Resolve ConditionalTypeForParameter children before converting to ConditionalType to prevent infinite traversal

- In `ResolvedFunctionVariantWithOriginal::resolveConditionalTypesForParameter()`, traverse
  children (target, if, else) of `ConditionalTypeForParameter` first, then convert to
  `ConditionalType` and return without further traversal. This prevents entering the subject
  (the passed argument type), which may contain its own `ConditionalTypeForParameter` with a
  colliding parameter name (e.g. `$value`), causing infinite recursion.
- Applied the same fix to the analogous pattern in `TypeSpecifier::resolveAssertTypes()`.
- Triggered by `is_X(is_Y(...))` first-class callable combinations where both functions have
  conditional return types using the same parameter name `$value`.

Author: ondrejmirtes

src/Analyser/TypeSpecifier.php

@@ -1849,8 +1849,12 @@ private function specifyTypesFromAsserts(TypeSpecifierContext $context, Expr\Cal
 					if ($type instanceof ConditionalTypeForParameter) {
 						$parameterName = substr($type->getParameterName(), 1);
 						if (array_key_exists($parameterName, $argsMap)) {
-							$argType = TypeCombinator::union(...array_map(static fn (Expr $expr) => $scope->getType($expr), $argsMap[$parameterName]));
-							$type = $type->toConditional($argType);
+							$type = $traverse($type);
+							if ($type instanceof ConditionalTypeForParameter) {
+								$argType = TypeCombinator::union(...array_map(static fn (Expr $expr) => $scope->getType($expr), $argsMap[substr($type->getParameterName(), 1)]));
+								return $type->toConditional($argType);
+							}
+							return $type;
 						}
 					}
 

src/Reflection/ResolvedFunctionVariantWithOriginal.php

@@ -290,7 +290,13 @@ private function resolveConditionalTypesForParameter(Type $type): Type
 	{
 		return TypeTraverser::map($type, function (Type $type, callable $traverse): Type {
 			if ($type instanceof ConditionalTypeForParameter && array_key_exists($type->getParameterName(), $this->passedArgs)) {
-				$type = $type->toConditional($this->passedArgs[$type->getParameterName()]);
+				// Traverse children first, then convert — avoids infinite loop when
+				// the passed argument contains ConditionalTypeForParameter with a colliding parameter name.
+				$type = $traverse($type);
+				if ($type instanceof ConditionalTypeForParameter) {
+					return $type->toConditional($this->passedArgs[$type->getParameterName()]);
+				}
+				return $type;
 			}
 
 			return $traverse($type);

tests/PHPStan/Analyser/nsrt/bug-13872.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Bug13872;
+
+use function is_array;
+use function is_bool;
+use function is_callable;
+use function is_countable;
+use function is_float;
+use function is_int;
+use function is_iterable;
+use function is_null;
+use function is_numeric;
+use function is_object;
+use function is_resource;
+use function is_scalar;
+use function is_string;
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+	public function check(): void
+	{
+		assertType('true', is_callable(is_callable(...)));
+		assertType('true', is_callable(is_array(...)));
+		assertType('false', is_array(is_string(...)));
+		assertType('false', is_string(is_int(...)));
+		assertType('false', is_int(is_callable(...)));
+		assertType('true', is_object(is_callable(...)));
+		assertType('true', is_callable(is_bool(...)));
+		assertType('false', is_null(is_string(...)));
+		assertType('false', is_float(is_int(...)));
+		assertType('false', is_scalar(is_numeric(...)));
+		assertType('false', is_countable(is_array(...)));
+		assertType('false', is_iterable(is_string(...)));
+		assertType('false', is_resource(is_callable(...)));
+	}
+}