fix inheritance chaining

Signed-off-by: Robert Landers <landers.robert@gmail.com>

Author: withinboredom

Zend/tests/generics/inheritance/lsp/impl_with_identity_type_param_binding.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Parametric LSP: child implementing `I<TN>` with its own TN forwarded to parent's TN
+--FILE--
+<?php
+// Regression: when both parent and child bind the same parameter shape
+// (parent's TN, child's TN, both bare type-parameter refs), the
+// inheritance check needs to treat them as equivalent. The parent's
+// substituted return is itself a type-parameter ref so the substitute
+// helper falls back to the erased form; the child must follow the same
+// fall-back, or the check sees `mixed` vs `TN` and rejects what's
+// structurally an identity binding.
+
+interface GI<TN = mixed, TW = mixed> {
+    public function getEdgesFrom(TN $from): array;
+}
+
+class DG<TN = mixed, TW = mixed> implements GI<TN, TW> {
+    public function getEdgesFrom(TN $from): array { return []; }
+}
+
+echo "OK\n";
+?>
+--EXPECT--
+OK

Zend/tests/generics/inheritance/lsp/method_level_param_bound_subst.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Parametric LSP: method-level type-parameter bound that references a class-scope T substitutes when the subclass binds T
+--FILE--
+<?php
+// Regression: `class A<T> { function set<U : T>(U $x) }` — the method's
+// own U has a bound that's a class-scope T-ref. When `class B extends A<string>`
+// supplies T = string, the inheritance check on the inherited (or overridden)
+// method must see U's bound substituted from T → string, otherwise the parent
+// renders as `set(mixed $x)` (T erased) and the child's `set<U:string>(U $x)`
+// gets rejected as narrower than mixed.
+
+class A<T> {
+    public function set<U : T>(U $x): void {}
+}
+
+class B extends A<string> {
+    public function set<U : string>(U $x): void {}
+}
+
+class C<Tl, Tr> {
+    public function set<U : Tl|Tr>(U $x): void {}
+}
+
+class D extends C<string, int> {
+    public function set<U : string|int>(U $x): void {}
+}
+
+echo "OK\n";
+?>
+--EXPECT--
+OK

Zend/zend_inheritance.c

@@ -1256,10 +1256,12 @@ static bool zend_get_target_default_args(
 	return true;
 }
 
-/* If ce supplies type arguments to proto's declaring scope (directly,
- * transitively, or via parameter defaults), returns proto's pre-erasure type
- * with class-scope T-refs substituted. */
-static zend_type zend_substitute_proto_type(
+/* Internal: substitute proto's pre-erasure against ce's binding without
+ * applying the top-level type-parameter fallback. May return a type that
+ * still has TYPE_PARAMETER refs at the top — callers use this to detect
+ * the "would fall back" case so the child side can mirror it. Returns
+ * `fallback` (unchanged) when no substitution applies at all. */
+static zend_type zend_substitute_proto_type_raw(
 		zend_type fallback,
 		const zend_type *pre_erasure,
 		const zend_function *proto,
@@ -1269,12 +1271,30 @@ static zend_type zend_substitute_proto_type(
 		return fallback;
 	}
 
-	/* Top-level type-param ref of function-scope origin can't be bound by
-	 * inheritance. Compound types may still contain class-scope refs deep
-	 * inside; the leaf walker filters origin per-leaf. */
+	/* Top-level type-param ref of function-scope origin: dereference to the
+	 * param's bound's pre-erasure. This lets `set<U : T>(U $x)` substitute
+	 * T → ce's binding in U's bound, so the inheritance check compares the
+	 * substituted bound rather than the erased mixed. */
 	if (ZEND_TYPE_HAS_TYPE_PARAMETER(*pre_erasure)
 			&& ZEND_TYPE_TYPE_PARAMETER(*pre_erasure)->origin != ZEND_GENERIC_ORIGIN_CLASS_LIKE) {
-		return fallback;
+		const zend_type_parameter_ref *ref = ZEND_TYPE_TYPE_PARAMETER(*pre_erasure);
+		if (!ZEND_USER_CODE(proto->common.type)) return fallback;
+		const zend_op_array *op = &proto->op_array;
+		if (!op->generic_parameters || ref->index >= op->generic_parameters->count) {
+			return fallback;
+		}
+		const zend_generic_parameter *p = &op->generic_parameters->parameters[ref->index];
+		const zend_type *bound_pre = ZEND_TYPE_IS_SET(p->bound_pre_erasure)
+			? &p->bound_pre_erasure
+			: (ZEND_TYPE_IS_SET(p->bound) ? &p->bound : NULL);
+		if (!bound_pre || !zend_type_contains_type_parameter(*bound_pre)) {
+			return fallback;
+		}
+		/* Recurse with the bound as the pre-erasure. The recursive call may
+		 * also need to deref (chained method-level bounds), but loop detection
+		 * isn't needed for inheritance because the user-visible bound is a
+		 * finite expression. */
+		return zend_substitute_proto_type_raw(fallback, bound_pre, proto, ce);
 	}
 	if (!zend_type_contains_type_parameter(*pre_erasure)) {
 		return fallback;
@@ -1298,49 +1318,96 @@ static zend_type zend_substitute_proto_type(
 			&& !zend_get_target_default_args(proto_scope, args, cap, &arity)) {
 		result = fallback;
 	} else {
-		zend_type substituted = zend_substitute_leaf_type_param(*pre_erasure, args, arity);
-		/* If the result is *still* a bare type-parameter (couldn't be ground),
-		 * fall back to the erased form so the inheritance check stays symmetric
-		 * with the other side's mixed. Compound types containing leftover
-		 * type-param leaves are kept — the structural comparison below handles
-		 * them by identity. */
-		result = ZEND_TYPE_HAS_TYPE_PARAMETER(substituted) ? fallback : substituted;
+		result = zend_substitute_leaf_type_param(*pre_erasure, args, arity);
 	}
 
