Repository navigation
Read the native base type from native state when narrowing an expression that only has a PHPDoc holder in MutatingScope::applySpecifiedTypes() - #6808
Open
phpstan-bot wants to merge 1 commit into
Conversation
…ion that only has a PHPDoc holder in `MutatingScope::applySpecifiedTypes()` - When an expression had a Yes-certainty holder in expressionTypes but none in nativeExpressionTypes (e.g. `$s['projects']` placed only on the phpdoc side by the conditional expression of `$has = isset($s['projects'])`), the native result of a narrowing fell back to the phpdoc-derived specified type. That leaked `list<string>` into the native type through the foreach `iteratee !== []` narrowing, and caused a false function.alreadyNarrowedType with treatPhpDocTypesAsCertain: false. - Now the native base comes from getCurrentTypesOfSpecifiedExpr() in that case. This covers all three branches: sure narrowing, sure-not removal, and alternative-form terms. - Ported the same change to the native mirror in turbo-ext/src/MutatingScope.cpp. - Probed the analogous entry points (array_key_exists() stored in a variable, `!== []`, `!is_int()`, `is_array()`, property fetch `!== null` stored in a variable). They all went through the same code path and are covered by the new NSRT test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ondrejmirtes
force-pushed
the
create-pull-request/patch-4k5qdxd
branch
from
October 27, 2026 18:45
eb5aaa6 to
cbd408f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
With
treatPhpDocTypesAsCertain: false, storingisset($s['projects'])in a variable and checking that variable later made the PHPDoc type of$s['projects'](list<string>) show up as its native type. This caused a falsefunction.alreadyNarrowedTypeforis_string($p)inside aforeachover it. This PR makes narrowing take the native base type from native state, not from the PHPDoc-derived specified type.Changes
src/Analyser/MutatingScope.php(applySpecifiedTypes()): when an expression has a tracked PHPDoc type but no tracked native type, read the native base type viagetCurrentTypesOfSpecifiedExpr().turbo-ext/src/MutatingScope.cpp: the same change in the native mirror.$has = array_key_exists(...)$s['projects'] !== []!is_int($s['projects'])(the sure-not / removal branch)is_array($s['projects'])$has = $this->projects !== nullRoot cause
A conditional expression holder (
if $has=true then $s['projects'] is list<string>) is applied byprocessConditionalExpressionsAfterSpecifying()toexpressionTypesonly, so the expression ends up with a PHPDoc holder and no native holder. InapplySpecifiedTypes(), the native current type was only looked up when the PHPDoc side was untracked too. Otherwise$trackedNativeTypestayednull, and all three branches used the PHPDoc-derived type as the native result:: $type: $newType?? $trackedTypeThe foreach's
iteratee !== []narrowing then wrotenon-empty-list<string>as the native type of$s['projects']. Reading the native current type in this case fixes all three branches.Test
tests/PHPStan/Analyser/nsrt/bug-15404.php: the reproducer from the issue, the inline-isset()form, and the analogous cases above, withassertType()/assertNativeType(). Without the fix it fails at 4 sites:!== []!is_int()ImpossibleCheckTypeFunctionCallRuleWithUncertainPhpDocTypesTest::testBug15404: the reported false positive is no longer emitted. It fails without the fix.make testsandmake phpstanpass. The full suite also passes with the turbo extension loaded.turbo-ext/tests/smoke.phpandwalk-trace.phpover the default corpus report identical output.Fixes phpstan/phpstan#15404
🤖 Generated with Claude Code