array_column should not extract non-public properties from objects#5210
Merged
staabm merged 4 commits intophpstan:2.1.xfrom Mar 22, 2026
Merged
array_column should not extract non-public properties from objects#5210staabm merged 4 commits intophpstan:2.1.xfrom
staabm merged 4 commits intophpstan:2.1.xfrom
Conversation
janedbal
force-pushed
the
array-column-visibility
branch
from
f8df7cc to
4252b95
Compare
Collaborator
|
This pull request has been marked as ready for review. |
VincentLanglet
requested changes
Mar 12, 2026
janedbal
force-pushed
the
array-column-visibility
branch
2 times, most recently
from
4252b95 to
acf44c2
Compare
staabm
reviewed
Mar 17, 2026
Contributor
staabm
left a comment
staabm
left a comment
There was a problem hiding this comment.
I think we also need to assert expectations for classes which define properties via phpdoc like
/**
* @property int $id
* @property string $name
*/
class ObjectWithIsset {}
PHP's array_column respects calling scope visibility. This change: - Checks scope->canReadProperty() before including a property type - When both __isset and __get are defined, treats inaccessible properties as maybe-accessible (returns generic array) - For non-final classes, accounts for child classes that could override visibility: protected keeps its type (invariant in PHP), private becomes mixed (child can redeclare with any type) - For final classes, inaccessible properties return empty array - Handles NeverType in index position by falling back to integer keys Fixes phpstan/phpstan#13573
For non-final classes, a child class can widen visibility: - protected: type is preserved (invariant in PHP), treat as maybe - private: child can redeclare with any type, treat as mixed For final classes, non-accessible properties return empty array. Add implicit final test for new expression (asFinal via NewHandler).
@Final is just a PHPDoc convention with no runtime enforcement, so a child class can still extend and override property visibility.
Co-authored-by: Vincent Langlet <VincentLanglet@users.noreply.github.com>
staabm
force-pushed
the
array-column-visibility
branch
from
81a548c to
b5f33c9
Compare
Contributor
|
lets give it a go. thank you |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes phpstan/phpstan#13573