Resolve self/parent/static in Closure::bind() scope

[zonuexe]

Resolves self / parent / static against the Closure::bind() scope (the 3rd argument) inside the bound closure body, for both type inference and the related rules.

Rebased onto 2.2.x and reworked: the original inline patch in MutatingScope::getType() no longer exists after expression handling was split into ExprHandler services, so the logic now lives where each expression/rule resolves its class scope.

What works now

Inside Closure::bind(fn () => …, $newThis, Scope::class):

• Class constants — self::CONST, parent::CONST resolve against the bound scope.
• ::class — self::class, parent::class.
• Static method calls — self::method(), parent::method() return types.
• Static property access — self::$prop, parent::$prop types.
• Instantiation — new self, new parent, new static.
• Rules no longer emit Using self outside of class scope. etc. and check accessibility against the bound class: ClassConstantRule, StaticMethodCallCheck, AccessStaticPropertiesCheck, InstantiationRule.

This works even when Closure::bind() is called outside a class context (the closure body type is inferred in the enclosing scope, where the closure-bind scope classes are otherwise unavailable — hence the class-name nodes are annotated by ClosureBindArgVisitor).

Approach

• ClosureBindArgVisitor annotates self/parent/static class-name nodes inside the closure body only (1st argument) with the bind scope argument. The $newThis/$newScope arguments are intentionally not rescoped — this keeps Closure::bind(self::cond() ? … : …, …) correct (see #6319).
• ClosureBindScopeResolver (new) resolves that annotation to a ClassReflection, shared by ClassConstFetchHandler and the rules.
• MutatingScope::resolveName() / resolveTypeByName() honour the annotation so static calls / properties / new resolve without touching each handler.

Issues

• Advances Closure::bind does not rebind correctly phpstan#5987 — self::/parent:: constant, ::class, static method, and private-member cases now resolve. (Remaining: static:: late static binding and the bound $this object type — a separate concern, overlaps Narrow down static and $this together #2972.)
• Regression coverage for Incorrect class in closure for Closure::bind phpstan#7675, #6319, Defer by-ref closure scope modifications after all args are processed #4865 (all already fixed; unchanged here).

Not included (follow-ups)

• Closure::bindTo() (Support Closure::bindTo() phpstan#8569) — separate call, separate visitor path.
• static:: LSB + bound $this type (Closure::bind does not rebind correctly phpstan#5987 remainder) — overlaps the stalled Narrow down static and $this together #2972; better decided after review of this approach.

[phpstan-bot]

This pull request has been marked as ready for review.

[phpstan-bot]

This pull request has been marked as ready for review.

[staabm]

@SanderMuller please review :)

[SanderMuller]

Reviewed. I ran it rather than only reading it, and the approach holds up: the rescoping is confined to the closure body, everything the description advertises resolves, and the cases that fall outside it fail safe.

Verified against 81e06a583 at level 9, with Closure::bind(fn () => …, null, Target::class) and Target extends Base:

expression	before	after
self::C	Using self outside of class scope.	'target'
parent::C	error	'base'
self::SECRET (private const)	error	42
self::$prop (private static)	error	string
self::priv() (private static)	error	int
new self()	error	P\Target
self::class	error	'P\Target'

A closure nested inside a bound closure inherits the bind scope and resolves to 'target', which matches PHP: the inner closure is created while the outer one already carries the rebound scope.

The confinement claim is real, which was the part I most wanted to check. Inside a method of Ctx, self::cond() in the first argument stays 'ctx', self::obj() in the $newThis argument stays P\Ctx, self::C inside the body is 'target', and self::C after the call is 'ctx' again. So #6319 stays fixed.

Gates on the head: full suite green (21288 tests, 96849 assertions), self-analysis clean. Nothing under turbo-ext, and MutatingScope is not shadowed by it, so there is no native mirror to keep in step.

Three cases sit outside the visitor. All of them decline to rescope rather than picking the wrong class, which is the right direction, but two are worth knowing about:

1. Named arguments in non-positional order. Closure::bind(closure: fn () => self::C, newScope: Target::class, newThis: null) still reports Using self outside of class scope., because getArgs() is read positionally, so $args[2] is newThis there. A non-class expression lands in the resolver and it returns null, so nothing is misresolved. ArgumentsNormalizer would cover it if you want it, otherwise a comment saying positional-only would help.
2. An object as the scope, Closure::bind(fn () => self::C, $o, $o), which PHP accepts. getClassStringObjectType() yields no class names for an object type, so it is left alone.
3. A closure not written inline at the call site. Inherent to the approach, no complaint.

Three small code notes:

• MutatingScope::resolveClosureBindScopeClassName() repeats what ClosureBindScopeResolver::resolveScopeClass() already does. Is that to avoid a dependency cycle in the scope, or could the scope take the resolver?
• That method carries two doc blocks, the prose one followed by /** @return non-empty-string|null */. Only the second attaches, so the explanation is orphaned. Worth merging into one.
• The annotation path now sits beside the existing enterClosureBind() / inClosureBindScopeClasses one. The description explains why the scope-based path cannot reach the out-of-class case, so both earn their place, but a line saying which one owns which case would save the next reader the trip.

The single red job is Compile Turbo Extension (8.4, macos-x86_64) at 35m0s, which is the runner timeout on a compile step, and this PR has no C++ in it.

On performance, since the visitor calls spl_object_id() and an array lookup on every node entered and left, I measured instead of assuming. Three interleaved rounds on a doctrine/symfony codebase: 139.0s median on the base against 138.6s with the PR, inside a within-build spread of about 4s. No measurable cost.