From c7047997008e80cbe2008455268b0d36c57d6ca8 Mon Sep 17 00:00:00 2001
From: phpstan-bot <79867460+phpstan-bot@users.noreply.github.com>
Date: Sun, 25 Oct 2026 07:16:14 +0000
Subject: [PATCH] Require the union with the other branch's type to equal the
 consequent before rescuing a one-sided conditional holder

- MutatingScope::preserveVacuousConditionalExpressions() kept a conditional
  holder present in only one branch when the other branch's state was a
  subtype of the holder's consequent. Without bleeding edge, array shapes are
  unsealed in isSuperTypeOf(), so array{}|array{a?: T} counted as a supertype
  of array{a?: T, b: T}. Applying that holder later dropped the 'b' key,
  which caused false positives such as "Offset ... on left side of ?? does
  not exist".
- Now also require TypeCombinator::union(consequent, other) to equal the
  consequent, so the other branch's state adds nothing to it.
- Ported the same check to turbo-ext/src/MutatingScope.cpp.
- Probed the other isSuperTypeOf() uses in the conditional-holder machinery
  (vacuous-guard check, ScopeOps guard matching, StatementsHandler loop
  holders). They compare guards rather than check that a consequent still
  holds, so they don't have this problem.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/Analyser/MutatingScope.php                |  8 +++
 tests/PHPStan/Analyser/Bug15534Test.php       | 29 ++++++++
 tests/PHPStan/Analyser/data/bug-15534.php     | 38 +++++++++++
 .../NullCoalesceRuleNoBleedingEdgeTest.php    | 44 +++++++++++++
 .../Rules/Variables/data/bug-15534.php        | 66 +++++++++++++++++++
 turbo-ext/src/MutatingScope.cpp               |  8 +++
 6 files changed, 193 insertions(+)
 create mode 100644 tests/PHPStan/Analyser/Bug15534Test.php
 create mode 100644 tests/PHPStan/Analyser/data/bug-15534.php
 create mode 100644 tests/PHPStan/Rules/Variables/NullCoalesceRuleNoBleedingEdgeTest.php
 create mode 100644 tests/PHPStan/Rules/Variables/data/bug-15534.php

diff --git a/src/Analyser/MutatingScope.php b/src/Analyser/MutatingScope.php
index 85867200a20..667e388a0ac 100644
--- a/src/Analyser/MutatingScope.php
+++ b/src/Analyser/MutatingScope.php
@@ -4557,6 +4557,14 @@ private function preserveVacuousConditionalExpressions(
 					continue;
 				}
 
