Infer rand() with $min greater than $max as the swapped range

rand() swaps the arguments when $min is greater than $max, so rand(5, 1)
returns an int between 1 and 5, but it was inferred as never like
random_int() and mt_rand(), which throw ValueError for such arguments.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dhb4ssXuKVWcVBcNFpsdn7

Author: ondrejmirtes

src/Type/Php/RandomIntFunctionReturnTypeExtension.php

@@ -10,6 +10,7 @@
 use PHPStan\Type\DynamicFunctionReturnTypeExtension;
 use PHPStan\Type\IntegerRangeType;
 use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
 use PHPStan\Type\UnionType;
 use function array_map;
 use function assert;
@@ -41,6 +42,13 @@ public function getTypeFromFunctionCall(FunctionReflection $functionReflection,
 		$minType = $scope->getType($args[0]->value)->toInteger();
 		$maxType = $scope->getType($args[1]->value)->toInteger();
 
+		if ($functionReflection->getName() === 'rand') {
+			// rand() swaps the arguments when $min is greater than $max
+			$bothType = TypeCombinator::union($minType, $maxType);
+
+			return $this->createRange($bothType, $bothType);
+		}
+
 		return $this->createRange($minType, $maxType);
 	}
 

tests/PHPStan/Analyser/nsrt/rand-swapped-arguments.php

@@ -0,0 +1,18 @@
+<?php declare(strict_types = 1);
+
+namespace RandSwappedArguments;
+
+use function PHPStan\Testing\assertType;
+
+function doFoo(int $i): void
+{
+	assertType('int<1, 5>', rand(5, 1));
+	assertType('int<-5, 5>', rand(5, -5));
+	assertType('int<1, 10>', rand(10, random_int(1, 5)));
+
+	\assert($i >= 0);
+	assertType('int<0, max>', rand($i, 0));
+
+	assertType('*NEVER*', mt_rand(5, 1));
+	assertType('*NEVER*', random_int(5, 1));
+}