Collect all remaining callable parameter types for variadic closure parameters instead of using only the matching index

src/Analyser/MutatingScope.php

@@ -2021,7 +2021,7 @@
 			$isNullable = $this->isParameterValueNullable($parameter);
 			$parameterType = $this->getFunctionType($parameter->type, $isNullable, $parameter->variadic);
 			if ($callableParameters !== null) {
-				$parameterType = self::intersectButNotNever($parameterType, $this->getCallableParameterType($callableParameters, $i));
+				$parameterType = self::intersectButNotNever($parameterType, $this->getCallableParameterType($parameter, $callableParameters, $i));
 			}
 			$holder = ExpressionTypeHolder::createYes($parameter->var, $parameterType);
 			$expressionTypes[$paramExprString] = $holder;
@@ -2221,7 +2221,7 @@
 			$isNullable = $this->isParameterValueNullable($parameter);
 			$parameterType = $this->getFunctionType($parameter->type, $isNullable, $parameter->variadic);
 			if ($callableParameters !== null) {
-				$parameterType = self::intersectButNotNever($parameterType, $this->getCallableParameterType($callableParameters, $i));
+				$parameterType = self::intersectButNotNever($parameterType, $this->getCallableParameterType($parameter, $callableParameters, $i));
 			}
 
 			if (!$parameter->var instanceof Variable || !is_string($parameter->var->name)) {
@@ -2290,8 +2290,12 @@
 	/**
 	 * @param ParameterReflection[] $callableParameters
 	 */
-	private function getCallableParameterType(array $callableParameters, int $index): Type
+	private function getCallableParameterType(Node\Param $parameter, array $callableParameters, int $index): Type
 	{
+		if ($parameter->variadic) {
+			return $this->buildVariadicArrayTypeFromCallableParameters($callableParameters, $index);
+		}
+
 		if (isset($callableParameters[$index])) {
 			return $callableParameters[$index]->getType();
 		}
@@ -2308,6 +2312,40 @@
 		return new MixedType();
 	}
 
+	/**
+	 * @param array<ParameterReflection> $callableParameters
+	 */
+	private function buildVariadicArrayTypeFromCallableParameters(array $callableParameters, int $startIndex): Type
+	{
+		$elementTypes = [];
+		$callableParametersCount = count($callableParameters);
+		for ($j = $startIndex; $j < $callableParametersCount; $j++) {
+			$elementTypes[] = $callableParameters[$j]->getType();
+			if ($callableParameters[$j]->isVariadic()) {
+				break;
+			}
+		}
+
+		if ($elementTypes === [] && $callableParametersCount > 0) {
+			$lastParameter = array_last($callableParameters);
+			if ($lastParameter->isVariadic()) {
+				$elementTypes[] = $lastParameter->getType();
+			}
+		}
+
+		if ($elementTypes === []) {
+			return new MixedType();
+		}
+
+		$elementType = TypeCombinator::union(...$elementTypes);
+
+		if (!$this->getPhpVersion()->supportsNamedArguments()->no()) {
+			return new ArrayType(new UnionType([new IntegerType(), new StringType()]), $elementType);
+		}
+
+		return new IntersectionType([new ArrayType(IntegerRangeType::createAllGreaterThanOrEqualTo(0), $elementType), new AccessoryArrayListType()]);
+	}
+
 	public static function intersectButNotNever(Type $nativeType, Type $inferredType): Type
 	{
 		if ($nativeType->isSuperTypeOf($inferredType)->no()) {

src/Analyser/NodeScopeResolver.php

@@ -2965,7 +2965,15 @@ public function createCallableParameters(Scope $scope, Expr $closureExpr, ?array
 						continue;
 					}
 
-					$type = $scope->getType($args[$index]->value);
+					if ($callableParameter->isVariadic()) {
+						$argTypes = [];
+						for ($j = $index; $j < count($args); $j++) {
+							$argTypes[] = $scope->getType($args[$j]->value);
+						}
+						$type = TypeCombinator::union(...$argTypes);
+					} else {
+						$type = $scope->getType($args[$index]->value);
+					}
 					$callableParameters[$index] = new NativeParameterReflection(
 						$callableParameter->getName(),
 						$callableParameter->isOptional(),

