fixup! Guard *scanf() return type extension by counter

Return `NeverType` on PHP 8+ (where an invalid format throws
`ValueError`) and `NullType` on PHP < 8.0. This makes the gatekeeper
precise about the call never returning on modern PHP.

The test strategy for the version‑dependent types will be settled
in review – the CI now whispers `*NEVER*` where `null` stood before,
and `array{}|null` where `array|null` stood before.

Author: hakre

src/Type/Php/SscanfFunctionDynamicReturnTypeExtension.php

@@ -5,6 +5,7 @@
 use PhpParser\Node\Expr\FuncCall;
 use PHPStan\Analyser\Scope;
 use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\Php\PhpVersion;
 use PHPStan\Reflection\FunctionReflection;
 use PHPStan\Rules\Functions\PrintfHelper;
 use PHPStan\Type\Accessory\AccessoryNonEmptyStringType;
@@ -16,6 +17,7 @@
 use PHPStan\Type\FloatType;
 use PHPStan\Type\IntegerType;
 use PHPStan\Type\IntersectionType;
+use PHPStan\Type\NeverType;
 use PHPStan\Type\NullType;
 use PHPStan\Type\StringType;
 use PHPStan\Type\Type;
@@ -28,7 +30,10 @@
 final class SscanfFunctionDynamicReturnTypeExtension implements DynamicFunctionReturnTypeExtension
 {
 
-	public function __construct(private PrintfHelper $printfHelper)
+	public function __construct(
+		private PrintfHelper $printfHelper,
+		private PhpVersion $phpVersion,
+	)
 	{
 	}
 
@@ -57,11 +62,12 @@ public function getTypeFromFunctionCall(
 		$formatValue = $formatType->getValue();
 		$placeholderCount = $this->printfHelper->getScanfPlaceholdersCount($formatValue);
 		if ($placeholderCount === null) {
-			return new NullType();
+			return $this->phpVersion->throwsValueErrorForInternalFunctions() ? new NeverType() : new NullType();
 		}
 
+		$arrayBuilder = ConstantArrayTypeBuilder::createEmpty();
+
 		if (preg_match_all('/%(\d*)(\[[^\]]+\]|[cdeEfosux]{1})/', $formatValue, $matches) > 0) {
-			$arrayBuilder = ConstantArrayTypeBuilder::createEmpty();
 
 			for ($i = 0; $i < count($matches[0]); $i++) {
 				$length = $matches[1][$i];
@@ -94,10 +100,9 @@ public function getTypeFromFunctionCall(
 				$arrayBuilder->setOffsetValueType(new ConstantIntegerType($i), $type);
 			}
 
-			return TypeCombinator::addNull($arrayBuilder->getArray());
 		}
 
-		return null;
+		return TypeCombinator::addNull($arrayBuilder->getArray());
 	}
 
 }

tests/PHPStan/Analyser/NodeScopeResolverTest.php

@@ -284,6 +284,12 @@ private static function findTestFiles(): iterable
 		yield __DIR__ . '/../Rules/Variables/data/bug-14124.php';
 		yield __DIR__ . '/../Rules/Variables/data/bug-14124b.php';
 		yield __DIR__ . '/../Rules/Arrays/data/bug-14308.php';
+
+		if (PHP_VERSION_ID < 80000) {
+			yield __DIR__ . '/data/sscanf-php74.php';
+		} else {
+			yield __DIR__ . '/data/sscanf-php80.php';
+		}
 	}
 
 	/**

tests/PHPStan/Analyser/data/sscanf-php74.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace SscanfPHP74;
+
+use function PHPStan\Testing\assertType;
+
+function sscanfInvalidFormatMixingPositionalWithSequential(string $s) {
+	assertType('null', sscanf($s, '%1$s %s'));
+}

tests/PHPStan/Analyser/data/sscanf-php80.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace SscanfPHP80;
+
+use function PHPStan\Testing\assertType;
+
+function sscanfInvalidFormatMixingPositionalWithSequential(string $s) {
+	assertType('*NEVER*', sscanf($s, '%1$s %s'));
+}

tests/PHPStan/Analyser/nsrt/sscanf.php

@@ -55,7 +55,3 @@ function sscanfSuppression(string $s) {
 	assertType('array{string|null}|null', sscanf($s, '%*d %s'));
 	assertType('array{int|null}|null', sscanf($s, '%*[a-z]%d'));
 }
-
-function sscanfInvalidFormatMixingPositionalWithSequential(string $s) {
-	assertType('null', sscanf($s, '%1$s %s'));
-}