Avoid retaining call ASTs in template argument caches

Keep the call expression as a weak cache key, alongside the weak inference-context key. Cache identity remains exact without extending either object lifetime. Validation: the cache lifetime assertion fails with the strong expression key and passes with weak keys.
ondrejmirtes · Sep 7, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 6, 2026
commit 5fad23a62cd600af82f13ae7d9a19ff511cf59cf
diff --git a/src/Reflection/ResolvedFunctionVariantWithOriginal.php b/src/Reflection/ResolvedFunctionVariantWithOriginal.php
@@ -37,7 +37,11 @@ final class ResolvedFunctionVariantWithOriginal implements ResolvedFunctionVaria
 
 	private ?Type $phpDocReturnType = null;
 
-	/** @var array{Expr, WeakReference<TemplateArgumentFrame>, bool, Type}|null */
+	/**
+	 * Cache keys must not keep the call AST or inference context alive.
+	 *
+	 * @var array{WeakReference<Expr>, WeakReference<TemplateArgumentFrame>, bool, Type}|null
+	 */
 	private ?array $returnTypeWithUnresolvedTemplateArguments = null;
 
 	/**
@@ -186,7 +190,7 @@ public function getReturnType(): Type
 	public function getReturnTypeWithUnresolvedTemplateArguments(Expr $site, TemplateArgumentFrame $frame, bool $allowUnresolved): Type
 	{
 		$cached = $this->returnTypeWithUnresolvedTemplateArguments;
-		if ($cached !== null && $cached[0] === $site && $cached[1]->get() === $frame && $cached[2] === $allowUnresolved) {
+		if ($cached !== null && $cached[0]->get() === $site && $cached[1]->get() === $frame && $cached[2] === $allowUnresolved) {
 			return $cached[3];
 		}
 
@@ -201,7 +205,7 @@ public function getReturnTypeWithUnresolvedTemplateArguments(Expr $site, Templat
 			),
 			false,
 		);
-		$this->returnTypeWithUnresolvedTemplateArguments = [$site, WeakReference::create($frame), $allowUnresolved, $type];
+		$this->returnTypeWithUnresolvedTemplateArguments = [WeakReference::create($site), WeakReference::create($frame), $allowUnresolved, $type];
 
 		return $type;
 	}

diff --git a/tests/PHPStan/Analyser/Generics/TemplateArgumentResolverTest.php b/tests/PHPStan/Analyser/Generics/TemplateArgumentResolverTest.php
@@ -28,6 +28,7 @@
 use PHPStan\Type\Type;
 use PHPStan\Type\TypeCombinator;
 use PHPStan\Type\VerbosityLevel;
+use WeakReference;
 
 class TemplateArgumentResolverTest extends PHPStanTestCase
 {
@@ -264,6 +265,15 @@ public function testReturnTypeCacheDistinguishesImmutableResolutions(): void
 		$this->assertSame('PHPStan\Type\Test\A\A<1>', self::describe($variant->getReturnTypeWithUnresolvedTemplateArguments($site, $initial, true)));
 		$this->assertTrue($unresolved->equals($variant->getReturnTypeWithUnresolvedTemplateArguments($site, $collecting, true)));
 		$this->assertTrue($collecting->isObserving());
+
+		$reference = WeakReference::create($collecting);
+		unset($collecting);
+		$this->assertNull($reference->get(), 'The return-type cache must not retain the inference context.');
+
+		$variant->getReturnTypeWithUnresolvedTemplateArguments($site, $sent, true);
+		$siteReference = WeakReference::create($site);
+		unset($site, $marker, $constraints, $unresolved);
+		$this->assertNull($siteReference->get(), 'The resolved return-type cache must not retain the call AST.');
 	}
 
 	public function testSiteAttributionByTokenPosition(): void