An argument written as an array element, a global constant, or a simple

operator expression is no longer read as nothing

Author: AJenbo

docs/CHANGELOG.md

@@ -119,6 +119,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **An argument written as an array element, a global constant, or a simple operator expression is no longer read as nothing.** `str_replace()`, `preg_replace()`, and any `@template` binding all decide part of their answer from the argument's own source text, and several ordinary ways of writing that argument left them with nothing to go on: `str_replace('a', 'b', $data['message'])` where `$data` is `array{message: string}`, `preg_replace('/-.*/', '', PHP_VERSION)`, and `preg_replace('/\s+/', ' ', $body ?: '')` all kept the full undecided union of both replace branches, even though assigning the same expression to a variable first resolved it correctly. An array-shape or generic element now reads its own value type instead of only the class-backed results the general resolver reported; a bare identifier that names a global constant is read through the same constant lookup hover already uses; and concatenation (always `string`) and the elvis operator (the union of both sides) are read directly rather than being mistaken for a bare variable name.
 - **A fully-qualified type-guard call narrows like its unqualified spelling.** `\is_array($x)`, the style PHP-CS-Fixer's `native_function_invocation` rule enforces, kept the leading backslash in the function name PHPantom compared against `is_array`, `is_string`, and the rest, so the comparison never matched and the guard was silently ignored in both branches. The same held for `\is_a()`, `\class_exists()` and its siblings, and `\property_exists()`/`\method_exists()`. All four narrowing checks now strip a leading backslash before matching, so a project that fully qualifies its builtin calls narrows exactly as one that does not.
 - **Formatting a `.blade.php` file is a no-op.** `textDocument/formatting` handed Blade markup straight to the Pint/php-cs-fixer/phpcbf/mago pipeline with no check on the file's extension, so running "Format Document" on a template sent directives, `{{ }}` echoes, and component tags through a PHP formatter, which most likely errored out or produced nonsense edits. Formatting now returns no edits for a `.blade.php` file (matched the same way completion and hover already recognise Blade, so it also covers a file opened with a `blade` language ID that lacks the extension) until real Blade-aware formatting lands.
 - **An array literal whose keys are out of order no longer passes for a list.** `list{string, string}` and `list<string>` promise the keys run `0, 1, 2, …` in that order, which is what `array_is_list()` answers `true` for, and `[1 => 'x', 0 => 'y']` does not hold. PHPantom accepted it silently: a `list{…}` was read as the `array{…}` it prints as, and a shape's keys were never compared against the order a list requires. The promise is part of the type now, so a parameter written as a list is reported for a literal whose keys are reversed, gapped, or named, and the message says the order is the complaint rather than leaving two near-identical type expressions to be diffed by eye. Hover also spells such a parameter back the way it was written instead of widening it to an `array{…}`. Only a literal written out at the call site is judged, since an array built up across assignments lists the keys we saw in the order we saw them, which says nothing about the order the value's keys are really in.

docs/todo.md

@@ -98,7 +98,6 @@ unlikely to move the needle for most users.
 | D17 | [`docblock_native_mismatch` only judges nullability](todo/diagnostics.md#d17-docblock_native_mismatch-only-judges-nullability)                                              | Low         | Medium      |
 |     | **[Bug Fixes](todo/bugs.md)**                                                                                                                                               |             |             |
 | B125 | [A class narrowed by `instanceof` keeps an array alternative from before the check](todo/bugs.md#b125-a-class-narrowed-by-instanceof-keeps-an-array-alternative-from-before-the-check) | High        | Medium      |
-| B124 | [An argument's type is read from its source text, and several ordinary spellings read as nothing](todo/bugs.md#b124-an-arguments-type-is-read-from-its-source-text-and-several-ordinary-spellings-read-as-nothing) | Medium      | Medium      |
 |     | **[Code Actions](todo/actions.md)**                                                                                                                                         |             |             |
 | A40 | [Generate method from call](todo/actions.md#a40-generate-method-from-call)                                                                                                  | Medium-High | Medium      |
 | A41 | [Create class from non-existing name](todo/actions.md#a41-create-class-from-non-existing-name)                                                                              | Medium      | Medium      |