 	free_alloca(args, use_heap);
 	return result;
 }
 
+/* If ce supplies type arguments to proto's declaring scope (directly,
+ * transitively, or via parameter defaults), returns proto's pre-erasure type
+ * with class-scope T-refs substituted. Applies a top-level fallback when the
+ * substituted result is still a bare TYPE_PARAMETER (couldn't be ground). */
+static zend_type zend_substitute_proto_type(
+		zend_type fallback,
+		const zend_type *pre_erasure,
+		const zend_function *proto,
+		zend_class_entry *ce)
+{
+	zend_type result = zend_substitute_proto_type_raw(fallback, pre_erasure, proto, ce);
+	/* If the result is *still* a bare type-parameter (couldn't be ground),
+	 * fall back to the erased form. Compound types containing leftover
+	 * type-param leaves are kept — the structural comparison handles them
+	 * by identity. */
+	return ZEND_TYPE_HAS_TYPE_PARAMETER(result) ? fallback : result;
+}
+
 /* Returns the type the inheritance check should use for the child (fe) side.
  * When the child has a pre-erasure stash and that stash carries class-scope
  * shape the arg_info erased away (e.g. `Tl|Tr` collapsed to mixed because
  * both members are unbounded class-scope type parameters), prefer the
  * pre-erasure so the check sees the same structure that's substituted in
  * for the parent side. Function-scope refs aren't bound by inheritance —
- * they erase to their bound and we keep using the erased form. */
+ * they erase to their bound and we keep using the erased form.
+ *
+ * `proto_substituted_had_type_param` tells us whether the parent's
+ * substitution would have fallen back to its erased form (its substituted
+ * result was a bare TYPE_PARAMETER). When that's true and the child's
+ * pre-erasure is also a bare TYPE_PARAMETER, the child falls back too —
+ * keeping both sides at the erased mixed so the comparison stays symmetric.
+ * Otherwise the child uses its pre-erasure so structural compounds (unions
+ * like `Tl|Tr`, named-with-args like `I<T>`) line up with the parent's
+ * substituted form. */
 static zend_type zend_resolve_fe_type(
 		zend_type fallback,
 		const zend_type *pre_erasure,
 		const zend_function *fe,
-		zend_class_entry *ce)
+		zend_class_entry *ce,
+		bool proto_substituted_had_type_param)
 {
 	if (!pre_erasure || !ZEND_TYPE_IS_SET(*pre_erasure)) {
 		return fallback;
 	}
+	/* Function-scope TYPE_PARAMETER ref: deref to the param's bound's
+	 * pre-erasure so its class-scope content can still drive the comparison.
+	 * Mirrors the symmetric deref in zend_substitute_proto_type_raw. */
+	if (ZEND_TYPE_HAS_TYPE_PARAMETER(*pre_erasure)
+			&& ZEND_TYPE_TYPE_PARAMETER(*pre_erasure)->origin != ZEND_GENERIC_ORIGIN_CLASS_LIKE) {
+		const zend_type_parameter_ref *ref = ZEND_TYPE_TYPE_PARAMETER(*pre_erasure);
+		if (!ZEND_USER_CODE(fe->common.type)) return fallback;
+		const zend_op_array *op = &fe->op_array;
+		if (!op->generic_parameters || ref->index >= op->generic_parameters->count) {
+			return fallback;
+		}
+		const zend_generic_parameter *p = &op->generic_parameters->parameters[ref->index];
+		const zend_type *bound_pre = ZEND_TYPE_IS_SET(p->bound_pre_erasure)
+			? &p->bound_pre_erasure
+			: (ZEND_TYPE_IS_SET(p->bound) ? &p->bound : NULL);
+		if (!bound_pre) return fallback;
+		return zend_resolve_fe_type(fallback, bound_pre, fe, ce, proto_substituted_had_type_param);
+	}
 	if (!zend_type_contains_class_scope_type_parameter(*pre_erasure)) {
+		/* Pre-erasure has structure but no class-scope refs to substitute.
+		 * If proto fell back (its substituted result was still a bare type
+		 * param), fall back here too for symmetric mixed-vs-mixed compare;
+		 * otherwise use the pre-erasure structure directly so unions like
+		 * `string|int` compare properly. */
+		if (proto_substituted_had_type_param
+				&& ZEND_TYPE_HAS_TYPE_PARAMETER(*pre_erasure)) {
+			return fallback;
+		}
+		return *pre_erasure;
+	}
+	/* Mirror the parent's fall-back: if proto fell back AND fe's pre-erasure
+	 * is itself a bare TYPE_PARAMETER, fall back to the erased form too. */
+	if (proto_substituted_had_type_param
+			&& ZEND_TYPE_HAS_TYPE_PARAMETER(*pre_erasure)) {
 		return fallback;
 	}
 	/* Immediate-child case: the pre-erasure type-param refs are already in
-	 * fe_scope, which is the same scope the comparison runs in. Mirror the
-	 * parent-side logic in zend_substitute_proto_type — if the pre-erasure
-	 * is a bare top-level TYPE_PARAMETER, fall back to the erased form so
-	 * both sides of the check see the same width (both substitute to the
-	 * erased bound; the parent already falls back here, so the child must
-	 * too or the comparison sees `T` vs `mixed` and spuriously rejects). */
+	 * fe_scope, which is the same scope the comparison runs in. */
 	if (ce == fe->common.scope) {
-		if (ZEND_TYPE_HAS_TYPE_PARAMETER(*pre_erasure)) {
-			return fallback;
-		}
 		return *pre_erasure;
 	}
 	/* Transitive: substitute the child's class-scope refs against ce's
@@ -1453,17 +1520,17 @@ static inheritance_status zend_do_perform_implementation_check(
 		}
 
