Batch unionWith in specifyTypesForFlattenedBooleanOr falsey path to avoid O(N²)

The falsey path called `unionWith` N times in a loop. Each call did
`TypeCombinator::union()` on the incrementally growing `sureNotTypes`,
making each step O(K) for K accumulated types — O(N²) total.

Collect per-expression types into arrays first, then build the final
`TypeCombinator::union()`/`intersect()` once at the end in O(N).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Analyser/TypeSpecifier.php

@@ -2020,13 +2020,36 @@ private function specifyTypesForFlattenedBooleanOr(
 		$arms = array_reverse($arms);
 
 		if ($context->false() || $context->falsey()) {
-			// Falsey: all arms are false → union all SpecifiedTypes
-			$result = new SpecifiedTypes([], []);
+			// Falsey: all arms are false → union all SpecifiedTypes.
+			// Collect per-expression types first, then build unions once
+			// to avoid O(N²) from incremental TypeCombinator::union() growth.
+			/** @var array<string, array{Expr, list<Type>}> $sureTypesPerExpr */
+			$sureTypesPerExpr = [];
+			/** @var array<string, array{Expr, list<Type>}> $sureNotTypesPerExpr */
+			$sureNotTypesPerExpr = [];
+
 			foreach ($arms as $arm) {
 				$armTypes = $this->specifyTypesInCondition($scope, $arm, $context);
-				$result = $result->unionWith($armTypes);
+				foreach ($armTypes->getSureTypes() as $exprString => [$exprNode, $type]) {
+					$sureTypesPerExpr[$exprString][0] = $exprNode;
+					$sureTypesPerExpr[$exprString][1][] = $type;
+				}
+				foreach ($armTypes->getSureNotTypes() as $exprString => [$exprNode, $type]) {
+					$sureNotTypesPerExpr[$exprString][0] = $exprNode;
+					$sureNotTypesPerExpr[$exprString][1][] = $type;
+				}
 			}
-			return $result->setRootExpr($expr);
+
+			$sureTypes = [];
+			foreach ($sureTypesPerExpr as $exprString => [$exprNode, $types]) {
+				$sureTypes[$exprString] = [$exprNode, TypeCombinator::intersect(...$types)];
+			}
+			$sureNotTypes = [];
+			foreach ($sureNotTypesPerExpr as $exprString => [$exprNode, $types]) {
+				$sureNotTypes[$exprString] = [$exprNode, TypeCombinator::union(...$types)];
+			}
+
+			return (new SpecifiedTypes($sureTypes, $sureNotTypes))->setRootExpr($expr);
 		}
 
 		// Truthy: at least one arm is true → intersect all normalized SpecifiedTypes

tests/bench/data/or-chain-falsey-blowup.php

@@ -0,0 +1,39 @@
+<?php declare(strict_types = 1);
+
+namespace BenchOrChainFalseyBlowup;
+
+/**
+ * Regression test for O(N²) in specifyTypesForFlattenedBooleanOr falsey path.
+ * Each unionWith call incrementally grew the sureNotTypes union,
+ * causing O(N²) TypeCombinator::union() work. The fix batches all
+ * per-expression types and builds unions once at the end.
+ *
+ * Slow with BOOLEAN_EXPRESSION_MAX_PROCESS_DEPTH raised to 128.
+ */
+function test(string $x): void
+{
+	if (
+		$x === 'v001' || $x === 'v002' || $x === 'v003' || $x === 'v004' || $x === 'v005' ||
+		$x === 'v006' || $x === 'v007' || $x === 'v008' || $x === 'v009' || $x === 'v010' ||
+		$x === 'v011' || $x === 'v012' || $x === 'v013' || $x === 'v014' || $x === 'v015' ||
+		$x === 'v016' || $x === 'v017' || $x === 'v018' || $x === 'v019' || $x === 'v020' ||
+		$x === 'v021' || $x === 'v022' || $x === 'v023' || $x === 'v024' || $x === 'v025' ||
+		$x === 'v026' || $x === 'v027' || $x === 'v028' || $x === 'v029' || $x === 'v030' ||
+		$x === 'v031' || $x === 'v032' || $x === 'v033' || $x === 'v034' || $x === 'v035' ||
+		$x === 'v036' || $x === 'v037' || $x === 'v038' || $x === 'v039' || $x === 'v040' ||
+		$x === 'v041' || $x === 'v042' || $x === 'v043' || $x === 'v044' || $x === 'v045' ||
+		$x === 'v046' || $x === 'v047' || $x === 'v048' || $x === 'v049' || $x === 'v050' ||
+		$x === 'v051' || $x === 'v052' || $x === 'v053' || $x === 'v054' || $x === 'v055' ||
+		$x === 'v056' || $x === 'v057' || $x === 'v058' || $x === 'v059' || $x === 'v060' ||
+		$x === 'v061' || $x === 'v062' || $x === 'v063' || $x === 'v064' || $x === 'v065' ||
+		$x === 'v066' || $x === 'v067' || $x === 'v068' || $x === 'v069' || $x === 'v070' ||
+		$x === 'v071' || $x === 'v072' || $x === 'v073' || $x === 'v074' || $x === 'v075' ||
+		$x === 'v076' || $x === 'v077' || $x === 'v078' || $x === 'v079' || $x === 'v080' ||
+		$x === 'v081' || $x === 'v082' || $x === 'v083' || $x === 'v084' || $x === 'v085' ||
+		$x === 'v086' || $x === 'v087' || $x === 'v088' || $x === 'v089' || $x === 'v090' ||
+		$x === 'v091' || $x === 'v092' || $x === 'v093' || $x === 'v094' || $x === 'v095' ||
+		$x === 'v096' || $x === 'v097' || $x === 'v098' || $x === 'v099' || $x === 'v100'
+	) {
+		echo $x;
+	}
+}