docs/todo/bugs.md

@@ -66,48 +66,3 @@ exact site before fixing.
 this exact `UploadedFile|array<UploadedFile>(|null)` shape, all following a
 correct `instanceof` guard in the source; one more instance in
 `projects/vytrvalec-server` uses a different class.
-
-### B124. An argument's type is read from its source text, and several ordinary spellings read as nothing
-
-**Impact: Medium · Effort: Medium**
-
-```php
-/** @param array{message: string} $data */
-function report(array $data, string $body): void {
-    $out = str_replace('a', 'b', $data['message']);   // array<array-key, string>|string
-    $subject = $data['message'];
-    $sameThing = str_replace('a', 'b', $subject);     // string — correct
-
-    $version = preg_replace('/-.*/', '', PHP_VERSION);   // array<array-key, string>|string
-    $trimmed = preg_replace('/\s+/', ' ', $body ?: ''); // array<array-key, string>|string
-}
-```
-
-`Backend::resolve_arg_text_to_type` is the shared "what type is this
-argument" helper that conditional return types and `@template` binding both
-consult, and it works from the argument's *source text*. It answers for
-literals, casts, variables, property chains, calls, `::class` and static
-access, but several ordinary spellings resolve to nothing:
-
-- an array element (`$data['message']`, `$rows[0]`): the general expression
-  path reports only class-backed results, so an element holding a scalar
-  comes back empty, and the raw-type fallback skips any text containing `[`
-  outright;
-- a global constant (`PHP_VERSION`, `PHP_EOL`): there is no constant branch,
-  and `ResolutionCtx` does not carry the constant loader that
-  `VarResolutionCtx` has, so one would have nothing to consult;
-- an operator expression (`$body ?: ''`, `$a . $b`, `$n + 1`): nothing reads
-  the operator, even where it alone decides the type.
-
-Assigning the same expression to a variable first resolves fine, so the
-answer depends on how the call was spelled. The visible effects are a
-conditional return type that stays undecided (and therefore returns the
-union of both branches, as `str_replace` does above) and a template
-parameter that stays unbound.
-
-**Fix:** each spelling needs its own small branch in the text resolver,
-answering with what the same expression resolves to when it is assigned to a
-variable first: array access via `SubjectExpr::ArrayAccess` plus the
-array-shape key lookup the forward walker already has, a global constant via
-the constant loader (which `ResolutionCtx` has to start carrying), and the
-operators whose result type is fixed regardless of their operands.

examples/demo.php

@@ -1152,6 +1152,20 @@ public function demo(): void
         $swappedAll = str_replace('a', 'b', ['banana', 'apple']);
         strtoupper($swappedAll[0]);               // array subject → array<array-key, string>
 
+        // The subject is read the same way spelled other ways too: an
+        // array-shape element, a global constant, and an elvis expression
+        // all rule out the array branch instead of leaving it undecided.
+        /** @var array{message: string} $shapeData */
+        $shapeData = ['message' => 'banana'];
+        $fromShape = str_replace('a', 'b', $shapeData['message']);
+        strtoupper($fromShape);                   // array-shape element subject → string
+        $fromConst = str_replace('.', '-', PHP_VERSION);
+        strtoupper($fromConst);                    // global constant subject → string
+        /** @var ?string $maybeBody */
+        $maybeBody = null;
+        $fromElvis = str_replace('a', 'b', $maybeBody ?: 'banana');
+        strtoupper($fromElvis);                    // elvis-operator subject → string
+
         // `preg_replace()` keeps its `null` error branch for a string
         // subject, where PCRE really can fail, and drops it for an array.
         $masked = preg_replace('/\d/', '*', 'a1b2') ?? '';
@@ -8309,6 +8323,15 @@ function runDemoAssertions(): void
     // ── Subject-keyed conditional return type (the replace family) ───────
     assert(str_replace('a', 'b', 'banana') === 'bbnbnb', 'a string subject replaces into a string');
     assert(str_replace('a', 'b', ['banana', 'apple']) === ['bbnbnb', 'bpple'], 'an array subject replaces into an array');
+
+    // ── Other ordinary subject spellings (the replace family) ────────────
+    /** @var array{message: string} $shapeData */
+    $shapeData = ['message' => 'banana'];
+    assert(str_replace('a', 'b', $shapeData['message']) === 'bbnbnb', 'an array-shape element subject replaces into a string');
+    assert(is_string(str_replace('.', '-', PHP_VERSION)), 'a global constant subject replaces into a string');
+    $maybeBody = null;
+    assert(str_replace('a', 'b', $maybeBody ?: 'banana') === 'bbnbnb', 'an elvis-operator subject replaces into a string');
+
     assert(preg_replace('/\d/', '*', 'a1b2') === 'a*b*', 'a string subject is replaced into a string');
     assert(preg_replace('/\d/', '*', ['a1', 'b2']) === ['a*', 'b*'], 'an array subject is replaced into an array');
     assert(substr_replace('banana', 'x', 0, 1) === 'xanana', 'a string subject is spliced into a string');

src/type_engine/call_resolution/return_types.rs

@@ -1959,6 +1959,141 @@ pub(super) fn resolve_cast_type(text: &str) -> Option<PhpType> {
     Some(PhpType::named(atom(name)))
 }
 
+/// The type an operator expression produces, for the operators whose
+/// answer can be read from the source text without a full parse.
+///
+/// Concatenation (`$a . $b`) always yields `string`, whatever its operands
+/// are. The elvis operator (`$body ?: ''`) yields the union of both sides —
+/// resolved recursively through [`Backend::resolve_arg_text_to_type`], the
+/// same way assigning the expression to a variable first would resolve
+/// through the AST-based `resolve_conditional_chain`.
+///
+/// A full three-part ternary (`$a ? $b : $c`) and arithmetic operators
+/// (`+`, `-`, `*`, …) are deliberately left unanswered here: arithmetic's
+/// result depends on whether its operands are int or float (and `+` alone
+/// can mean array union), which the source text can't decide without
+/// resolving both operands' concrete types.
+pub(super) fn resolve_operator_type(text: &str, ctx: &ResolutionCtx<'_>) -> Option<PhpType> {
+    if contains_top_level_concat(text) {
+        return Some(PhpType::named(atom("string")));
+    }
+    if let Some((left, right)) = split_top_level_elvis(text) {
+        let left_ty = Backend::resolve_arg_text_to_type(left, ctx);
+        let right_ty = Backend::resolve_arg_text_to_type(right, ctx);
+        return match (left_ty, right_ty) {
+            (Some(l), Some(r)) if l == r => Some(l),
+            (Some(l), Some(r)) => Some(PhpType::union(vec![l, r])),
+            (Some(l), None) => Some(l),
+            (None, Some(r)) => Some(r),
+            (None, None) => None,
+        };
+    }
+    None
+}
+
+/// Whether `text` contains a concatenation (`.`) outside quotes, parens,
+/// brackets, and `->`/`?->` chain links.
+///
+/// A pure numeric literal (`3.14`) is already answered by
+/// [`resolve_literal_type`] before this runs, so any `.` reaching this scan
+/// belongs to a genuine concatenation rather than a decimal point.
+fn contains_top_level_concat(text: &str) -> bool {
+    let bytes = text.as_bytes();
+    let mut depth: u32 = 0;
+    let mut quote: Option<u8> = None;
+    let mut i = 0;
+    while i < bytes.len() {
+        let b = bytes[i];
+        if let Some(q) = quote {
+            if b == b'\\' {
+                i += 2;
+                continue;
+            }
+            if b == q {
+                quote = None;
+            }
+            i += 1;
+            continue;
+        }
+        match b {
+            b'\'' | b'"' => {
+                quote = Some(b);
+                i += 1;
+            }
+            b'(' | b'[' | b'{' => {
+                depth += 1;
+                i += 1;
+            }
+            b')' | b']' | b'}' => {
+                depth = depth.saturating_sub(1);
+                i += 1;
+            }
+            b'?' if bytes[i..].starts_with(b"?->") => i += 3,
+            b'-' if bytes[i..].starts_with(b"->") => i += 2,
+            b'.' if depth == 0 => {
+                // `...` (spread/variadic) is not concatenation.
+                if bytes[i..].starts_with(b"...") {
+                    i += 3;
+                } else {
+                    return true;
+                }
+            }
+            _ => i += 1,
+        }
+    }
+    false
+}
+
+/// Split `text` at a top-level elvis operator (`?:`), respecting quotes,
+/// parens/brackets, and the nullsafe `?->` operator (which is not this).
+///
+/// Returns the trimmed left and right operand texts, or `None` when no
+/// top-level `?:` is found — including a full ternary (`$a ? $b : $c`),
+/// which is left to the caller's other paths.
+fn split_top_level_elvis(text: &str) -> Option<(&str, &str)> {
+    let bytes = text.as_bytes();
+    let mut depth: u32 = 0;
+    let mut quote: Option<u8> = None;
+    let mut i = 0;
+    while i < bytes.len() {
+        let b = bytes[i];
+        if let Some(q) = quote {
+            if b == b'\\' {
+                i += 2;
+                continue;
+            }
+            if b == q {
+                quote = None;
+            }
+            i += 1;
+            continue;
+        }
+        match b {
+            b'\'' | b'"' => {
+                quote = Some(b);
+                i += 1;
+            }
+            b'(' | b'[' | b'{' => {
+                depth += 1;
+                i += 1;
+            }
+            b')' | b']' | b'}' => {
+                depth = depth.saturating_sub(1);
+                i += 1;
+            }
+            b'?' if depth == 0 && !bytes[i..].starts_with(b"?->") => {
+                let after = text[i + 1..].trim_start();
+                if let Some(rest) = after.strip_prefix(':') {
+                    return Some((text[..i].trim_end(), rest.trim_start()));
+                }
+                i += 1;
+            }
+            _ => i += 1,
+        }
+    }
+    None
+}
+
 /// Whether `operand` is one expression rather than several joined by an
 /// operator.
 ///