+				// Array shapes are unsealed in isSuperTypeOf(): array{a?: int} is a supertype
+				// of array{a?: int, b: int}, yet applying the holder would drop the 'b' key
+				// the other branch tracks. The consequent only holds on both paths when the
+				// other branch's state adds nothing to it.
+				if (!TypeCombinator::union($typeHolder->getType(), $otherTargetHolder->getType())->equals($typeHolder->getType())) {
+					continue;
+				}
+
 				$currentConditionalExpressions[$exprString][$key] = $holder;
 			}
 		}
diff --git a/tests/PHPStan/Analyser/Bug15534Test.php b/tests/PHPStan/Analyser/Bug15534Test.php
new file mode 100644
index 00000000000..f0314f12fb8
--- /dev/null
+++ b/tests/PHPStan/Analyser/Bug15534Test.php
@@ -0,0 +1,29 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PHPStan\Testing\TypeInferenceTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+class Bug15534Test extends TypeInferenceTestCase
+{
+
+	public static function dataFileAsserts(): iterable
+	{
+		yield from self::gatherAssertTypes(__DIR__ . '/data/bug-15534.php');
+	}
+
+	/**
+	 * @param mixed ...$args
+	 */
+	#[DataProvider('dataFileAsserts')]
+	public function testFileAsserts(
+		string $assertType,
+		string $file,
+		...$args,
+	): void
+	{
+		$this->assertFileAsserts($assertType, $file, ...$args);
+	}
+
+}
diff --git a/tests/PHPStan/Analyser/data/bug-15534.php b/tests/PHPStan/Analyser/data/bug-15534.php
new file mode 100644
index 00000000000..44b780ab1b4
--- /dev/null
+++ b/tests/PHPStan/Analyser/data/bug-15534.php
@@ -0,0 +1,38 @@
+<?php declare(strict_types=1);
+
+namespace Bug15534Types;
+
+use function PHPStan\Testing\assertType;
+
+function isEnabled(): bool { return (bool) rand(0, 1); }
+function otherEnabled(): bool { return (bool) rand(0, 1); }
+function getSavedPost(string $key): ?string { return rand(0, 1) === 1 ? $key : null; }
+
+function doFoo(): void
+{
+	$post = [];
+	if (getSavedPost('field0')) {
+		$post['field0'] = getSavedPost('field0');
+	}
+	if (getSavedPost('field1')) {
+		$post['field1'] = getSavedPost('field1');
+	}
+	if (otherEnabled()) {
+		if (getSavedPost('other0')) {
+			$post['other0'] = 'o';
+		}
+	}
+
+	if (isEnabled()) {
+		if (getSavedPost('c')) {
+			$post['company_address'] = 'c';
+		}
+	}
+
+	if (!otherEnabled()) {
+		assertType("array{}|array{field0?: non-falsy-string, field1?: non-falsy-string, other0?: 'o', company_address?: 'c'}", $post);
+	}
+	if (isEnabled()) {
+		assertType("array{}|array{field0?: non-falsy-string, field1?: non-falsy-string, other0?: 'o', company_address?: 'c'}", $post);
+	}
+}
diff --git a/tests/PHPStan/Rules/Variables/NullCoalesceRuleNoBleedingEdgeTest.php b/tests/PHPStan/Rules/Variables/NullCoalesceRuleNoBleedingEdgeTest.php
new file mode 100644
index 00000000000..f340133c45e
--- /dev/null
+++ b/tests/PHPStan/Rules/Variables/NullCoalesceRuleNoBleedingEdgeTest.php
@@ -0,0 +1,44 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Rules\Variables;
+
+use Override;
+use PHPStan\Rules\Comparison\ConstantConditionInTraitHelper;
+use PHPStan\Rules\IssetCheck;
+use PHPStan\Rules\Properties\PropertyDescriptor;
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+
+/**
+ * Array shapes are unsealed without bleeding edge.
+ *
+ * @extends RuleTestCase<NullCoalesceRule>
+ */
+class NullCoalesceRuleNoBleedingEdgeTest extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		return new NullCoalesceRule(
+			new IssetCheck(
+				new PropertyDescriptor(),
+				true,
+				$this->shouldTreatPhpDocTypesAsCertain(),
+			),
+			self::getContainer()->getByType(ConstantConditionInTraitHelper::class),
+			true,
+		);
+	}
+
+	#[Override]
+	public static function getAdditionalConfigFiles(): array
+	{
+		return [];
+	}
+
+	public function testBug15534(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-15534.php'], []);
+	}
+
+}
diff --git a/tests/PHPStan/Rules/Variables/data/bug-15534.php b/tests/PHPStan/Rules/Variables/data/bug-15534.php
new file mode 100644
index 00000000000..4c2aca54d6d
--- /dev/null
+++ b/tests/PHPStan/Rules/Variables/data/bug-15534.php
@@ -0,0 +1,66 @@
+<?php declare(strict_types=1);
+
+namespace Bug15534;
+
+function isEnabled(): bool
+{
+    return (bool) ($GLOBALS['enabled'] ?? false);
+}
+
+function isVisible(): bool
+{
+    return (bool) ($GLOBALS['visible'] ?? false);
+}
+
+function otherEnabled(): bool
+{
+    return (bool) ($GLOBALS['other'] ?? false);
+}
+
+function getSavedPost(string $key): ?string
+{
+    if (!isset($_SESSION[$key]) || !is_string($_SESSION[$key])) {
+        return null;
+    }
+
+    return (string) $_SESSION[$key];
+}
+
+function translate(string $key): string
+{
+    return $key;
+}
+
+$post = [];
+
+if (getSavedPost('field0')) {
+    $post['field0'] = getSavedPost('field0');
+}
+if (getSavedPost('field1')) {
+    $post['field1'] = getSavedPost('field1');
+}
+
+if (otherEnabled()) {
+    if (getSavedPost('other0')) {
+        $post['other0'] = getSavedPost('other0');
+    }
+}
+
+if (isEnabled()) {
+    if (getSavedPost('company_address')) {
+        $post['company_address'] = getSavedPost('company_address');
+    }
+}
+
+if (isVisible() && !isEnabled()) {
+    echo 'other';
+}
+
+if (isVisible() && !otherEnabled()) {
+    echo translate(isEnabled() ? 'enabled' : 'disabled');
+}
+
+if (isEnabled()) {
+    echo $post['company_address'] ?? '';
+}
+
diff --git a/turbo-ext/src/MutatingScope.cpp b/turbo-ext/src/MutatingScope.cpp
index 1138b46ed9a..b110d7675da 100644
--- a/turbo-ext/src/MutatingScope.cpp
+++ b/turbo-ext/src/MutatingScope.cpp
@@ -8565,6 +8565,14 @@ class MutatingScope
 				bool yes;
 				if (UNEXPECTED(!isSuperTypeOfYes(Z_OBJ_P(typeHolderType.raw()), otherTargetType.raw(), yes))) return zv::Val();
 				if (!yes) continue;
+				/* array shapes are unsealed in isSuperTypeOf() - the consequent
+				 * only holds on both paths when the other branch's state adds
+				 * nothing to it */
+				zv::Val united = unionTypes(typeHolderType.raw(), otherTargetType.raw());
+				if (UNEXPECTED(united.isUndef())) return zv::Val();
+				bool unchanged;
+				if (UNEXPECTED(!typeEquals(united.raw(), typeHolderType.raw(), unchanged))) return zv::Val();
+				if (!unchanged) continue;
 				if (UNEXPECTED(!appendConditionalHolder(result, exprKey, exprIndex, key, keyIndex, holder))) return zv::Val();
 			}
 		}