Fix expressionHasNewInChain crash on Name nodes, add tests for all expression types

The recursive call in expressionHasNewInChain() could receive a Name node
(e.g. from Foo::bar()) instead of an Expr, causing a type error. Added an
instanceof Expr guard before recursing on $expr->class.

Also added test coverage for all expression types handled by
expressionHasNewInChain(): nullsafe method calls, property fetches,
nullsafe property fetches, array dim fetches, static calls, and chained
expressions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

src/Analyser/MutatingScope.php

@@ -1006,7 +1006,7 @@ private function expressionHasNewInChain(Expr $expr): bool
 			|| $expr instanceof Expr\StaticPropertyFetch
 			|| $expr instanceof Expr\ClassConstFetch
 		) {
-			return $expr->class instanceof Expr\New_ || $this->expressionHasNewInChain($expr->class);
+			return $expr->class instanceof Expr\New_ || ($expr->class instanceof Expr && $this->expressionHasNewInChain($expr->class));
 		}
 
 		return false;

tests/PHPStan/Analyser/nsrt/bug-8985.php

@@ -8,8 +8,11 @@
 
 class Entity
 {
-	public function __construct(private string $value)
+	public string $value;
+
+	public function __construct(string $value)
 	{
+		$this->value = $value;
 	}
 
 	public function getValue(): string
@@ -25,12 +28,67 @@ public function getAll(): array
 	{
 		return [new Entity('test')];
 	}
+
+	public string $name = 'default';
+
+	/** @return array<int, Entity> */
+	public static function staticGetAll(): array
+	{
+		return [new Entity('test')];
+	}
+
+	public function getEntity(): Entity
+	{
+		return new Entity('test');
+	}
 }
 
-function () : void {
+function testMethodCall(): void {
 	assert((new Repository())->getAll() === []);
 
 	$all = (new Repository())->getAll();
 	assertType('array<int, Bug8985\Entity>', $all);
 	$value = $all[0]->getValue();
-};
+}
+
+function testNullsafeMethodCall(): void {
+	assert((new Repository())?->getEntity()?->getValue() === 'specific');
+
+	assertType('string', (new Repository())?->getEntity()?->getValue());
+}
+
+function testPropertyFetch(): void {
+	assert((new Repository())->name === 'foo');
+
+	assertType('string', (new Repository())->name);
+}
+
+function testNullsafePropertyFetch(): void {
+	assert((new Repository())?->name === 'foo');
+
+	assertType('string', (new Repository())?->name);
+}
+
+function testArrayDimFetch(): void {
+	assert((new Repository())->getAll()[0]->getValue() === 'specific');
+
+	assertType('string', (new Repository())->getAll()[0]->getValue());
+}
+
+function testStaticCall(): void {
+	assert((new Repository())::staticGetAll() === []);
+
+	assertType('array<int, Bug8985\Entity>', (new Repository())::staticGetAll());
+}
+
+function testChainedMethodCalls(): void {
+	assert((new Repository())->getEntity()->getValue() === 'specific');
+
+	assertType('string', (new Repository())->getEntity()->getValue());
+}
+
+function testChainedPropertyOnMethodCall(): void {
+	assert((new Repository())->getEntity()->value === 'specific');
+
+	assertType('string', (new Repository())->getEntity()->value);
+}