Store the result cache with serialize() instead of a var_export'd PHP file

The result cache was written as a var_export'd PHP file and hydrated
with include. Including a multi-megabyte PHP source retains its
compiled op_arrays and interned strings for the process lifetime, and
building the var_export string concatenates the whole file in memory
on save. unserialize() produces only the values, and the retained
compiled-code cost disappears.

The errorsCallback/collectedDataCallback/exportedNodesCallback
closures existed to embed object graphs in the PHP file; restore()
invoked all of them unconditionally right after the include, so plain
arrays are equivalent.

A cache file in the old PHP format fails to unserialize and is
discarded like any other corrupted cache file (unlink and full
analysis). The serialized payload is prefixed with '<?php return; ?>'
so that an older PHPStan including the new-format file returns null
immediately instead of echoing megabytes of inline text to stdout,
and then discards it the same way. The format transition therefore
needs no cache version bump in either direction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: SanderMuller

src/Analyser/ResultCache/ResultCacheManager.php

@@ -19,6 +19,7 @@
 use PHPStan\File\CouldNotReadFileException;
 use PHPStan\File\FileFinder;
 use PHPStan\File\FileHelper;
+use PHPStan\File\FileReader;
 use PHPStan\File\FileWriter;
 use PHPStan\Internal\ArrayHelper;
 use PHPStan\Internal\ComposerHelper;
@@ -47,11 +48,14 @@
 use function ksort;
 use function microtime;
 use function sort;
+use function serialize;
 use function sprintf;
 use function str_starts_with;
+use function strlen;
+use function substr;
 use function time;
 use function unlink;
-use function var_export;
+use function unserialize;
 use const PHP_VERSION_ID;
 
 /**
@@ -64,6 +68,15 @@ final class ResultCacheManager
 
 	private const CACHE_VERSION = 'v13-packageDependencies';
 
+	/**
+	 * The cache file is serialize() output, but an older PHPStan reading it would
+	 * include it as PHP and echo the whole multi-megabyte content to stdout as
+	 * inline text before discarding it. This prefix makes such an include return
+	 * null immediately (the text after ?> is never reached), so a downgrade
+	 * degrades to a silent full analysis instead.
+	 */
+	private const SERIALIZED_FILE_PREFIX = '<?php return; ?>';
+
 	/** @var array<string, string> */
 	private array $fileHashes = [];
 
@@ -201,7 +214,16 @@ public function restore(array $allAnalysedFiles, bool $debug, bool $onlyFiles, ?
 		}
 
 		try {
-			$data = require $cacheFilePath;
+			// The cache used to be a var_export'd PHP file loaded via include. Including a
+			// multi-megabyte PHP source retains its compiled op_arrays and interned strings
+			// for the process lifetime; unserialize() produces only the values. A cache file
+			// in the old PHP format fails to unserialize and is discarded below like any
+			// other corrupted file, so no cache version bump is needed for the transition.
+			$contents = FileReader::read($cacheFilePath);
+			if (str_starts_with($contents, self::SERIALIZED_FILE_PREFIX)) {
+				$contents = substr($contents, strlen(self::SERIALIZED_FILE_PREFIX));
+			}
+			$data = @unserialize($contents);
 		} catch (Throwable $e) {
 			if ($output->isVeryVerbose()) {
 				$output->writeLineFormatted(sprintf('Result cache not used because an error occurred while loading the cache file: %s', $e->getMessage()));
@@ -397,12 +419,12 @@ public function restore(array $allAnalysedFiles, bool $debug, bool $onlyFiles, ?
 		$filesToAnalyse = [];
 		$invertedDependenciesToReturn = [];
 		$invertedUsedTraitDependenciesToReturn = [];
-		$errors = $data['errorsCallback']();
-		$locallyIgnoredErrors = $data['locallyIgnoredErrorsCallback']();
+		$errors = $data['errors'];
+		$locallyIgnoredErrors = $data['locallyIgnoredErrors'];
 		$linesToIgnore = $data['linesToIgnore'];
 		$unmatchedLineIgnores = $data['unmatchedLineIgnores'];
-		$collectedData = $data['collectedDataCallback']();
-		$exportedNodes = $data['exportedNodesCallback']();
+		$collectedData = $data['collectedData'];
+		$exportedNodes = $data['exportedNodes'];
 		$filteredErrors = [];
 		$filteredLocallyIgnoredErrors = [];
 		$filteredLinesToIgnore = [];
@@ -1155,22 +1177,19 @@ private function save(
 
 		FileWriter::write(
 			$file,
-			"<?php declare(strict_types = 1);
-
-return [
-	'lastFullAnalysisTime' => " . var_export($lastFullAnalysisTime, true) . ",
-	'meta' => " . var_export($meta, true) . ",
-	'projectExtensionFiles' => " . var_export($projectExtensionFiles, true) . ",
-	'errorsCallback' => static function (): array { return " . var_export($errors, true) . "; },
-	'locallyIgnoredErrorsCallback' => static function (): array { return " . var_export($locallyIgnoredErrors, true) . "; },
-	'linesToIgnore' => " . var_export($linesToIgnore, true) . ",
-	'unmatchedLineIgnores' => " . var_export($unmatchedLineIgnores, true) . ",
-	'collectedDataCallback' => static function (): array { return " . var_export($collectedData, true) . "; },
-	'dependencies' => " . var_export($invertedDependencies, true) . ",
-	'packageDependencies' => " . var_export($packageDependencies, true) . ",
-	'exportedNodesCallback' => static function (): array { return " . var_export($exportedNodes, true) . '; },
-];
-',
+			self::SERIALIZED_FILE_PREFIX . serialize([
+				'lastFullAnalysisTime' => $lastFullAnalysisTime,
+				'meta' => $meta,
+				'projectExtensionFiles' => $projectExtensionFiles,
+				'errors' => $errors,
+				'locallyIgnoredErrors' => $locallyIgnoredErrors,
+				'linesToIgnore' => $linesToIgnore,
+				'unmatchedLineIgnores' => $unmatchedLineIgnores,
+				'collectedData' => $collectedData,
+				'dependencies' => $invertedDependencies,
+				'packageDependencies' => $packageDependencies,
+				'exportedNodes' => $exportedNodes,
+			]),
 		);
 	}