From e5da88a966094c0d073d065ed0336bde63e6dc65 Mon Sep 17 00:00:00 2001
From: Sander Muller <github@scode.nl>
Date: Thu, 27 Aug 2026 14:03:54 +0200
Subject: [PATCH] Decline only the file that declares the function of that name

wouldReIncludeALoadedFile() declined on any trapped read of an
already-loaded file, but an aliasing autoloader reads the file of the
class it aliases *to*: class_alias(Target::class, 'File') autoloads
Target, and Target already being loaded is the normal case - class_alias()
includes nothing. So the guard declined the very case it was written to
keep working, and `use File;` still reported class.notFound with Laravel's
AliasLoader.

Only re-including the file that declares the function of that name can
redeclare it, so compare the trapped read against that file. A built-in
has no declaring file and nothing to redeclare.

e2e/bug-15102b required its alias target upfront, which is why it passed:
class_alias() then reads no file and the guard never fires. It now
autoloads the target like AliasLoader does, and fails without this change.

Reported and diagnosed by @hoetaek, including the suggested condition and
a red-team case for the redeclare hazard.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/e2e-tests.yml                   |  1 +
 e2e/bug-15102b/.gitignore                         |  2 ++
 e2e/bug-15102b/bootstrap.php                      |  9 +++++----
 e2e/bug-15102b/composer.json                      |  7 +++++++
 phpstan-baseline.neon                             |  6 ++++++
 .../AutoloadFunctionsSourceLocator.php            | 15 +++++++++++++++
 6 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 e2e/bug-15102b/.gitignore
 create mode 100644 e2e/bug-15102b/composer.json

diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 1ab8c24c1ee..316c7bb6603 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -142,6 +142,7 @@ jobs:
               ../../bin/phpstan analyze
           - script: |
               cd e2e/bug-15102b
+              composer install
               ../../bin/phpstan analyze
           - script: |
               cd e2e/bug-15102
diff --git a/e2e/bug-15102b/.gitignore b/e2e/bug-15102b/.gitignore
new file mode 100644
index 00000000000..3a9875b460f
--- /dev/null
+++ b/e2e/bug-15102b/.gitignore
@@ -0,0 +1,2 @@
+/vendor/
+composer.lock
diff --git a/e2e/bug-15102b/bootstrap.php b/e2e/bug-15102b/bootstrap.php
index f86d4b17ba3..c97c5c80d25 100644
--- a/e2e/bug-15102b/bootstrap.php
+++ b/e2e/bug-15102b/bootstrap.php
@@ -1,9 +1,10 @@
 <?php declare(strict_types = 1);
 
-// The shape Illuminate\Foundation\AliasLoader creates: a prepended autoloader that
-// resolves a short alias to a real class with class_alias(), reading no file. The alias
-// names collide with global functions - Laravel's Cache, File, Str, Hash all do.
-require_once __DIR__ . '/src/Real.php';
+// The shape Illuminate\Foundation\AliasLoader creates: a prepended autoloader that resolves a
+// short alias with class_alias(). The alias names collide with global functions - Laravel's
+// Cache, File, Str and Hash all do - and the alias *target* is autoloaded on demand, so the
+// class_alias() call is what pulls it in. Nothing is re-included and no function is redeclared.
+require __DIR__ . '/vendor/autoload.php';
 
 spl_autoload_register(static function (string $class): void {
 	if ($class !== 'File') {
diff --git a/e2e/bug-15102b/composer.json b/e2e/bug-15102b/composer.json
new file mode 100644
index 00000000000..051bb3ad9f2
--- /dev/null
+++ b/e2e/bug-15102b/composer.json
@@ -0,0 +1,7 @@
+{
+	"autoload": {
+		"psr-4": {
+			"E2eFacadeAlias\\": "src/"
+		}
+	}
+}
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index fef664d8b33..15ff1b9b19c 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -360,6 +360,12 @@ parameters:
 			count: 1
 			path: src/Reflection/BetterReflection/SourceLocator/AutoloadSourceLocator.php
 
+		-
+			rawMessage: Creating new ReflectionFunction is a runtime reflection concept that might not work in PHPStan because it uses fully static reflection engine. Use objects retrieved from ReflectionProvider instead.
+			identifier: phpstanApi.runtimeReflection
+			count: 1
+			path: src/Reflection/BetterReflection/SourceLocator/AutoloadFunctionsSourceLocator.php
+
 		-
 			rawMessage: 'Parameter #2 $node of method PHPStan\BetterReflection\SourceLocator\Ast\Strategy\NodeToReflection::__invoke() expects PhpParser\Node\Expr\ArrowFunction|PhpParser\Node\Expr\Closure|PhpParser\Node\Expr\FuncCall|PhpParser\Node\Stmt\Class_|PhpParser\Node\Stmt\Const_|PhpParser\Node\Stmt\Enum_|PhpParser\Node\Stmt\Function_|PhpParser\Node\Stmt\Interface_|PhpParser\Node\Stmt\Trait_, PhpParser\Node\Stmt\ClassLike given.'
 			identifier: argument.type
diff --git a/src/Reflection/BetterReflection/SourceLocator/AutoloadFunctionsSourceLocator.php b/src/Reflection/BetterReflection/SourceLocator/AutoloadFunctionsSourceLocator.php
index cf49e560136..3794b0c4d2b 100644
--- a/src/Reflection/BetterReflection/SourceLocator/AutoloadFunctionsSourceLocator.php
+++ b/src/Reflection/BetterReflection/SourceLocator/AutoloadFunctionsSourceLocator.php
@@ -3,6 +3,7 @@
 namespace PHPStan\Reflection\BetterReflection\SourceLocator;
 
 use Override;
+use ReflectionFunction;
 use PHPStan\BetterReflection\Identifier\Identifier;
 use PHPStan\BetterReflection\Identifier\IdentifierType;
 use PHPStan\BetterReflection\Reflection\Reflection;
@@ -140,11 +141,25 @@ static function () use ($autoloadFunctions, $className): array {
 			return false;
 		}
 
+		// Only re-including the file that *declares the function of this name* can redeclare it.
+		// A trapped read of any other file is not the hazard: an aliasing autoloader reads the
+		// file of the class it aliases to, and that file already being loaded is the normal case -
+		// class_alias() includes nothing, it names a class that is there. A built-in function has
+		// no declaring file, so there is nothing it could redeclare.
+		$functionFileName = (new ReflectionFunction($className))->getFileName();
+		if ($functionFileName === false) {
+			return false;
+		}
+
 		// PHP canonicalises the path before it reaches a stream wrapper - a `/./` segment, a
 		// symlinked directory or an include-path-relative name all arrive resolved - so the
 		// trapped paths compare directly against get_included_files().
 		$includedFiles = get_included_files();
 		foreach ($locatedFiles as $locatedFile) {
+			if ($locatedFile !== $functionFileName) {
+				continue;
+			}
+
 			if (in_array($locatedFile, $includedFiles, true)) {
 				return true;
 			}