Discard the cache when the cached results cannot be reconstructed

unserialize() has no reconstruction hook, so a cache written by a PHPStan
whose classes have since changed can fail while the objects are rebuilt: a
property the payload does not carry stays uninitialized and reading it
throws. var_export absorbed this because __set_state() reconstructs through
the constructor, which applies the declared defaults - renaming Error::$tip
is harmless there and aborted the run here.

cacheVersion and phpstanVersion keep a released version away from another
release's objects, but phpstanVersion comes from Composer's installed.php
rather than the working tree, so a source checkout keeps one value across
every edit of these classes. That is where it is reachable, and it is also
where PHPStan is developed.

The four callbacks are now invoked inside restore()'s failure path, so a
cache that cannot be read back is discarded and everything re-analysed, the
same as for a damaged file. Before this the same shape aborted the command
with an uncaught error and a usage dump - on both formats, since the
var_export closures are evaluated at the same point.

e2e/result-cache-stale-objects renames Error::$message inside the cache file,
which is that shape without needing two PHPStan versions installed, keeping
the byte length so the frame headers stay valid. The run reports the cause
and re-analyses; without the change it dies on the uninitialized property.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/e2e-tests.yml

@@ -179,6 +179,22 @@ jobs:
               OUTPUT=$(../../bin/phpstan -vvv 2>&1)
               echo "$OUTPUT"
               ../bashunit -a contains 'Result cache restored.' "$OUTPUT"
+          - script: |
+              cd e2e/result-cache-stale-objects
+              OUTPUT=$(../bashunit -a exit_code "1" "../../bin/phpstan -vvv")
+              echo "$OUTPUT"
+              # Renaming a property inside the cache file is what a cache written by a PHPStan whose
+              # classes have changed since looks like: the payload does not carry the property the class
+              # now declares, so reconstructing the object leaves it uninitialized and reading it throws.
+              php rename-property.php
+              OUTPUT=$(../bashunit -a exit_code "1" "../../bin/phpstan -vvv")
+              echo "$OUTPUT"
+              ../bashunit -a contains 'could not be read back' "$OUTPUT"
+              ../bashunit -a contains 'Result cache is saved.' "$OUTPUT"
+              # The cache written in its place is usable again.
+              OUTPUT=$(../bashunit -a exit_code "1" "../../bin/phpstan -vvv")
+              echo "$OUTPUT"
+              ../bashunit -a contains 'Result cache restored.' "$OUTPUT"
           - script: |
               cd e2e/bug-14514
               composer install

.gitignore

@@ -20,4 +20,5 @@ e2e/bashunit
 /e2e/result-cache-atomic-save/tmp
 /e2e/result-cache-moved-tmpdir/tmp-a
 /e2e/result-cache-moved-tmpdir/tmp-b
+/e2e/result-cache-stale-objects/tmp
 /e2e/result-cache-truncated/tmp

e2e/result-cache-stale-objects/phpstan.neon

@@ -0,0 +1,5 @@
+parameters:
+	level: 8
+	tmpDir: tmp
+	paths:
+		- src

e2e/result-cache-stale-objects/rename-property.php

@@ -0,0 +1,25 @@
+<?php declare(strict_types = 1);
+
+// A cache written by a PHPStan whose classes have changed since cannot be reconstructed: the payload
+// does not carry the property the class now declares, so the object comes back with it uninitialized
+// and reading it throws. Renaming one inside the cache file is that shape without needing two
+// PHPStan versions installed, and keeping the byte length identical leaves the rest of the payload
+// valid - the frame headers count bytes.
+$file = __DIR__ . '/tmp/resultCache.php';
+$contents = file_get_contents($file);
+if ($contents === false) {
+	throw new RuntimeException('No result cache at ' . $file);
+}
+
+// Error::$message, read by transformPaths() while the cached errors are absolutized.
+$property = "\0PHPStan\\Analyser\\Error\0message";
+if (substr_count($contents, $property) !== 1) {
+	throw new RuntimeException('Expected exactly one cached Error carrying that property.');
+}
+
+$renamed = substr($property, 0, -strlen('message')) . 'messagf';
+if (strlen($renamed) !== strlen($property)) {
+	throw new RuntimeException('The replacement has to keep the byte length.');
+}
+
+file_put_contents($file, str_replace($property, $renamed, $contents));

e2e/result-cache-stale-objects/src/Foo.php

@@ -0,0 +1,13 @@
+<?php declare(strict_types = 1);
+
+namespace ResultCacheE2EStaleObjects;
+
+class Foo
+{
+
+	public function doFoo(): int
+	{
+		return 'not an int';
+	}
+
+}

e2e/result-cache-stale-objects/tmp/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

src/Analyser/ResultCache/ResultCacheManager.php

@@ -134,6 +134,12 @@ final class ResultCacheManager
 	 * Sections restore() hands back as callbacks instead of arrays, so a run that never asks for them
 	 * never pays for decoding them. Each is a whole array frame in the file, so the reader only has to
 	 * remember where it starts and walk past its entries.
+	 *
+	 * Nothing closure-shaped is written: a frame holds the plain serialized payload
+	 * (`a:1:{s:9:"file.php";a:1:{i:0;O:22:"PHPStan\Analyser\Error"...`), and readCacheFile() builds
+	 * the callback in PHP around the open handle and that offset, which is only the shape restore()
+	 * expects. The var_export format writes a real `static function (): array` into the file instead,
+	 * and PHP still compiles the array literal inside it.
 	 */
 	private const LAZY_SECTIONS = ['errors', 'locallyIgnoredErrors', 'collectedData', 'exportedNodes'];
 
@@ -593,12 +599,31 @@ public function restore(array $allAnalysedFiles, bool $debug, bool $onlyFiles, ?
 		$filesToAnalyse = [];
 		$invertedDependenciesToReturn = [];
 		$invertedUsedTraitDependenciesToReturn = [];
-		$errors = $data['errorsCallback']();
-		$locallyIgnoredErrors = $data['locallyIgnoredErrorsCallback']();
 		$linesToIgnore = $data['linesToIgnore'];
 		$unmatchedLineIgnores = $data['unmatchedLineIgnores'];
-		$collectedData = $data['collectedDataCallback']();
-		$exportedNodes = $data['exportedNodesCallback']();
+
+		try {
+			// The cached objects are reconstructed here, and a cache written by a PHPStan whose classes
+			// have since changed can fail at it: a property the payload does not carry stays
+			// uninitialized, and reading it throws. The cacheVersion and phpstanVersion in the metadata
+			// keep a released version away from another release's objects, but a source checkout keeps
+			// one phpstanVersion across every edit of these classes, so this is reachable there. A cache
+			// that cannot be reconstructed is discarded like any other unusable one.
+			$errors = $data['errorsCallback']();
+			$locallyIgnoredErrors = $data['locallyIgnoredErrorsCallback']();
+			$collectedData = $data['collectedDataCallback']();
+			$exportedNodes = $data['exportedNodesCallback']();
+		} catch (Throwable $e) {
+			@unlink($cacheFilePath);
+
+			return $this->fullAnalysis(
+				sprintf('Result cache not used because the cached results could not be read back: %s', $e->getMessage()),
+				$allAnalysedFiles,
+				$meta,
+				$currentFileHashes,
+				$output,
+			);
+		}
 		$filteredErrors = [];
 		$filteredLocallyIgnoredErrors = [];
 		$filteredLinesToIgnore = [];