Enter the Closure::bind() scope for named arguments in any order

The visitor resolved the scope argument by name, but member accessibility went
through the bind-scope factory, which captured the un-normalized call and read
$newThis/$newScope from getArgs()[1]/[2] — the written positions. A reordered call
therefore kept a false positive and only its message changed
(outOfClass.self -> classConstant.protected).

Normalize the call inside the factory so both arguments are found at their parameter
positions. The rule test covers all six argument orders of the report.

Author: zonuexe

src/Analyser/ExprHandler/StaticCallHandler.php

@@ -126,7 +126,10 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 						// deferred until the closure argument is processed: with
 						// closures processed last, the bound $this/scope arguments
 						// are already evaluated on the scope the factory receives
-						$closureBindScopeFactory = static function (MutatingScope $boundScope) use ($expr): MutatingScope {
+						$closureBindScopeFactory = static function (MutatingScope $boundScope) use ($expr, $parametersAcceptor): MutatingScope {
+							// normalized so that $newThis and $newScope are found at their
+							// parameter positions even when the call names its arguments
+							$expr = ArgumentsNormalizer::reorderStaticCallArguments($parametersAcceptor, $expr) ?? $expr;
 							$thisType = null;
 							$nativeThisType = null;
 							if (isset($expr->getArgs()[1])) {

tests/PHPStan/Rules/Classes/ClassConstantRuleTest.php

@@ -192,6 +192,13 @@ public function testClassConstantVisibility(): void
 		]);
 	}
 
+	#[RequiresPhp('>= 8.0.0')]
+	public function testClosureBindNamedArguments(): void
+	{
+		$this->phpVersion = PHP_VERSION_ID;
+		$this->analyse([__DIR__ . '/data/closure-bind-named-arguments.php'], []);
+	}
+
 	public function testClassExists(): void
 	{
 		$this->phpVersion = PHP_VERSION_ID;

tests/PHPStan/Rules/Classes/data/closure-bind-named-arguments.php

@@ -0,0 +1,23 @@
+<?php // lint >= 8.0
+
+declare(strict_types = 1);
+
+namespace ClosureBindNamedArguments;
+
+use Closure;
+
+class Target
+{
+
+	protected const C = 'c';
+
+}
+
+// Every form binds the scope to Target, so accessing its protected constant is allowed
+// no matter how the arguments are written.
+Closure::bind(static fn () => self::C, null, Target::class);
+Closure::bind(closure: static fn () => self::C, newThis: null, newScope: Target::class);
+Closure::bind(closure: static fn () => self::C, newScope: Target::class, newThis: null);
+Closure::bind(newScope: Target::class, closure: static fn () => self::C, newThis: null);
+Closure::bind(static fn () => self::C, null, newScope: Target::class);
+Closure::bind(static fn () => self::C, newScope: Target::class, newThis: null);