src/type_engine/call_resolution/template_subs.rs

@@ -16,7 +16,8 @@ use crate::type_engine::resolver::{Loaders, ResolutionCtx};
 
 use super::return_types::{
     resolve_call_return_hint, resolve_cast_type, resolve_chain_declared_return,
-    resolve_expression_to_type, resolve_literal_type, resolve_static_access_type,
+    resolve_expression_to_type, resolve_literal_type, resolve_operator_type,
+    resolve_static_access_type,
 };
 
 impl Backend {
@@ -734,6 +735,34 @@ impl Backend {
             return class_named.map(|n| PhpType::class_string(Some(n)));
         }
 
+        // Global constant access: `PHP_VERSION`, `PHP_EOL`, etc.
+        //
+        // A bare identifier that isn't a keyword, a `::class`/enum/const
+        // access (handled above and below), or any other special form is a
+        // global constant reference.  Consult the constant loader (derived
+        // from the attached `Backend`, the same source `VarResolutionCtx`
+        // draws from) and infer the type from its value, mirroring the
+        // `Expression::ConstantAccess` branch the AST-based RHS resolver
+        // already has for a plain `$x = PHP_EOL;` assignment.
+        if !trimmed.is_empty()
+            && !trimmed.starts_with('$')
+            && !trimmed.contains("::")
+            && !trimmed.contains("->")
+            && !trimmed.contains('(')
+            && !trimmed.contains('[')
+            && trimmed
+                .chars()
+                .all(|c| c.is_alphanumeric() || c == '_' || c == '\\')
+            && !is_self_or_static(trimmed)
+            && !trimmed.eq_ignore_ascii_case("parent")
+            && let Some(backend) = ctx.backend
+            && let Some(Some(value)) = backend.constant_loader()(trimmed)
+            && let Some(ty) =
+                crate::type_engine::variable::rhs_resolution::infer_type_from_constant_value(&value)
+        {
+            return Some(ty);
+        }
+
         // When the expression contains a `->` chain (e.g.
         // `Country::DK->value`, `new Decimal($x)->toFixed(2)`),
         // skip the static-access and new-expression shortcuts —
@@ -787,6 +816,15 @@ impl Backend {
             return Some(ty);
         }
 
+        // Operators whose result is decided from their operands rather
+        // than from source-text shape alone (`$a . $b`, `$body ?: ''`).
+        // Checked before the general fallback because `SubjectExpr::parse`
+        // has no notion of these operators and would otherwise misread the
+        // whole expression as a single bare variable or class name.
+        if let Some(ty) = resolve_operator_type(trimmed, ctx) {
+            return Some(ty);
+        }
+
         // General expression fallback: parse the argument text as a
         // SubjectExpr and try to resolve it to a type.  This handles
         // $var, $var->prop, $this->prop, $var->method(), method