Narrow the foreach source offset when the value variable is narrowed - #6386
Open
ondrejmirtes wants to merge 4 commits into
Open
Narrow the foreach source offset when the value variable is narrowed#6386ondrejmirtes wants to merge 4 commits into
ondrejmirtes wants to merge 4 commits into
Conversation
…ratee dim fetch Inside foreach ($array as $key => $value), the value variable and $array[$key] hold the same runtime value until any of $value, $key or the iteratee is written. enterForeach() now records that alias (ForeachValueAliasExpr, invalidated through containment of all three participating expressions), and applySpecifiedTypes() intersects a narrowing landed on the value variable into the tracked dim fetch holder while the link is intact. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA
…nt path The value-variable alias projected onto $array[$key] relied on every write to the value, key or iteratee variable severing the link through the assignment-time containment invalidation. Several paths bypass that walk: a by-ref closure use (processClosureScope), extract() and a dynamic $$name write update variable holders directly, so drop the aliases there. And because foreach iterates a snapshot, a cross-iteration write into the iteratee desyncs the live element from the snapshot value variable - do not record the alias when the loop body mutates the iteratee at a foreign key, reassigns the iteratee, or lets it escape by reference; a same-key write ($array[$key] = ...) is still kept. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA
The value-variable alias projected onto $array[$key] is only sound while the
loop body cannot mutate the iteratee at a foreign key. foreachAliasDesyncingTarget
flagged such writes only when their target base was a statically named Variable
equal to the iteratee, so a dynamic-variable base slipped through: $$name[$key + 1]
(with $name = 'data') resolves to the iteratee at runtime and desyncs the live
element from the snapshot value variable, yet the alias survived and projected a
narrowed int onto $data[$key] whose sound type is int|string.
Make the detector conservatively complete - the alias is a pure precision
optimization, so any write target that cannot be proven to be exactly the
iteratee at the current key (or a distinctly named non-iteratee location) drops
it. A dim fetch whose base is a Variable with a non-string (Expr) name - a
variable-variable ($$name[...]) or a curly dynamic variable (${'data'}[...]) -
now desyncs, as does a bare dynamic-variable write ($$name = ...) that may target
the key or value variable, and a dynamic global ($$name). The #7508 same-key
sub-offset write ($array[$key][0] = ...) stays kept.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA
Collaborator
|
You've opened the pull request against the latest branch 2.3.x. PHPStan 2.3 is not going to be released for months. If your code is relevant on 2.2.x and you want it to be released sooner, please rebase your pull request and change its target to 2.2.x. |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CGhnJQpUWRRpg6H5LuWJkA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Inside
foreach ($data as $key => $value), narrowing the value variable now also narrows the aliased source element$data[$key]for the current iteration, because they are two names for one runtime value.The alias is a pure precision optimisation, so it is dropped conservatively whenever a write could desync it from the value variable — writes that bypass the assignment path (by-reference closure use,
extract(), dynamic-variable writes), cross-iteration writes into the iteratee, and any write whose target cannot be proven to be exactly the current key. The same-key sub-offset write is kept.Two follow-up commits close the soundness holes found during review; the file is not shadowed by the turbo extension. Regression tests cover the fix and the bypass shapes; the full
NodeScopeResolverTeststays green and a local issue-bot run confirms the fix plus one collateral fix (#12500) with no regressions.Closes phpstan/phpstan#7508
Closes phpstan/phpstan#12500
🤖 Generated with Claude Code