Reproduce a weird bug with closures

src/Analyser/NodeScopeResolver.php

@@ -4311,6 +4311,7 @@ private function processClosureNode(
 				$statementResult,
 				$executionEnds,
 				array_merge($statementResult->getImpurePoints(), $closureImpurePoints),
+				$passedToType,
 			), $closureScope);
 
 			return new ProcessClosureResult($scope, $statementResult->getThrowPoints(), $statementResult->getImpurePoints(), $invalidateExpressions);
@@ -4357,6 +4358,7 @@ private function processClosureNode(
 			$statementResult,
 			$executionEnds,
 			array_merge($statementResult->getImpurePoints(), $closureImpurePoints),
+			$passedToType,
 		), $closureScope);
 
 		return new ProcessClosureResult($scope->processClosureScope($closureResultScope, null, $byRefUses), $statementResult->getThrowPoints(), $statementResult->getImpurePoints(), $invalidateExpressions);

src/Node/ClosureReturnStatementsNode.php

@@ -9,6 +9,7 @@
 use PhpParser\NodeAbstract;
 use PHPStan\Analyser\ImpurePoint;
 use PHPStan\Analyser\StatementResult;
+use PHPStan\Type\Type;
 use function count;
 
 /**
@@ -33,6 +34,7 @@ public function __construct(
 		private StatementResult $statementResult,
 		private array $executionEnds,
 		private array $impurePoints,
+		private ?Type $passedToType,
 	)
 	{
 		parent::__construct($closureExpr->getAttributes());
@@ -84,6 +86,11 @@ public function returnsByRef(): bool
 		return $this->closureExpr->byRef;
 	}
 
+	public function getPassedToType(): ?Type
+	{
+		return $this->passedToType;
+	}
+
 	public function getType(): string
 	{
 		return 'PHPStan_Node_ClosureReturnStatementsNode';

src/Rules/Functions/ClosureReturnTypeRule.php

@@ -7,6 +7,7 @@
 use PHPStan\Node\ClosureReturnStatementsNode;
 use PHPStan\Rules\FunctionReturnTypeCheck;
 use PHPStan\Rules\Rule;
+use PHPStan\Type\CallableType;
 use PHPStan\Type\Type;
 use PHPStan\Type\TypeCombinator;
 
@@ -31,8 +32,13 @@
 			return [];
 		}
 
-		/** @var Type $returnType */
-		$returnType = $scope->getAnonymousFunctionReturnType();
+		if ($node->getPassedToType() instanceof CallableType) {
+			$returnType = $node->getPassedToType()->getReturnType();
+		} else {
+			/** @var Type $returnType */
+			$returnType = $scope->getAnonymousFunctionReturnType();
+		}
+
 		$containsNull = TypeCombinator::containsNull($returnType);
 		$hasNativeTypehint = $node->getClosureExpr()->returnType !== null;
 

tests/PHPStan/Rules/Functions/WeirdBugTest.php

@@ -0,0 +1,38 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Rules\Functions;
+
+use PHPStan\Rules\FunctionReturnTypeCheck;
+use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleLevelHelper;
+use PHPStan\Testing\RuleTestCase;
+use const PHP_VERSION_ID;
+
+/**
+ * @extends RuleTestCase<ClosureReturnTypeRule>
+ */
+class WeirdBugTest extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		return new ClosureReturnTypeRule(new FunctionReturnTypeCheck(new RuleLevelHelper($this->createReflectionProvider(), true, false, true, false, false, true, false)));
+	}
+
+	public function testClosureReturnTypeRule(): void
+	{
+		if (PHP_VERSION_ID < 80000) {
+			$this->markTestSkipped('Test requires PHP 8.0');
+		}
+
+		$this->analyse([__DIR__ . '/data/weird-bug-test.php'], []);
+	}
+
+	public static function getAdditionalConfigFiles(): array
+	{
+		return [
+			__DIR__ . '/data/weird-bug-config.neon',
+		];
+	}
+
+}

tests/PHPStan/Rules/Functions/data/weird-bug-config.neon

@@ -0,0 +1,10 @@
+services:
+	-
+		class: WeirdBugExtensions\MethodParameterClosureTypeExtension
+		tags:
+			- phpstan.methodParameterClosureTypeExtension
+
+	-
+		class: WeirdBugExtensions\BuilderForwardsCallsToAnotherBuilderExtensions
+		tags:
+			- phpstan.broker.methodsClassReflectionExtension

