Fix phpstan/phpstan#3831: false positive on comparison after dynamic method call

- Dynamic method calls like $this->{'compileSection'}() did not invalidate
  tracked expression types on the called object, causing properties set before
  the call (e.g. $this->footer = []) to retain their narrowed types
- Added invalidateAllOnExpression() to MutatingScope that clears tracked
  expression types (property fetches, method call results) without clearing
  conditional type narrowing
- New regression test in tests/PHPStan/Rules/Comparison/data/bug-3831.php

Author: VincentLanglet

src/Analyser/ExprHandler/MethodCallHandler.php

@@ -174,6 +174,9 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			}
 
 		} else {
+			if ($expr->name instanceof Expr) {
+				$scope = $scope->invalidateAllOnExpression($normalizedExpr->var);
+			}
 			$throwPoints[] = InternalThrowPoint::createImplicit($scope, $expr);
 		}
 		$hasYield = $hasYield || $result->hasYield();

src/Analyser/MutatingScope.php

@@ -3350,6 +3350,48 @@ public function invalidateExpression(Expr $expressionToInvalidate, bool $require
 		);
 	}
 
+	public function invalidateAllOnExpression(Expr $expressionToInvalidate): self
+	{
+		$expressionTypes = $this->expressionTypes;
+		$nativeExpressionTypes = $this->nativeExpressionTypes;
+		$invalidated = false;
+		$exprStringToInvalidate = $this->getNodeKey($expressionToInvalidate);
+
+		foreach ($expressionTypes as $exprString => $exprTypeHolder) {
+			$exprExpr = $exprTypeHolder->getExpr();
+			if (!$this->shouldInvalidateExpression($exprStringToInvalidate, $expressionToInvalidate, $exprExpr, $exprString, true)) {
+				continue;
+			}
+
+			unset($expressionTypes[$exprString]);
+			unset($nativeExpressionTypes[$exprString]);
+			$invalidated = true;
+		}
+
+		if (!$invalidated) {
+			return $this;
+		}
+
+		return $this->scopeFactory->create(
+			$this->context,
+			$this->isDeclareStrictTypes(),
+			$this->getFunction(),
+			$this->getNamespace(),
+			$expressionTypes,
+			$nativeExpressionTypes,
+			$this->conditionalExpressions,
+			$this->inClosureBindScopeClasses,
+			$this->anonymousFunctionReflection,
+			$this->inFirstLevelStatement,
+			$this->currentlyAssignedExpressions,
+			$this->currentlyAllowedUndefinedExpressions,
+			[],
+			$this->afterExtractCall,
+			$this->parentScope,
+			$this->nativeTypesPromoted,
+		);
+	}
+
 	private function shouldInvalidateExpression(string $exprStringToInvalidate, Expr $exprToInvalidate, Expr $expr, string $exprString, bool $requireMoreCharacters = false, ?ClassReflection $invalidatingClass = null): bool
 	{
 		if ($requireMoreCharacters && $exprStringToInvalidate === $exprString) {

tests/PHPStan/Rules/Comparison/NumberComparisonOperatorsConstantConditionRuleTest.php

@@ -288,4 +288,9 @@ public function testBug13874(): void
 		$this->analyse([__DIR__ . '/data/bug-13874.php'], []);
 	}
 
+	public function testBug3831(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-3831.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Comparison/data/bug-3831.php

@@ -0,0 +1,27 @@
+<?php declare(strict_types = 1);
+
+namespace Bug3831;
+
+class Template {
+
+	/** @var list<string> */
+	public $footer = [];
+
+	public function render() : string {
+		$content = '';
+		$this->footer = [];
+
+		// dynamic method call - could modify $this->footer
+		$this->{'compileSection'}();
+
+		if (count($this->footer) > 0) {
+			$content = str_replace('some', 'thing', $content);
+		}
+		return $content;
+	}
+
+	private function compileSection(): void {
+		$this->footer[] = 'section-name';
+	}
+
+}