Single-pass expression analysis groundwork - answer type questions from ExpressionResults

phpstan-baseline.neon

@@ -24,6 +24,12 @@ parameters:
 			count: 3
 			path: src/Analyser/ExprHandler/AssignHandler.php
 
+		-
+			rawMessage: Casting to string something that's already string.
+			identifier: cast.useless
+			count: 3
+			path: src/Analyser/ExprHandler/Helper/ConditionalExpressionHolderHelper.php
+
 		-
 			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantStringType is error-prone and deprecated. Use Type::getConstantStrings() instead.'
 			identifier: phpstanApi.instanceofType
@@ -36,40 +42,22 @@ parameters:
 			count: 2
 			path: src/Analyser/ExprHandler/BinaryOpHandler.php
 
-		-
-			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantBooleanType is error-prone and deprecated. Use Type::isTrue() or Type::isFalse() instead.'
-			identifier: phpstanApi.instanceofType
-			count: 1
-			path: src/Analyser/ExprHandler/BooleanNotHandler.php
-
-		-
-			rawMessage: 'Doing instanceof PHPStan\Type\ConstantScalarType is error-prone and deprecated. Use Type::isConstantScalarValue() or Type::getConstantScalarTypes() or Type::getConstantScalarValues() instead.'
-			identifier: phpstanApi.instanceofType
-			count: 2
-			path: src/Analyser/ExprHandler/Helper/EqualityTypeSpecifyingHelper.php
-
-		-
-			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantBooleanType is error-prone and deprecated. Use Type::isTrue() or Type::isFalse() instead.'
-			identifier: phpstanApi.instanceofType
-			count: 3
-			path: src/Analyser/ExprHandler/Helper/EqualityTypeSpecifyingHelper.php
-
 		-
 			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantStringType is error-prone and deprecated. Use Type::getConstantStrings() instead.'
 			identifier: phpstanApi.instanceofType
 			count: 2
-			path: src/Analyser/ExprHandler/IssetHandler.php
+			path: src/Analyser/ExprHandler/Helper/DefaultNarrowingHelper.php
 
 		-
 			rawMessage: 'Only numeric types are allowed in pre-increment, float|int|string|null given.'
 			identifier: preInc.nonNumeric
 			count: 1
-			path: src/Analyser/ExprHandler/PreIncHandler.php
+			path: src/Analyser/ExprHandler/Helper/IncDecTypeHelper.php
 
 		-
 			rawMessage: Casting to string something that's already string.
 			identifier: cast.useless
-			count: 2
+			count: 4
 			path: src/Analyser/MutatingScope.php
 
 		-
@@ -114,18 +102,6 @@ parameters:
 			count: 1
 			path: src/Analyser/RuleErrorTransformer.php
 
-		-
-			rawMessage: Casting to string something that's already string.
-			identifier: cast.useless
-			count: 2
-			path: src/Analyser/ScopeOps.php
-
-		-
-			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantBooleanType is error-prone and deprecated. Use Type::isTrue() or Type::isFalse() instead.'
-			identifier: phpstanApi.instanceofType
-			count: 2
-			path: src/Analyser/TypeSpecifier.php
-
 		-
 			rawMessage: 'Template type TNodeType is declared as covariant, but occurs in contravariant position in parameter node of method PHPStan\Collectors\Collector::processNode().'
 			identifier: generics.variance

