Fix NAN same-variable comparison: $a === $a where $a is NAN should be false

The same-variable short-circuit in RicherScopeGetTypeHelper and
BinaryOpHandler assumed $a === $a and $a == $a are always true, but
this is incorrect when $a is NAN (NAN !== NAN in PHP). Added NAN check
before the short-circuit, and made containsNan public for reuse.

Added test cases for $a = NAN; $a == $a; [$a] == [$a] as requested.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/BinaryOpHandler.php

@@ -109,7 +109,10 @@ public function resolveType(MutatingScope $scope, Expr $expr): Type
 				&& is_string($expr->right->name)
 				&& $expr->left->name === $expr->right->name
 			) {
-				return new ConstantBooleanType(true);
+				$varType = $scope->getType($expr->left);
+				if (!$this->initializerExprTypeResolver->containsNan($varType)) {
+					return new ConstantBooleanType(true);
+				}
 			}
 
 			$leftType = $scope->getType($expr->left);

src/Analyser/RicherScopeGetTypeHelper.php

@@ -36,7 +36,10 @@ public function getIdenticalResult(Scope $scope, Identical $expr): TypeResult
 			&& is_string($expr->right->name)
 			&& $expr->left->name === $expr->right->name
 		) {
-			return new TypeResult(new ConstantBooleanType(true), []);
+			$varType = $scope->getType($expr->left);
+			if (!$this->initializerExprTypeResolver->containsNan($varType)) {
+				return new TypeResult(new ConstantBooleanType(true), []);
+			}
 		}
 
 		$leftType = $scope->getType($expr->left);

src/Reflection/InitializerExprTypeResolver.php

@@ -2070,7 +2070,7 @@ private function resolveConstantArrayTypeComparison(ConstantArrayType $leftType,
 		return new TypeResult($resultType->toBoolean(), []);
 	}
 
-	private function containsNan(Type $type): bool
+	public function containsNan(Type $type): bool
 	{
 		if ($type instanceof ConstantFloatType && is_nan($type->getValue())) {
 			return true;

tests/PHPStan/Rules/Comparison/ConstantLooseComparisonRuleTest.php

@@ -260,6 +260,14 @@ public function testBug14394(): void
 				'Loose comparison using == between list<mixed> and array{NAN} will always evaluate to false.',
 				10,
 			],
+			[
+				'Loose comparison using == between NAN and NAN will always evaluate to false.',
+				16,
+			],
+			[
+				'Loose comparison using == between array{NAN} and array{NAN} will always evaluate to false.',
+				18,
+			],
 		]);
 	}
 

tests/PHPStan/Rules/Comparison/StrictComparisonOfDifferentTypesRuleTest.php

@@ -1195,6 +1195,14 @@ public function testBug14394(): void
 				'Strict comparison using === between list<mixed> and array{NAN} will always evaluate to false.',
 				11,
 			],
+			[
+				'Strict comparison using === between NAN and NAN will always evaluate to false.',
+				17,
+			],
+			[
+				'Strict comparison using === between array{NAN} and array{NAN} will always evaluate to false.',
+				19,
+			],
 		]);
 	}
 

tests/PHPStan/Rules/Comparison/data/bug-14394.php

@@ -11,6 +11,14 @@ public static function test(float $v1, array $v2): void {
 		if ($v2 === [NAN]) { echo "never reached\n"; }
 	}
 
+	public static function testSameVariable(): void {
+		$a = NAN;
+		if ($a == $a) { echo "never reached\n"; }
+		if ($a === $a) { echo "never reached\n"; }
+		if ([$a] == [$a]) { echo "never reached\n"; }
+		if ([$a] === [$a]) { echo "never reached\n"; }
+	}
+
 	/** @param array{NAN}|array{1} $v */
 	public static function testUnionArrayNotAlwaysFalse(array $v): void {
 		if ($v === [1]) { echo "maybe reached\n"; }