Skip to content

PHPStan ArrayHandler::getCallableDependencies() guard leaks in method bodies, functions, param defaults, and closures, reflecting full classes on 2-element string arrays - #6758

Open
alfredbez wants to merge 1 commit into
phpstan:2.3.xfrom
alfredbez:fix/callable-array-dependency-guard-leak
Open

alfredbez wants to merge 1 commit into
phpstan:2.3.xfrom
alfredbez:fix/callable-array-dependency-guard-leak

Conversation

@alfredbez

Copy link
Copy Markdown
Contributor

In ArrayHandler::getCallableDependencies(), the guard introduced in PR #6559 only skips class-level scopes ($scope->getFunction() === null). In method bodies, functions, parameter defaults, and closures, any 2-element array literal ['SomeClass', 'string_literal'] whose first element resolves to an existing class name triggers ConstantArrayType::isCallable(). This calls hasMethod() and reflects the entire class into memory, causing large memory spikes for monolithic classes.

Reproducer

class BigContainer
{
}

class Service
{
    public function check(string $item): bool
    {
        $modes = ['BigContainer', 'packstation'];
        return in_array($item, $modes, true);
    }
}

Expected Behavior

Two-element array literals whose first element is a plain string scalar or not currently within a function call should not reflect the named class as a callable. getCallableDependencies() should only collect callable dependencies when an active function call is in progress and the first element is an explicit ClassConstFetch (Foo::class).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant