fix(checker): a dynamic-only function returns what it was given

[Guikingone]

Closes #576.

function h($b, $p) { return $b; }
$fn = 'h';
var_dump(call_user_func($fn, "probe", 9));   // int(0); PHP: string(5) "probe"

Silent: no cast in the source, no diagnostic, and the value is gone.

Why

An untyped parameter starts as the checker's Int placeholder, which a direct call site replaces with the real argument type. A function reached only through a dynamic callable has no such site, so the placeholder survives — and the return type, inferred from return $b;, records Int for a value that is really whatever the caller passed. The runtime-callable invoker coerces through that recorded type.

The value was never lost on the way in: gettype($b) inside the callee answers string, exactly as the issue reports. Only the return was misdescribed.

The rule

An un-hinted body that hands one of its untyped by-value parameters straight back records mixed. Narrow on purpose:

• only a return that yields the parameter itself counts, through the pass-through shapes (?:, ??, match, @, assignment);
• a body that computes its own result keeps its inferred type — function add($a, $b) { return $a + $b; } still returns int;
• a declared return type is authoritative and is never overridden.

Where, and why there

In the checker, because the declaration and its call sites have to reach the same answer.

EIR already boxes such a parameter, and normalize_method_map_for_eir already applies this exact rule to methods. Widening only the callee makes things worse rather than better — measured, call_user_func then read the boxed cell back as a raw integer and printed int(4309365472) instead of int(0). The checker's signature is what both sides start from.

That the rule was already written for methods and missing for functions is the defect, so it now lives in one place — src/types/dynamic_params.rs — and ir_lower calls it instead of keeping its own copy. That is most of the diff: 147 lines move out of ir_lower/program/metadata.rs.

Measured

Every row of the issue's scope table, byte-identical to the host PHP 8.5.10, including the ones that must not change:

call_user_func($fn, "probe", 9)	string(5) "probe"	the defect
call_user_func($fnp, "x", 12345)	int(12345)	was accidentally right — an int survives an int cast
call_user_func($fnt, "typed", 1)	string(5) "typed"	declared types, never affected
m("direct") then call_user_func($fm, "probe")	string(6) "direct", string(5) "probe"	the masking variant, both orders
strlen(call_user_func($fs, "abcde"))	int(5)	refused to compile before
call_user_func($fadd, 2, 3)	int(5)	computing body keeps int
array_map, call_user_func_array		the other entry points into the same invoker

Verified against the defect, not only against PHP: with the rule disabled the regression fails at the static consumer with

strlen cannot lower checked operand type Int

which is the recorded return type read back directly.

Suites: --bin elephc 1915, error_tests 1534, codegen::callables 455, codegen::types 313, codegen::oop 615, codegen::arrays 568, codegen::spl 258, codegen::runtime_gc 298 — all clean.

Docs

docs/internals/the-type-checker.md gains a "When no direct call site exists" subsection under call-site inference: why the Int fallback is only sound when something replaces it, why the rule is recorded in the checker rather than during lowering, and what keeps it narrow. docs/php/functions.md states the user-visible guarantee next to the dynamic-callback paragraph.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSAAWPyNBq6dP2b5puN3wr

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no new changes were introduced since the previous review, all previous threads are resolved, and no repository-rule violations remain.

Summary

This PR preserves values returned through dynamic callables by widening eligible untyped pass-through function returns to mixed, while retaining inferred types for directly specialized or computed returns.

• Centralizes dynamic-parameter return detection for checker and EIR lowering.
• Tracks genuine direct function calls while excluding signature probes and first-class callable resolution.
• Handles generated include-function variants through resolver metadata rather than symbol-name parsing.
• Adds PHP-compatible regression coverage, documentation, and an example.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Resolve function declarations] --> B[Infer provisional signatures]
    B --> C[Track genuine direct calls]
    C --> D{Direct arguments specialized function?}
    D -->|Yes| E[Keep inferred return type]
    D -->|No| F{Returns untyped parameter directly?}
    F -->|Yes| G[Record mixed return type]
    F -->|No| E
    G --> H[Checker and EIR share dynamic-parameter predicate]
    E --> I[Generate callable descriptor]
    H --> I
    I --> J[Dynamic invocation preserves returned value]

Loading

_{Reviews (10) · Last reviewed commit: "ci: empty commit to retrigger checks"}