Keep the expression result alive in the native ReturnHandler

The native processStmt() read the throw points, impure points and
dependencies of the returned expression as pointers into its
ExpressionResult. The result was released at the end of the inner block,
before the node callback ran. A rule that called getType() from that
callback could then reuse the freed memory, and the statement result got
an unrelated object as its impure points.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: 2 people

tests/PHPStan/Analyser/ReturnedExprGetTypeRule.php

@@ -0,0 +1,38 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PhpParser\Node;
+use PhpParser\Node\Stmt\ClassMethod;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\NodeFinder;
+use PHPStan\Rules\Rule;
+
+/**
+ * Asks the type of a method's returned expression from the callback for the
+ * method itself, after the walk of the body is complete. The test only checks
+ * that this does not crash.
+ *
+ * @implements Rule<ClassMethod>
+ */
+class ReturnedExprGetTypeRule implements Rule
+{
+
+	public function getNodeType(): string
+	{
+		return ClassMethod::class;
+	}
+
+	public function processNode(Node $node, Scope $scope): array
+	{
+		$return = (new NodeFinder())->findFirstInstanceOf((array) $node->stmts, Return_::class);
+		if ($return === null || $return->expr === null) {
+			return [];
+		}
+
+		$scope->getType($return->expr);
+
+		return [];
+	}
+
+}

tests/PHPStan/Analyser/ReturnedExprGetTypeRuleTest.php

@@ -0,0 +1,26 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+use PHPUnit\Framework\Attributes\RequiresPhp;
+
+/**
+ * @extends RuleTestCase<ReturnedExprGetTypeRule>
+ */
+class ReturnedExprGetTypeRuleTest extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		return new ReturnedExprGetTypeRule();
+	}
+
+	#[RequiresPhp('>= 8.0.0')]
+	public function testRule(): void
+	{
+		$this->analyse([__DIR__ . '/data/returned-expr-get-type.php'], []);
+	}
+
+}

tests/PHPStan/Analyser/data/returned-expr-get-type.php

@@ -0,0 +1,27 @@
+<?php // lint >= 8.0
+
+declare(strict_types = 1);
+
+namespace ReturnedExprGetType;
+
+/** @template T */
+final class Bag {
+	/** @param list<T> $items */
+	public function __construct(private array $items) {}
+	/** @return list<T> */
+	public function all(): array { return $this->items; }
+}
+
+/**
+ * @template TReturnType
+ * @param callable(): TReturnType $callback
+ * @return TReturnType
+ */
+function once4(callable $callback) { return $callback(); }
+
+final class Box4 {
+	/** @return Bag<string> */
+	public function items(): Bag {
+		return once4(function (): Bag { return new Bag(['a']); });
+	}
+}

turbo-ext/src/ReturnHandler.cpp

@@ -79,6 +79,7 @@ class ReturnHandler
 		zval *throwPoints = &emptyArray;
 		zval *impurePoints = &emptyArray;
 		zval *dependencies = NULL;
+		zv::Val result;
 		zv::Val variableFlow;
 		expr = returnedExpr(stmt);
 		if (UNEXPECTED(expr == NULL)) return zv::Val();
@@ -96,7 +97,7 @@ class ReturnHandler
 				Z_TYPE_P(expectedReturnType.raw()) == IS_OBJECT ? expectedReturnType.raw() : NULL,
 				Z_TYPE_P(nativeExpectedReturnType.raw()) == IS_OBJECT ? nativeExpectedReturnType.raw() : NULL);
 			if (UNEXPECTED(expressionContext.isUndef())) return zv::Val();
-			zv::Val result = pt_node_scope_resolver_process_expr_node(nodeScopeResolver, stmt, expr, stmtScope.raw(), storage, nodeCallback, expressionContext.raw());
+			result = pt_node_scope_resolver_process_expr_node(nodeScopeResolver, stmt, expr, stmtScope.raw(), storage, nodeCallback, expressionContext.raw());
 			if (UNEXPECTED(result.isUndef())) return zv::Val();
 			dependencies = pt_expression_result_dependencies(result.raw(), dependenciesHold);
 			if (UNEXPECTED(dependencies == NULL)) return zv::Val();