tests/PHPStan/Rules/Functions/data/weird-bug-extensions.php

@@ -0,0 +1,171 @@
+<?php
+
+namespace WeirdBugExtensions;
+
+use PhpParser\Node\Expr\MethodCall;
+use PHPStan\Analyser\OutOfClassScope;
+use PHPStan\Analyser\Scope;
+use PHPStan\Reflection\ClassMemberReflection;
+use PHPStan\Reflection\ClassReflection;
+use PHPStan\Reflection\FunctionVariant;
+use PHPStan\Reflection\MethodReflection;
+use PHPStan\Reflection\MethodsClassReflectionExtension;
+use PHPStan\Reflection\Native\NativeParameterReflection;
+use PHPStan\Reflection\ParameterReflection;
+use PHPStan\Reflection\PassedByReference;
+use PHPStan\Reflection\ReflectionProvider;
+use PHPStan\TrinaryLogic;
+use PHPStan\Type\CallableType;
+use PHPStan\Type\Generic\GenericObjectType;
+use PHPStan\Type\Generic\TemplateTypeMap;
+use PHPStan\Type\ObjectType;
+use PHPStan\Type\Type;
+
+use function PHPStan\Testing\assertType;
+
+class MethodParameterClosureTypeExtension implements \PHPStan\Type\MethodParameterClosureTypeExtension
+{
+
+	public function isMethodSupported(MethodReflection $methodReflection, ParameterReflection $parameter): bool
+	{
+		return $methodReflection->getDeclaringClass()->getName() === \WeirdBug\Builder::class &&
+			$parameter->getName() === 'callback' &&
+			$methodReflection->getName() === 'methodWithCallback';
+	}
+
+	public function getTypeFromMethodCall(
+		MethodReflection $methodReflection,
+		MethodCall $methodCall,
+		ParameterReflection $parameter,
+		Scope $scope
+	): ?Type {
+		return new CallableType(
+			[
+				new NativeParameterReflection('test', false, new GenericObjectType(\WeirdBug\Builder::class, [new ObjectType(\WeirdBug\SubModel::class)]), PassedByReference::createNo(), false, null), // @phpstan-ignore-line
+			]
+		);
+	}
+}
+
+class BuilderForwardsCallsToAnotherBuilderExtensions implements MethodsClassReflectionExtension
+{
+
+	public function __construct(private ReflectionProvider $reflectionProvider)
+	{
+	}
+
+	public function hasMethod(ClassReflection $classReflection, string $methodName): bool
+	{
+		return $classReflection->getName() === \WeirdBug\Builder::class && $this->reflectionProvider->getClass(\WeirdBug\AnotherBuilder::class)->hasNativeMethod($methodName);
+	}
+
+	public function getMethod(
+		ClassReflection $classReflection,
+		string $methodName
+	): MethodReflection {
+		$ref = $this->reflectionProvider->getClass(\WeirdBug\AnotherBuilder::class)->getNativeMethod($methodName);
+
+		/** @var ObjectType $model */
+		$model = $classReflection->getActiveTemplateTypeMap()->getType('T');
+
+		return new BuilderMethodReflection(
+			$methodName,
+			$classReflection,
+			$ref->getVariants()[0]->getParameters(),
+			$model->getMethod('getBuilder', new OutOfClassScope())->getVariants()[0]->getReturnType(),
+			$ref->getVariants()[0]->isVariadic()
+		);
+	}
+}
+
+final class BuilderMethodReflection implements MethodReflection
+{
+	private Type $returnType;
+
+	/** @param  ParameterReflection[] $parameters */
+	public function __construct(private string $methodName, private ClassReflection $classReflection, private array $parameters, Type|null $returnType = null, private bool $isVariadic = false)
+	{
+		$this->returnType = $returnType ?? new ObjectType(\WeirdBug\Builder::class);
+	}
+
+	public function getDeclaringClass(): ClassReflection
+	{
+		return $this->classReflection;
+	}
+
+	public function isStatic(): bool
+	{
+		return true;
+	}
+
+	public function isPrivate(): bool
+	{
+		return false;
+	}
+
+	public function isPublic(): bool
+	{
+		return true;
+	}
+
+	public function getName(): string
+	{
+		return $this->methodName;
+	}
+
+	public function getPrototype(): ClassMemberReflection
+	{
+		return $this;
+	}
+
+	/**
+	 * {@inheritDoc}
+	 */
+	public function getVariants(): array
+	{
+		return [
+			new FunctionVariant(
+				TemplateTypeMap::createEmpty(),
+				null,
+				$this->parameters,
+				$this->isVariadic,
+				$this->returnType,
+			),
+		];
+	}
+
+	public function getDocComment(): string|null
+	{
+		return null;
+	}
+
+	public function isDeprecated(): TrinaryLogic
+	{
+		return TrinaryLogic::createNo();
+	}
+
+	public function getDeprecatedDescription(): string|null
+	{
+		return null;
+	}
+
+	public function isFinal(): TrinaryLogic
+	{
+		return TrinaryLogic::createNo();
+	}
+
+	public function isInternal(): TrinaryLogic
+	{
+		return TrinaryLogic::createNo();
+	}
+
+	public function getThrowType(): Type|null
+	{
+		return null;
+	}
+
+	public function hasSideEffects(): TrinaryLogic
+	{
+		return TrinaryLogic::createMaybe();
+	}
+}

tests/PHPStan/Rules/Functions/data/weird-bug-test.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace WeirdBug;
+
+use function PHPStan\Testing\assertType;
+
+class Model {
+	/**
+	 * @return Builder<static>
+	 */
+	public static function getBuilder(): Builder
+	{
+		return new Builder(new static());
+	}
+}
+
+class SubModel extends Model {}
+
+/**
+ * @template T of Model
+ */
+class Builder {
+
+	/**
+	 * @param T $model
+	 */
+	public function __construct(private Model $model)
+	{
+	}
+
+	public function methodWithCallback(\Closure $callback): void
+	{
+		$callback($this);
+	}
+}
+
+class AnotherBuilder {
+	public function someMethod(): self
+	{
+		return $this;
+	}
+}
+
+function test(): void
+{
+	SubModel::getBuilder()->methodWithCallback(function (Builder $builder, $value) {
+		assertType('WeirdBug\Builder<WeirdBug\SubModel>', $builder);
+		return $builder->someMethod();
+	});
+}