Compare constant scalars refined by accessory types against other union members in TypeCombinator::union()

- `TypeCombinator::union()` buckets every type whose `isConstantScalarValue()` is yes into
  per-class scalar groups that are never compared with each other. An intersection such as
  `'Foo'&hasMethod(m1)` (produced by `method_exists()` / `property_exists()` on a constant
  class-string) landed in the `IntersectionType` bucket, so `'Foo'|('Foo'&hasMethod(m1))`
  was never collapsed to `'Foo'`.
- After N `method_exists($class, $method)` checks (e.g. a foreach over a constant array
  being unrolled) the type of `$class` grew to 2^N union members, making analysis time
  exponential.
- Such intersections now stay with the regular types, where `compareTypesInUnion()`
  absorbs them into the plain constant scalar or into a less refined intersection.
- Ported the same change to the native mirror in `turbo-ext/src/TypeCombinator.cpp`.
- Probed analogous constructs: `property_exists()` on a constant class-string had the same
  problem and is fixed by the same change (covered by the test); enum cases, objects and
  integers passed to `method_exists()`/`property_exists()` already collapsed correctly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: 2 people

phpstan-baseline.neon

@@ -1678,7 +1678,7 @@ parameters:
 		-
 			rawMessage: Doing instanceof PHPStan\Type\IntersectionType is error-prone and deprecated.
 			identifier: phpstanApi.instanceofType
-			count: 7
+			count: 8
 			path: src/Type/TypeCombinator.php
 
 		-

src/Type/TypeCombinator.php

@@ -420,7 +420,10 @@ public static function doUnion(Type ...$types): Type
 		$enumCaseTypes = [];
 		$integerRangeTypes = [];
 		for ($i = 0; $i < $typesCount; $i++) {
-			if ($types[$i]->isConstantScalarValue()->yes()) {
+			// a constant scalar refined by an accessory type ('Foo'&hasMethod(bar))
+			// stays with the other types so it is compared against the plain
+			// constant scalars and other refinements of the same value
+			if ($types[$i]->isConstantScalarValue()->yes() && !$types[$i] instanceof IntersectionType) {
 				$type = $types[$i];
 				$scalarTypes[get_class($type)][$type->describe(VerbosityLevel::cache())] = $type;
 				unset($types[$i]);

tests/PHPStan/Analyser/nsrt/bug-15591.php

@@ -0,0 +1,42 @@
+<?php declare(strict_types = 1);
+
+namespace Bug15591;
+
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+}
+
+function test(): void
+{
+	$class = Foo::class;
+	foreach (['m1', 'm2', 'm3', 'm4', 'm5', 'm6', 'm7', 'm8', 'm9', 'm10', 'm11', 'm12'] as $method) {
+		if (method_exists($class, $method)) {
+		}
+	}
+	assertType("'Bug15591\\\\Foo'", $class);
+}
+
+function testStraightLine(): void
+{
+	$class = Foo::class;
+	if (method_exists($class, 'm1')) {
+		assertType("'Bug15591\\\\Foo'&hasMethod(m1)", $class);
+	}
+	assertType("'Bug15591\\\\Foo'", $class);
+	if (method_exists($class, 'm2')) {
+		assertType("'Bug15591\\\\Foo'&hasMethod(m2)", $class);
+	}
+	assertType("'Bug15591\\\\Foo'", $class);
+}
+
+function testProperty(): void
+{
+	$class = Foo::class;
+	if (property_exists($class, 'p1')) {
+	}
+	if (property_exists($class, 'p2')) {
+	}
+	assertType("'Bug15591\\\\Foo'", $class);
+}

tests/bench/data/bug-15591.php

@@ -0,0 +1,16 @@
+<?php declare(strict_types = 1);
+
+namespace MethodExistsLoopRepro;
+
+class Foo
+{
+}
+
+function test(): void
+{
+	$class = Foo::class;
+	foreach (['m1', 'm2', 'm3', 'm4', 'm5', 'm6', 'm7', 'm8', 'm9', 'm10', 'm11', 'm12'] as $method) {
+		if (method_exists($class, $method)) {
+		}
+	}
+}

turbo-ext/src/TypeCombinator.cpp

@@ -1040,7 +1040,7 @@ class TypeCombinator
 			zval *type = types[i].raw();
 			zend_long isConstantScalarValue = callTrinary(type, PT_LC("isconstantscalarvalue"));
 			PT_FAIL_IF_NEG(isConstantScalarValue);
-			if (isConstantScalarValue == PT_TRI_YES) {
+			if (isConstantScalarValue == PT_TRI_YES && !isInstance(type, pt_ce_intersection_type)) {
 				zv::Val description = describe(type, cacheLevel);
 				zend_string *key = describedKey(description);
 				if (UNEXPECTED(key == NULL)) return zv::Val();