tests/PHPStan/Analyser/nsrt/bug-9240-php7.php

@@ -0,0 +1,108 @@
+<?php // lint < 8.0
+
+declare(strict_types = 1);
+
+namespace Bug9240Php7;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @phpstan-type PhpFileArray array{error: int, name: string}
+ */
+class Upload
+{
+	/**
+	 * @param \Closure(PhpFileArray, PhpFileArray, PhpFileArray): bool $fx
+	 */
+	public function onUpload(\Closure $fx): bool
+	{
+		$v = ['error' => 1, 'name' => 'x'];
+		$postFiles = [$v, $v, $v];
+
+		return $fx(...$postFiles);
+	}
+}
+
+function test(): void
+{
+	$u = new Upload();
+	$u->onUpload(function (...$postFiles): bool {
+		assertType('list<array{error: int, name: string}>', $postFiles);
+		foreach ($postFiles as $postFile) {
+			assertType('array{error: int, name: string}', $postFile);
+			if ($postFile['error'] !== 0) {
+				return false;
+			}
+		}
+
+		return true;
+	});
+}
+
+/**
+ * @param \Closure(int, string, float): void $fx
+ */
+function mixedTypes(\Closure $fx): void
+{
+	$fx(1, 'hello', 3.14);
+}
+
+function testMixedTypes(): void
+{
+	mixedTypes(function (...$args): void {
+		assertType('list<float|int|string>', $args);
+	});
+}
+
+/**
+ * @param \Closure(int, string): void $fx
+ */
+function twoParams(\Closure $fx): void
+{
+	$fx(1, 'hello');
+}
+
+function testVariadicNotFirst(): void
+{
+	twoParams(function (int $first, string ...$rest): void {
+		assertType('int', $first);
+		assertType('list<string>', $rest);
+	});
+}
+
+// Arrow function version
+function testArrowFunction(): void
+{
+	$u = new Upload();
+	$u->onUpload(fn (...$postFiles) => assertType('list<array{error: int, name: string}>', $postFiles) || true);
+}
+
+// Immediately-invoked closure with variadic
+function testImmediatelyInvoked(): void
+{
+	$result = (function (...$args): string {
+		assertType('list<1|3.14|\'hello\'>', $args);
+		return implode(', ', $args);
+	})(1, 'hello', 3.14);
+}
+
+// Immediately-invoked arrow function with variadic
+function testImmediatelyInvokedArrow(): void
+{
+	$result = (fn (...$args) => assertType('list<1|3.14|\'hello\'>', $args))(1, 'hello', 3.14);
+}
+
+// Variadic param with last callable parameter also variadic
+/**
+ * @param \Closure(string, int...): void $fx
+ */
+function variadicExpected(\Closure $fx): void
+{
+}
+
+function testVariadicExpected(): void
+{
+	variadicExpected(function (...$args): void {
+		assertType('list<int|string>', $args);
+	});
+}

tests/PHPStan/Analyser/nsrt/bug-9240.php

@@ -0,0 +1,108 @@
+<?php // lint >= 8.0
+
+declare(strict_types = 1);
+
+namespace Bug9240;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @phpstan-type PhpFileArray array{error: int, name: string}
+ */
+class Upload
+{
+	/**
+	 * @param \Closure(PhpFileArray, PhpFileArray, PhpFileArray): bool $fx
+	 */
+	public function onUpload(\Closure $fx): bool
+	{
+		$v = ['error' => 1, 'name' => 'x'];
+		$postFiles = [$v, $v, $v];
+
+		return $fx(...$postFiles);
+	}
+}
+
+function test(): void
+{
+	$u = new Upload();
+	$u->onUpload(function (...$postFiles): bool {
+		assertType('array<int|string, array{error: int, name: string}>', $postFiles);
+		foreach ($postFiles as $postFile) {
+			assertType('array{error: int, name: string}', $postFile);
+			if ($postFile['error'] !== 0) {
+				return false;
+			}
+		}
+
+		return true;
+	});
+}
+
+/**
+ * @param \Closure(int, string, float): void $fx
+ */
+function mixedTypes(\Closure $fx): void
+{
+	$fx(1, 'hello', 3.14);
+}
+
+function testMixedTypes(): void
+{
+	mixedTypes(function (...$args): void {
+		assertType('array<int|string, float|int|string>', $args);
+	});
+}
+
+/**
+ * @param \Closure(int, string): void $fx
+ */
+function twoParams(\Closure $fx): void
+{
+	$fx(1, 'hello');
+}
+
+function testVariadicNotFirst(): void
+{
+	twoParams(function (int $first, string ...$rest): void {
+		assertType('int', $first);
+		assertType('array<int|string, string>', $rest);
+	});
+}
+
+// Arrow function version
+function testArrowFunction(): void
+{
+	$u = new Upload();
+	$u->onUpload(fn (...$postFiles) => assertType('array<int|string, array{error: int, name: string}>', $postFiles) || true);
+}
+
+// Immediately-invoked closure with variadic
+function testImmediatelyInvoked(): void
+{
+	$result = (function (...$args): string {
+		assertType('array<int|string, 1|3.14|\'hello\'>', $args);
+		return implode(', ', $args);
+	})(1, 'hello', 3.14);
+}
+
+// Immediately-invoked arrow function with variadic
+function testImmediatelyInvokedArrow(): void
+{
+	$result = (fn (...$args) => assertType('array<int|string, 1|3.14|\'hello\'>', $args))(1, 'hello', 3.14);
+}
+
+// Variadic param with last callable parameter also variadic
+/**
+ * @param \Closure(string, int...): void $fx
+ */
+function variadicExpected(\Closure $fx): void
+{
+}
+
+function testVariadicExpected(): void
+{
+	variadicExpected(function (...$args): void {
+		assertType('array<int|string, int|string>', $args);
+	});
+}

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1321,6 +1321,11 @@ public function testArraySearchExisting(): void
 		]);
 	}
 
+	public function testBug9240(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-9240.php'], []);
+	}
+
 	#[RequiresPhp('>= 8.4.0')]
 	public function testArrayFindKeyExisting(): void
 	{

tests/PHPStan/Rules/Arrays/data/bug-9240.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Bug9240Rule;
+
+/**
+ * @phpstan-type PhpFileArray array{error: int, name: string}
+ */
+class Upload
+{
+	/**
+	 * @param \Closure(PhpFileArray, PhpFileArray, PhpFileArray): bool $fx
+	 */
+	public function onUpload(\Closure $fx): bool
+	{
+		$v = ['error' => 1, 'name' => 'x'];
+		$postFiles = [$v, $v, $v];
+
+		return $fx(...$postFiles);
+	}
+}
+
+function test(): void
+{
+	$u = new Upload();
+	$u->onUpload(function (...$postFiles): bool {
+		foreach ($postFiles as $postFile) {
+			if ($postFile['error'] !== 0) {
+				return false;
+			}
+		}
+
+		return true;
+	});
+}