Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Fix phpstan/phpstan#8270: False positive on array item modification#5189

Open
phpstan-bot wants to merge 1 commit intophpstan:2.1.xfrom
phpstan-bot:create-pull-request/patch-w8d4otm
Open

Fix phpstan/phpstan#8270: False positive on array item modification#5189
phpstan-bot wants to merge 1 commit intophpstan:2.1.xfrom
phpstan-bot:create-pull-request/patch-w8d4otm

Conversation

@phpstan-bot
Copy link
Collaborator

Summary

When modifying a sub-key of an array element at a non-constant offset (e.g., $list[$k]['test'] = true), PHPStan incorrectly concluded that ALL array items had the modified value. This caused false positives like "If condition is always true" when iterating over the array and checking the modified key.

Changes

  • Added shouldUnionExistingItemType() method in src/Analyser/ExprHandler/AssignHandler.php that checks whether a composed value changes existing constant-array key values
  • Modified produceArrayDimFetchAssignValueToWrite() to force unionValues=true at the outermost dimension when the composed value has conflicting key values with the existing item type
  • Updated test expectations in tests/PHPStan/Rules/Arrays/data/bug-11679.php and tests/PHPStan/Rules/Arrays/data/slevomat-foreach-array-key-exists-bug.php to match the more correct union behavior
  • Added regression test in tests/PHPStan/Analyser/nsrt/bug-8270.php

Root cause

In produceArrayDimFetchAssignValueToWrite(), nested array dimension assignments like $list[$k]['test'] = true are processed bottom-up. The inner dimension correctly computes the modified element value (e.g., array{test: true, value: int}). However, at the outer dimension, setOffsetValueType() was called with unionValues=false, which replaced the entire item type with the composed value. Since the offset key is non-constant (could match any element), this incorrectly assumed ALL elements had the new value.

The fix detects when the composed value changes existing key values (e.g., test: falsetest: true) by comparing key-by-key. When a conflict is found, it forces unionValues=true so the item type becomes the union of old and new (e.g., test: bool), correctly representing that some elements retain their original values.

The check is limited to the outermost dimension to avoid issues with deeply nested array building patterns (like bug-1388).

Test

Added tests/PHPStan/Analyser/nsrt/bug-8270.php with two test functions:

  1. A simple case with a @var-annotated non-empty-list and constant offset $list[0]['test'] = true
  2. A realistic case matching the original bug report: building a list in a loop, narrowing with array_key_first(), modifying one element, then iterating

Both verify that after modifying one element's sub-key, the foreach item type correctly shows bool (not true) for the modified key.

Fixes phpstan/phpstan#8270

- When modifying a sub-key of an array element at a non-constant offset
  (e.g. $list[$k]['test'] = true), PHPStan incorrectly replaced the item
  type for ALL elements instead of unioning with the original item type
- Added shouldUnionExistingItemType() check in AssignHandler to detect
  when the composed value changes existing constant-array key values,
  forcing a union to preserve unmodified elements' types
- Updated test expectations in bug-11679 and slevomat-foreach tests to
  reflect the more correct union behavior
- New regression test in tests/PHPStan/Analyser/nsrt/bug-8270.php

Closes phpstan/phpstan#8270
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant