Check isFirstClassCallable() before calling getArgs() on nested FuncCall nodes

[phpstan-bot]

Summary

PHPStan crashes with assert(!$this->isFirstClassCallable()) when using first-class callable syntax with certain array functions like array_key_last(...), array_key_first(...), array_rand(...), etc. The crash occurs because getArgs() is called on nested FuncCall nodes without first checking whether the call is a first-class callable.

Changes

• src/Analyser/TypeSpecifier.php — Added !$expr->isFirstClassCallable() checks before getArgs() calls in all patterns that match function names on nested FuncCall nodes within assignments and comparisons:

  • array_key_first/array_key_last assignment pattern (line ~829)
  • array_rand assignment pattern (line ~885)
  • array_search assignment pattern (line ~942)
  • count/sizeof - 1 assignment pattern (line ~917)
  • count/sizeof comparison patterns (lines ~251, ~279, ~382)
  • preg_match comparison pattern (line ~408)
  • strlen/mb_strlen comparison pattern (line ~425)
  • gettype, get_parent_class, get_class/get_debug_type equality patterns (lines ~1609, ~1649, ~2765)
  • trim/ltrim/rtrim equality pattern (line ~1691)
  • count/sizeof identical/equal comparison patterns (lines ~2909, ~2920)

• src/Analyser/NodeScopeResolver.php — Added guards for:

  • array_keys in foreach expression handling (line ~4142)
  • count/sizeof in for-loop condition patterns (lines ~4818, ~4842)

• src/Analyser/ExprHandler/AssignHandler.php — Added guards for:

  • count/sizeof in $list[count($list) - n] list-preservation check
  • array_key_first/array_key_last in $list[array_key_last($list)] list-preservation check
  • array_search in $list[array_search($needle, $list)] list-preservation check

• src/Rules/Arrays/NonexistentOffsetInArrayDimFetchRule.php — Added guards for:

  • array_rand dim fetch pattern (already had the check for array_key_first/array_key_last)
  • count/sizeof - 1 dim fetch pattern

Analogous cases probed and found already correct

• Parser visitors (ArrayMapArgVisitor, ArrayFilterArgVisitor, etc.) — all 14 visitors already check isFirstClassCallable()
• ImpossibleCheckTypeHelper.php — protected by function-level guard at entry + callers that don't pass first-class callables
• ConstantConditionRuleHelper.php — explicitly checks !$expr->isFirstClassCallable() before calling findSpecifiedType
• InitializerExprTypeResolver.php — has top-level isFirstClassCallable() guard
• FuncCallHandler.php — supports() method already rejects first-class callables

Root cause

The TypeSpecifier is called with original AST nodes (not the converted FunctionCallableNode equivalents). When processing assignments like $fn = array_key_last(...), the TypeSpecifier checks if the RHS is a FuncCall named array_key_first/array_key_last and calls getArgs() to access the function arguments. However, array_key_last(...) is a first-class callable where getArgs() triggers an assertion failure because first-class callables use VariadicPlaceholder arguments, not real Arg nodes.

The top-level guard in TypeSpecifier::specifyTypesInCondition() (line 138) catches first-class callables that ARE the expression being analyzed, but not first-class callables that are NESTED inside assignments, comparisons, or array dim fetches. The same pattern exists in NodeScopeResolver, AssignHandler, and NonexistentOffsetInArrayDimFetchRule.

Test

Added tests/PHPStan/Analyser/nsrt/bug-14550.php — an NSRT test that creates first-class callables of array_key_first, array_key_last, array_rand, and array_search, and asserts their types. Without the fix, this crashes with assert(!$this->isFirstClassCallable()).

Fixes phpstan/phpstan#14550

[staabm]

Turn this into a AnalyserIntegrationTest as we are covering crash bugs

[phpstan-bot]

Done. Converted the bug-14550 test from an NSRT test (tests/PHPStan/Analyser/nsrt/bug-14550.php) to an AnalyserIntegrationTest (tests/PHPStan/Analyser/data/bug-14550.php), since this is a crash bug. The test data file was simplified to remove assertType() calls (not needed for crash prevention), and a testBug14550() method was added to AnalyserIntegrationTest that verifies the analysis completes without crashing. All 11,941 tests pass and make phpstan reports no errors.