src/Analyser/ArgsResult.php

@@ -0,0 +1,76 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PhpParser\Node\Expr;
+use PHPStan\Reflection\ParametersAcceptor;
+use function spl_object_id;
+
+/**
+ * Result of NodeScopeResolver::processArgs(): the scope/throw/impure state after
+ * processing all arguments (wrapped ExpressionResult) plus the ParametersAcceptor
+ * resolved from the arg types gathered on the arg-to-arg evolving scope. The
+ * resolved acceptor is type-driven (selectFromTypes) so its generics are resolved
+ * against the actual argument types - callers wire it into the call expression's
+ * stored return type. Null when the call had no variants (dynamic callee).
+ */
+final class ArgsResult
+{
+
+	/**
+	 * @param array<int, ExpressionResult> $argResults keyed by spl_object_id of each argument's value expression
+	 */
+	public function __construct(
+		private ExpressionResult $expressionResult,
+		private ?ParametersAcceptor $resolvedParametersAcceptor,
+		private array $argResults = [],
+	)
+	{
+	}
+
+	/**
+	 * The already-processed ExpressionResult of a call argument's value expression,
+	 * so callers read its type via the result instead of re-asking the scope.
+	 */
+	public function getArgResult(Expr $argValue): ?ExpressionResult
+	{
+		return $this->argResults[spl_object_id($argValue)] ?? null;
+	}
+
+	public function getScope(): MutatingScope
+	{
+		return $this->expressionResult->getScope();
+	}
+
+	public function hasYield(): bool
+	{
+		return $this->expressionResult->hasYield();
+	}
+
+	public function isAlwaysTerminating(): bool
+	{
+		return $this->expressionResult->isAlwaysTerminating();
+	}
+
+	/**
+	 * @return InternalThrowPoint[]
+	 */
+	public function getThrowPoints(): array
+	{
+		return $this->expressionResult->getThrowPoints();
+	}
+
+	/**
+	 * @return ImpurePoint[]
+	 */
+	public function getImpurePoints(): array
+	{
+		return $this->expressionResult->getImpurePoints();
+	}
+
+	public function getResolvedParametersAcceptor(): ?ParametersAcceptor
+	{
+		return $this->resolvedParametersAcceptor;
+	}
+
+}

src/Analyser/AssignTargetWalkMode.php

@@ -0,0 +1,64 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+/**
+ * How AssignHandler::prepareTarget() walks the assignment target.
+ *
+ * Besides whether target sub-expressions are walked inside
+ * enterExpressionAssign() scopes, the mode says whether the walk also prices
+ * the whole target as a read: `$lvalue OP= ...` reads the old value of
+ * `$lvalue`, and `$lvalue ??= ...` reads it with isset() semantics (no
+ * undefined-variable/uninitialized-property reports; the read carries the
+ * isset descriptor). The read happens inside the one target walk instead of
+ * callers re-processing the target with a noop callback.
+ *
+ * @internal
+ */
+final class AssignTargetWalkMode
+{
+
+	private function __construct(
+		private bool $enterExpressionAssign,
+		private bool $producesTargetReadResult,
+		private bool $issetSemanticsForRead,
+	)
+	{
+	}
+
+	public static function assign(): self
+	{
+		return new self(true, false, false);
+	}
+
+	public static function virtualAssign(): self
+	{
+		return new self(false, false, false);
+	}
+
+	public static function readModifyWrite(): self
+	{
+		return new self(false, true, false);
+	}
+
+	public static function coalesceReadModifyWrite(): self
+	{
+		return new self(true, true, true);
+	}
+
+	public function enterExpressionAssign(): bool
+	{
+		return $this->enterExpressionAssign;
+	}
+
+	public function producesTargetReadResult(): bool
+	{
+		return $this->producesTargetReadResult;
+	}
+
+	public function issetSemanticsForRead(): bool
+	{
+		return $this->issetSemanticsForRead;
+	}
+
+}

src/Analyser/ConditionalExpressionHolderRecipe.php

@@ -0,0 +1,118 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PhpParser\Node\Expr;
+use PHPStan\Type\NeverType;
+use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
+use function array_key_exists;
+
+/**
+ * A deferred description of the boolean-decomposition conditional holders
+ * (`&&` asserted false, `||` asserted true): the raw narrowing entries of the
+ * condition side and the holder side, captured where the boolean narrowing was
+ * composed. The state-dependent math - the condition complements against the
+ * current type, the holder target types, the vacuity checks - runs in
+ * evaluate() against the scope the narrowing is applied to
+ * (MutatingScope::applySpecifiedTypes()), never the scope the composition ran
+ * on.
+ */
+final class ConditionalExpressionHolderRecipe
+{
+
+	/**
+	 * @param list<array{string, Expr, bool, Type}> $conditionEntries [exprString, expr, fromSureTypes, type]
+	 * @param list<array{string, Expr, Type, ?Type}> $holderEntries [exprString, expr, type, target type pinned at compose time (null = read the applying scope)]
+	 */
+	public function __construct(
+		private array $conditionEntries,
+		private array $holderEntries,
+		private bool $holdersFromSureTypes,
+	)
+	{
+	}
+
+	/**
+	 * @return array<string, ConditionalExpressionHolder[]>
+	 */
+	public function evaluate(MutatingScope $scope): array
+	{
+		$conditionExpressionTypes = [];
+		$droppedNoOpConditions = [];
+		// the unnarrowed type of each condition expression, for the
+		// dropped-self-condition complement below
+		$conditionOriginalTypes = [];
+		foreach ($this->conditionEntries as [$exprString, $expr, $fromSureTypes, $type]) {
+			$scopeType = $scope->getStateType($expr);
+			$conditionType = $fromSureTypes
+				? TypeCombinator::remove($scopeType, $type)
+				: TypeCombinator::intersect($scopeType, $type);
+			if ($scopeType->equals($conditionType)) {
+				$droppedNoOpConditions[$exprString] = true;
+				continue;
+			}
+
+			$conditionExpressionTypes[$exprString] = ExpressionTypeHolder::createYes($expr, $conditionType);
+			$conditionOriginalTypes[$exprString] = $scopeType;
+		}
+
+		if ($conditionExpressionTypes === []) {
+			return [];
+		}
+
+		$holders = [];
+		foreach ($this->holderEntries as [$exprString, $expr, $type, $pinnedTargetType]) {
+			// The target's only link to the antecedent was a no-op relation (e.g.
+			// `$a === $b`) that got dropped, so the antecedent no longer constrains
+			// it. Projecting a consequent onto it would fire unsoundly. Skip it.
+			if (array_key_exists($exprString, $droppedNoOpConditions)) {
+				continue;
+			}
+
+			$conditions = $conditionExpressionTypes;
+			$droppedSelfCondition = null;
+			if (isset($conditions[$exprString])) {
+				$droppedSelfCondition = $conditions[$exprString];
+				unset($conditions[$exprString]);
+			}
+
+			if ($conditions === []) {
+				continue;
+			}
+
+			$targetType = $pinnedTargetType ?? $scope->getStateType($expr);
+			$holderType = $this->holdersFromSureTypes
+				? TypeCombinator::intersect($targetType, $type)
+				: TypeCombinator::remove($targetType, $type);
+
+			// The dropped self-condition narrowed the target; without it the
+			// holder must allow the values it excluded, or it over-narrows when
+			// only the remaining conditions hold. So union back the complement.
+			if ($droppedSelfCondition !== null) {
+				$complement = TypeCombinator::remove($conditionOriginalTypes[$exprString], $droppedSelfCondition->getType());
+				if (!$complement instanceof NeverType) {
+					$holderType = TypeCombinator::union($holderType, $complement);
+				}
+			}
+
+			// These boolean-decomposition holders only refine an expression's
+			// type in a future scope; they must never collapse it to never and
+			// thereby mark the whole scope unreachable. A never result is an
+			// artifact (e.g. removing a non-nullable property's full type after
+			// swapping isset() narrowing), not a real contradiction.
+			if ($holderType instanceof NeverType && !$targetType instanceof NeverType) {
+				continue;
+			}
+			$holder = new ConditionalExpressionHolder(
+				$conditions,
+				ExpressionTypeHolder::createYes($expr, $holderType),
+			);
+			$holders[$exprString] ??= [];
+			$holders[$exprString][$holder->getKey()] = $holder;
+		}
+
+		return $holders;
+	}
+
+}

src/Analyser/DeferredSpecifiedTypesAugment.php

@@ -0,0 +1,17 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+/**
+ * A state-dependent augmentation of a SpecifiedTypes, deferred to the
+ * application point: MutatingScope::applySpecifiedTypes() evaluates it against
+ * the applying scope and unions the produced entries into the applied batch.
+ * The composition captures only position-fixed facts (operand-walk reads);
+ * everything that must reflect the current state runs in evaluate().
+ */
+interface DeferredSpecifiedTypesAugment
+{
+
+	public function evaluate(MutatingScope $scope): ?SpecifiedTypes;
+
+}