PHPStan 2.2.15 exhausts memory analyzing Symfony DoctrineExtractor.php (2.2.14 completes) #15310

Activity

1. mergeable commented on Sep 25, 2026

   

   mergeableBot

   on Sep 25, 2026 – with Mergeable

   More actions

   This bug report is missing a link to reproduction at phpstan.org/try.

   It will most likely be closed after manual review.
2. X-Coder264 commented on Sep 25, 2026

   

   X-Coder264

   on Sep 25, 2026

   Author

   More actions

   About the automated Playground-link warning: I could not reproduce this dependency-backed memory failure in the Playground. The report links the exact Symfony file at an immutable commit and includes copyable setup and one-file PHPStan commands. That one file alone exhausts 1 GiB with 2.2.15 in about 26 seconds; it completes in about 1.25 seconds with 2.2.14 when only the PHPStan package is changed. No full Symfony CI run is needed to reproduce it.
3. X-Coder264 commented on Sep 25, 2026

   

   X-Coder264

   on Sep 25, 2026

   Author

   More actions

   I narrowed this down further. The relevant Symfony declaration is BuiltinType's generic @extends Type<(T is ... ? ... : ...)>. It has a chain of 15 conditional branches. DoctrineExtractor::getType() reaches this type through the Type factories; even reducing that method to return Type::object($class); still reproduces the failure. Replacing the conditional @extends declaration with @extends Type<mixed> in a temporary checkout makes the reduced analysis complete.

   Here is a standalone reproducer that requires no Symfony code, dependencies, or PHPStan configuration (save as repro.php):

   <?php
   
   enum ExampleIdentifier { case A; case B; case C; case D; case E; case F; case G; case H; case I; case J; case K; case L; case M; case N; case O; }
   
   /** @template-covariant TValue */
   abstract class ExampleType
   {
   }
   
   /**
    * @template T of ExampleIdentifier
    * @extends ExampleType<(
    *   T is ExampleIdentifier::A ? array :
    *   T is ExampleIdentifier::B ? bool :
    *   T is ExampleIdentifier::C ? callable :
    *   T is ExampleIdentifier::D ? false :
    *   T is ExampleIdentifier::E ? float :
    *   T is ExampleIdentifier::F ? int :
    *   T is ExampleIdentifier::G ? iterable :
    *   T is ExampleIdentifier::H ? mixed :
    *   T is ExampleIdentifier::I ? null :
    *   T is ExampleIdentifier::J ? object :
    *   T is ExampleIdentifier::K ? resource :
    *   T is ExampleIdentifier::L ? string :
    *   T is ExampleIdentifier::M ? true :
    *   T is ExampleIdentifier::N ? never :
    *   T is ExampleIdentifier::O ? void :
    *   mixed
    * )>
    */
   final class ExampleBuiltinType extends ExampleType
   {
       /** @param T $identifier */
       public function __construct(public ExampleIdentifier $identifier) {}
   }
   
   function reproduce(): ExampleType
   {
       return new ExampleBuiltinType(ExampleIdentifier::A);
   }

   Run php phpstan.phar analyse repro.php --debug --no-progress --memory-limit=256M on PHP 8.4.25:

   • PHPStan 2.2.14: completes with [OK] No errors.
   • PHPStan 2.2.15: crashes after about 6 seconds with Allowed memory size of 268435456 bytes exhausted (observed in NarrowedSubjectType.php:114; the exact allocation site varies).

   With Xdebug enabled, the stack repeatedly goes through ConditionalType::getNormalizedElse() → narrowSubjectIn() → NarrowedSubjectType::narrowReferences() → TypeTraverser::map() → ConditionalType::traverse(), until Xdebug stops at a depth of 512 frames. This suggests the new branch normalization in 91dcf7e repeatedly traverses the remaining conditional chain, causing a large expansion in work and memory.
4. phpstan-bot commented on Sep 25, 2026

   

   phpstan-bot

   on Sep 25, 2026

   Contributor

   More actions

   Closed via merging phpstan/phpstan-src#6586
5. phpstan-bot

   closed this as completedon Sep 25, 2026