node->dim instanceof Variable && is_string($node->dim->name) && $node->dim->name === $keyName);
+				}
+
+				return false;
 			}
 
 			$node = $inner;

tests/PHPStan/Analyser/nsrt/foreach-value-alias-soundness.php

@@ -42,6 +42,58 @@ function dynamicWrite(array $data): void
 	}
 }
 
+/**
+ * A dynamic-variable dim write ($$name is $data) into the iteratee at a foreign
+ * key desyncs the live element from the snapshot value variable, exactly like a
+ * statically named $data[$key + 1] write - the dynamic base must not slip past
+ * the alias detector.
+ *
+ * @param array<int|string> $data
+ */
+function dynamicDimWrite(array $data): void
+{
+	foreach ($data as $key => $value) {
+		$name = 'data';
+		$$name[$key + 1] = 'str';
+		if (is_int($value)) {
+			assertType('int|string', $data[$key]);
+		}
+	}
+}
+
+/**
+ * A dynamic write to the key variable ($$name is $key) means $data[$key] no
+ * longer refers to the snapshot value's element.
+ *
+ * @param array<int|string> $data
+ */
+function dynamicKeyWrite(array $data): void
+{
+	foreach ($data as $key => $value) {
+		$name = 'key';
+		$$name = 99;
+		if (is_int($value)) {
+			assertType('int|string', $data[$key]);
+		}
+	}
+}
+
+/**
+ * A curly-brace dynamic variable (${'data'}) is a Variable with an Expr name in
+ * the AST, so a dim write through it must be treated as a possible iteratee write.
+ *
+ * @param array<int|string> $data
+ */
+function curlyDynamicDimWrite(array $data): void
+{
+	foreach ($data as $key => $value) {
+		${'data'}[$key + 1] = 'str';
+		if (is_int($value)) {
+			assertType('int|string', $data[$key]);
+		}
+	}
+}
+
 /**
  * @param array<int|string> $data
  * @param array<string, mixed> $vars