Fix #12253: assign.readOnlyProperty

[phpstan-bot]

Fixes phpstan/phpstan#12253

Reproducer

class Payload
{
    private(set) readonly array $validation;

    public function __construct(private readonly stdClass $payload)
    {
        $this->parseValidation();
    }

    private function parseValidation(): void
    {
        // ... builds $validations array, calls $this->validationValue() ...
        $this->validation = $validations; // FALSE POSITIVE: "already assigned"
    }
}

Root causes

Two issues in ClassPropertiesNode::getUninitializedProperties():

1. getMethodsCalledFromConstructor() over-eagerly marks properties as initialized: When a non-__construct method (like parseValidation) calls another method (like validationValue), all properties initialized in the constructor were marked as Yes for that method. This logic was intended only for additional constructors configured via ConstructorsHelper (e.g., setUp), but it applied to all non-__construct methods. Fixed by passing and checking the list of original constructors.

2. Scope pollution for PropertyInitializationExpr: The additionalAssigns check consulted $usageScope->hasExpressionType(PropertyInitializationExpr), but PropertyInitializationExpr types leak from the post-constructor class scope into all non-static method scopes via rememberConstructorScope() + enterFunctionLike($preserveConstructorScope=true). For non-constructor methods, this always reports the property as already initialized even on first assignment. Fixed by only consulting the scope for __construct itself, relying on $initializedPropertiesMap for helper methods.

Changes

• src/Node/ClassPropertiesNode.php: Added $originalConstructors parameter to getMethodsCalledFromConstructor() and restricted both the constructor-property-initialization logic and the scope check to appropriate methods
• tests/PHPStan/Rules/Properties/data/bug-12253.php: Regression test
• tests/PHPStan/Rules/Properties/MissingReadOnlyPropertyAssignRuleTest.php: Test method for the regression test

[staabm]

when seeing such comparison it reminds me that we have a NEON config additionalConstructors. is this somehow related/should be taken into account?

[phpstan-bot]

All background tasks confirmed successful. The fix is committed and pushed.

[staabm]

add another test with the same problem, but 1 additionalConstructors configured

[phpstan-bot]

You're out of extra usage · resets 5pm (UTC)