 		uint32_t proto_param_idx = i < proto_num_args ? i : proto_num_args - 1;
-		zend_type proto_type = zend_substitute_proto_type(
+		zend_type proto_raw = zend_substitute_proto_type_raw(
 			proto_arg_info->type,
 			zend_get_param_pre_erasure(proto, proto_param_idx),
-			proto,
-			ce
-		);
+			proto, ce);
+		bool proto_fell_back = ZEND_TYPE_HAS_TYPE_PARAMETER(proto_raw);
+		zend_type proto_type = proto_fell_back ? proto_arg_info->type : proto_raw;
 		uint32_t fe_param_idx = i < fe_num_args ? i : fe_num_args - 1;
 		zend_type fe_type = zend_resolve_fe_type(
 			fe_arg_info->type,
 			zend_get_param_pre_erasure(fe, fe_param_idx),
-			fe, ce);
+			fe, ce, proto_fell_back);
 		local_status = zend_do_perform_arg_type_hint_check(
 			fe_scope, fe_type, proto_scope, proto_type);
 
@@ -1495,14 +1562,17 @@ static inheritance_status zend_do_perform_implementation_check(
 			return status;
 		}
 
-		zend_type proto_return_type = zend_substitute_proto_type(
+		zend_type proto_raw_ret = zend_substitute_proto_type_raw(
 			proto->common.arg_info[-1].type,
 			zend_get_return_pre_erasure(proto),
 			proto, ce);
+		bool proto_ret_fell_back = ZEND_TYPE_HAS_TYPE_PARAMETER(proto_raw_ret);
+		zend_type proto_return_type = proto_ret_fell_back
+			? proto->common.arg_info[-1].type : proto_raw_ret;
 		zend_type fe_return_type = zend_resolve_fe_type(
 			fe->common.arg_info[-1].type,
 			zend_get_return_pre_erasure(fe),
-			fe, ce);
+			fe, ce, proto_ret_fell_back);
 		local_status = zend_perform_covariant_type_check(
 			fe_scope, fe_return_type, proto_scope, proto_return_type);