Fix phpstan/phpstan#10345: Array inside object used in anonymous function assumed to be empty ("Empty array passed to foreach")

[phpstan-bot]

Summary

When an object with a dynamic property (e.g. stdClass) was captured by use in an anonymous function, PHPStan incorrectly froze the property's type at closure definition time. This caused false positives like "Empty array passed to foreach" when the property was modified between closure definition and invocation.

Changes

• Added shouldNotCarryForwardPropertyFetchInClosure() method in src/Analyser/MutatingScope.php to check whether a PropertyFetch expression type should be excluded from forwarding into closure scope
• The check only excludes property fetches on objects that don't have the property as a native/declared property (i.e., dynamic properties like those on stdClass)
• Property fetches on objects with declared properties (e.g. MethodCall::$name) still carry forward type narrowings from instanceof checks
• Added regression test in tests/PHPStan/Rules/Arrays/data/bug-10345.php and test method in DeadForeachRuleTest.php

Root cause

In MutatingScope::enterAnonymousFunctionWithoutReflection(), expression type holders for non-ref captured variables were carried forward into the closure scope, including PropertyFetch expressions. For objects captured by value, this froze the property type at closure definition time. Since PHP objects are always references (even when captured by value via use), the object's properties can be modified externally before the closure is invoked. Dynamic properties (not declared in the class) are particularly prone to this because their types come entirely from assignment context rather than class declarations.

The fix checks whether the property is a native/declared property on the class. For dynamic properties (like on stdClass), the expression type holder is not carried forward, allowing the property to resolve to its natural type (mixed) inside the closure. For declared properties, type narrowings (e.g., from instanceof checks) are still carried forward as before.

Test

Added testBug10345 in DeadForeachRuleTest with a test data file that reproduces the exact scenario from the issue: a stdClass with an empty array property captured by a closure, where the property is later populated before invocation. The test expects no errors.

Fixes phpstan/phpstan#10345