Activity

1. samsonasik commented on Oct 27, 2026

   

   samsonasik

   on Oct 27, 2026

   Member

   More actions

   Turbo extension usage is new, I guess the option --disable-turbo is needed, but should be better to have it actually reproduced and fixed.
2. TomasVotruba commented on Oct 27, 2026

   

   TomasVotruba

   on Oct 27, 2026

   Member

   More actions

   Could you create a minimal reproducer test via PR? Can be unit test or e2e tests.
   I want to avoid blind fixes.
3. calebdw commented on Oct 28, 2026

   

   calebdw

   on Oct 28, 2026

   Author

   More actions

   I got to the bottom of this one: it is phpstan/phpstan-src#6852 ("Keep the expression result alive in the native ReturnHandler"), released in PHPStan 2.3.3 earlier today. The native ReturnHandler in the Turbo extension released the returned expression's result before the node callbacks ran, so a later getType() on that expression could read freed memory, and an unrelated ClosureType ended up where the impure points array should be. Rector calls Scope::getType() on nodes after PHPStan's traversal, which is exactly that pattern, and it explains why the error depended on what a worker had processed before.

   What I checked:

   • Minimal case, reduced from our project: it needs a worker with Turbo loaded, featureToggles.unresolvedTemplateArguments: true (from bleeding edge), RemoveUnusedPrivateMethodRector, and a non-arrow closure that returns a method call, passed to a generic method:

     /** @template TValue */
     final class Box
     {
         /** @param list<TValue> $items */
         public function __construct(private array $items) {}
     
         /**
          * @template TReturn
          * @param callable(TValue): list<TReturn> $callback
          * @return self<TReturn>
          */
         public function flatMap(callable $callback): self
         {
             return new self(array_merge(...array_map($callback, $this->items)));
         }
     
         /** @return list<TValue> */
         public function all(): array
         {
             return $this->items;
         }
     }
     
     final class Consumer
     {
         public function run(): array
         {
             return (new Box([1]))->flatMap(function (int $e): array {
                 return (new Box([$e]))->all();
             })->all();
         }
     
         private function unused(): void
         {
         }
     }

     With ->parallel(maxNumberOfProcess: 1), Rector 2.8.1 and PHPStan 2.3.2 fail on Consumer.php with the array_merge() error. Hiding vendor/phpstan/phpstan/turbo-ext/ or turning the feature toggle off makes it pass.

   • The same case passes with PHPStan 2.3.3, and as an e2e fixture on rector-src main (which locks 2.3.3).

   • Our full project on Rector 2.8.1 with PHPStan 2.3.3: 0 errors, previously 3 on every run.

   So there is nothing left to fix in Rector itself, and a reproducer PR would pass on main already. One suggestion: rector/rector currently requires phpstan/phpstan: ^2.3.2. Raising that to ^2.3.3 would stop projects that already lock 2.3.2 from picking up the Turbo workers together with this bug.

   Closing, since it is fixed by PHPStan 2.3.3.

   🚀React with 🚀1Reacted by Tomas Votruba
4. calebdw

   closed this as completedon Oct 28, 2026