Invalidate maybe-impure function return values after impure method/static calls

src/Analyser/TypeSpecifier.php

@@ -18,7 +18,9 @@
 use PhpParser\Node\Expr\PropertyFetch;
 use PhpParser\Node\Expr\StaticCall;
 use PhpParser\Node\Expr\StaticPropertyFetch;
+use PhpParser\Node\Identifier;
 use PhpParser\Node\Name;
+use PhpParser\NodeFinder;
 use PHPStan\Analyser\ExprHandler\BooleanAndHandler;
 use PHPStan\DependencyInjection\AutowiredService;
 use PHPStan\Node\Expr\AlwaysRememberedExpr;
@@ -2626,6 +2628,14 @@ private function createForExpr(
 			}
 		}
 
+		if (!($expr instanceof AlwaysRememberedExpr) && $this->expressionContainsNonPureCall($expr, $scope)) {
+			if (isset($containsNull) && !$containsNull) {
+				return $this->createNullsafeTypes($originalExpr, $scope, $context, $type);
+			}
+
+			return new SpecifiedTypes([], []);
+		}
+
 		$sureTypes = [];
 		$sureNotTypes = [];
 		if ($context->false()) {
@@ -2654,6 +2664,78 @@ private function createForExpr(
 		return $types;
 	}
 
+	private function expressionContainsNonPureCall(Expr $expr, Scope $scope): bool
+	{
+		$nodeFinder = new NodeFinder();
+		$found = $nodeFinder->findFirst([$expr], function (Node $node) use ($scope): bool {
+			if (!$node instanceof Expr) {
+				return false;
+			}
+
+			if ($node instanceof FuncCall) {
+				if ($node->name instanceof Name) {
+					if (!$this->reflectionProvider->hasFunction($node->name, $scope)) {
+						return true;
+					}
+					$hasSideEffects = $this->reflectionProvider->getFunction($node->name, $scope)->hasSideEffects();
+					return $hasSideEffects->yes()
+						|| (!$this->rememberPossiblyImpureFunctionValues && !$hasSideEffects->no());
+				}
+
+				$nameType = $scope->getType($node->name);
+				if ($nameType->isCallable()->yes()) {
+					$isPure = null;
+					foreach ($nameType->getCallableParametersAcceptors($scope) as $variant) {
+						$variantIsPure = $variant->isPure();
+						$isPure = $isPure === null ? $variantIsPure : $isPure->and($variantIsPure);
+					}
+					if ($isPure !== null) {
+						return $isPure->no()
+							|| (!$this->rememberPossiblyImpureFunctionValues && !$isPure->yes());
+					}
+				}
+
+				return false;
+			}
+
+			if ($node instanceof MethodCall) {
+				if ($node->name instanceof Identifier) {
+					$calledOnType = $scope->getType($node->var);
+					$methodReflection = $scope->getMethodReflection($calledOnType, $node->name->name);
+					if ($methodReflection === null) {
+						return true;
+					}
+					$hasSideEffects = $methodReflection->hasSideEffects();
+					return $hasSideEffects->yes()
+						|| (!$this->rememberPossiblyImpureFunctionValues && !$hasSideEffects->no());
+				}
+				return true;
+			}
+
+			if ($node instanceof StaticCall) {
+				if ($node->name instanceof Identifier) {
+					if ($node->class instanceof Name) {
+						$calledOnType = $scope->resolveTypeByName($node->class);
+					} else {
+						$calledOnType = $scope->getType($node->class);
+					}
+					$methodReflection = $scope->getMethodReflection($calledOnType, $node->name->name);
+					if ($methodReflection === null) {
+						return true;
+					}
+					$hasSideEffects = $methodReflection->hasSideEffects();
+					return $hasSideEffects->yes()
+						|| (!$this->rememberPossiblyImpureFunctionValues && !$hasSideEffects->no());
+				}
+				return true;
+			}
+
+			return false;
+		});
+
+		return $found !== null;
+	}
+
 	private function createNullsafeTypes(Expr $expr, Scope $scope, TypeSpecifierContext $context, ?Type $type): SpecifiedTypes
 	{
 		if ($expr instanceof Expr\NullsafePropertyFetch) {

tests/PHPStan/Analyser/nsrt/bug-13416.php

@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Bug13416;
+
+use function PHPStan\Testing\assertType;
+
+class MyRecord
+{
+	/** @var list<self> */
+	private static array $storage = [];
+
+	/**
+	 * @return list<self>
+	 * @phpstan-impure
+	 */
+	public static function find(): array
+	{
+		return self::$storage;
+	}
+
+	/** @phpstan-impure */
+	public function insert(): void
+	{
+		self::$storage[] = $this;
+	}
+
+	/**
+	 * @return non-empty-string
+	 * @phpstan-impure
+	 */
+	public function getName(): string
+	{
+		return 'test';
+	}
+}
+
+class Repository
+{
+	/**
+	 * @return list<MyRecord>
+	 * @phpstan-impure
+	 */
+	public function findAll(): array
+	{
+		return [];
+	}
+
+	/** @phpstan-impure */
+	public function save(MyRecord $record): void
+	{
+	}
+}
+
+function testImpureStaticCallNotNarrowedByCount(): void
+{
+	assert(count(MyRecord::find()) === 1);
+	// Impure call result should not be narrowed
+	assertType('int<0, max>', count(MyRecord::find()));
+}
+
+function testImpureMethodCallNotNarrowedByCount(): void
+{
+	$repo = new Repository();
+
+	assert(count($repo->findAll()) === 1);
+	// Impure call result should not be narrowed
+	assertType('int<0, max>', count($repo->findAll()));
+}
+
+function testStrlenOfImpureCallNotNarrowed(): void
+{
+	$record = new MyRecord();
+
+	assert(strlen($record->getName()) === 3);
+	// strlen wrapping an impure call should not be narrowed
+	assertType('int<1, max>', strlen($record->getName()));
+}
+
+function testPureFunctionStaysNarrowed(): void
+{
+	/** @var list<int> $arr */
+	$arr = [1];
+	assert(count($arr) === 1);
+	assertType('1', count($arr));
+
+	$x = rand(0, 10);
+
+	// Pure expressions stay narrowed
+	assertType('1', count($arr));
+}