Fix phpstan/phpstan#13416: Incorrectly narrowed to previously asserted type, even if marked impure

[phpstan-bot]

Summary

When assert(count(MyRecord::find()) === 1) narrowed the type of count(MyRecord::find()) to 1, subsequent calls to count(MyRecord::find()) incorrectly reused this narrowed type — even though MyRecord::find() is marked @phpstan-impure and could return different values on each call. This caused false positives like "comparison will always evaluate to false" when comparing the count to a different value after modifying state.

Changes

• Added containsImpureCall() private method to src/Analyser/TypeSpecifier.php that recursively checks whether an expression tree contains any impure function, method, or static method calls
• In createForExpr(), after verifying the top-level call is pure, now also checks if the call's arguments contain impure sub-expressions before remembering the narrowed type
• Applied the check to all three call type branches: FuncCall, MethodCall, and StaticCall

Root cause

TypeSpecifier::createForExpr() determines whether an expression's narrowed type should be remembered in the scope. For function calls like count(X), it checked if count() itself was pure (it is), but did not check if X contained impure calls. Since MyRecord::find() is marked @phpstan-impure, the expression count(MyRecord::find()) should not have its type remembered across different evaluation points — each call to MyRecord::find() can return a different array, so the count can differ.

The fix adds a recursive check of all sub-expressions within the arguments of a pure function call. If any sub-expression is an impure function/method/static call, the entire expression's type is not remembered.

Test

Added tests/PHPStan/Analyser/nsrt/bug-13416.php which reproduces the issue: after assert(count(MyRecord::find()) === 1) and an impure insert() call, count(MyRecord::find()) should be int<0, max> (not 1).

Fixes phpstan/phpstan#13416