Increase tracked ob_get_level() only in ob_start()'s truthy branch instead of unconditionally

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -571,8 +571,11 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			$scope = $scope->afterOpenSslCall($functionReflection->getName());
 		}
 
+		// Functions that only open the buffer on success (e.g. ob_start()) are handled
+		// by ObStartFunctionTypeSpecifyingExtension, so their level change is applied to
+		// the truthy branch only - an unchecked call may have failed.
 		$outputBufferDelta = $functionReflection !== null ? OutputBufferHelper::getLevelDelta($functionReflection->getName()) : 0;
-		if ($outputBufferDelta !== 0) {
+		if ($outputBufferDelta !== 0 && !OutputBufferHelper::opensBufferOnSuccess($functionReflection->getName())) {
 			$scope = OutputBufferHelper::applyLevelDelta($scope, $outputBufferDelta);
 		}
 

src/Analyser/ExprHandler/Helper/OutputBufferHelper.php

@@ -30,6 +30,16 @@ public static function getLevelDelta(string $functionName): int
 		return 0;
 	}
 
+	/**
+	 * Whether the function only opens the output buffer when it returns a truthy
+	 * value (e.g. `ob_start()`). The level increase must therefore be applied to
+	 * the truthy branch only, since an unchecked call may have failed.
+	 */
+	public static function opensBufferOnSuccess(string $functionName): bool
+	{
+		return in_array($functionName, self::LEVEL_INCREMENTING_FUNCTIONS, true);
+	}
+
 	public static function applyLevelDelta(MutatingScope $scope, int $delta): MutatingScope
 	{
 		foreach ([new Name('ob_get_level'), new Name\FullyQualified('ob_get_level')] as $name) {

src/Type/Php/ObStartFunctionTypeSpecifyingExtension.php

@@ -0,0 +1,70 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Type\Php;
+
+use PhpParser\Node\Expr\BinaryOp;
+use PhpParser\Node\Expr\FuncCall;
+use PhpParser\Node\Name;
+use PHPStan\Analyser\Scope;
+use PHPStan\Analyser\SpecifiedTypes;
+use PHPStan\Analyser\TypeSpecifier;
+use PHPStan\Analyser\TypeSpecifierAwareExtension;
+use PHPStan\Analyser\TypeSpecifierContext;
+use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\Node\Expr\TypeExpr;
+use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Type\Constant\ConstantIntegerType;
+use PHPStan\Type\FunctionTypeSpecifyingExtension;
+
+/**
+ * Opens the output buffer (increases the tracked `ob_get_level()`) only in the
+ * branch where `ob_start()` is known to have returned a truthy value. An
+ * unchecked `ob_start()` may have failed, so the buffer is not assumed active.
+ */
+#[AutowiredService]
+final class ObStartFunctionTypeSpecifyingExtension implements FunctionTypeSpecifyingExtension, TypeSpecifierAwareExtension
+{
+
+	private TypeSpecifier $typeSpecifier;
+
+	public function setTypeSpecifier(TypeSpecifier $typeSpecifier): void
+	{
+		$this->typeSpecifier = $typeSpecifier;
+	}
+
+	public function isFunctionSupported(
+		FunctionReflection $functionReflection,
+		FuncCall $node,
+		TypeSpecifierContext $context,
+	): bool
+	{
+		return $functionReflection->getName() === 'ob_start' && $context->truthy();
+	}
+
+	public function specifyTypes(
+		FunctionReflection $functionReflection,
+		FuncCall $node,
+		Scope $scope,
+		TypeSpecifierContext $context,
+	): SpecifiedTypes
+	{
+		$types = new SpecifiedTypes();
+		foreach ([new Name('ob_get_level'), new Name\FullyQualified('ob_get_level')] as $name) {
+			$obGetLevelCall = new FuncCall($name, []);
+			$newLevelType = $scope->getType(new BinaryOp\Plus(
+				new TypeExpr($scope->getType($obGetLevelCall)),
+				new TypeExpr(new ConstantIntegerType(1)),
+			));
+
+			$types = $types->unionWith($this->typeSpecifier->create(
+				$obGetLevelCall,
+				$newLevelType,
+				$context,
+				$scope,
+			)->setAlwaysOverwriteTypes());
+		}
+
+		return $types;
+	}
+
+}

tests/PHPStan/Analyser/nsrt/bug-14985.php

@@ -0,0 +1,26 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14985;
+
+use function PHPStan\Testing\assertType;
+
+function reproduce(): void
+{
+	// ob_start()'s success is not checked, so the buffer may not be active
+	// and ob_get_clean() may return false.
+	ob_start();
+	$a = ob_get_clean();
+	assertType('string|false', $a);
+	if ($a === false) {
+		echo 'false';
+	}
+}
+
+function checkedObStart(): void
+{
+	if (!ob_start()) {
+		return;
+	}
+	// here ob_start() is known to have succeeded, so the buffer is active
+	assertType('string', ob_get_clean());
+}