Fix method_exists() with string literal not narrowing static method calls

- When method_exists() receives a string literal class name (not ClassName::class),
  the type narrowing was only applied to the string expression, not to the equivalent
  ClassConstFetch expression that StaticMethodCallCheck uses
- Added logic in MethodExistsTypeSpecifyingExtension to also narrow the ClassConstFetch
  expression when the first argument is a string literal that is a class-string
- New regression tests in tests/PHPStan/Rules/Methods/data/bug-9592.php and
  tests/PHPStan/Analyser/nsrt/bug-9592.php

Closes phpstan/phpstan#9592

Author: github-actions[bot]

src/Type/Php/MethodExistsTypeSpecifyingExtension.php

@@ -2,6 +2,8 @@
 
 namespace PHPStan\Type\Php;
 
+use PhpParser\Node\Expr;
+use PhpParser\Node\Expr\ClassConstFetch;
 use PhpParser\Node\Expr\FuncCall;
 use PhpParser\Node\Name\FullyQualified;
 use PHPStan\Analyser\Scope;
@@ -20,6 +22,7 @@
 use PHPStan\Type\ObjectWithoutClassType;
 use PHPStan\Type\UnionType;
 use function count;
+use function ltrim;
 
 #[AutowiredService]
 final class MethodExistsTypeSpecifyingExtension implements FunctionTypeSpecifyingExtension, TypeSpecifierAwareExtension
@@ -64,7 +67,7 @@ public function specifyTypes(
 		$objectType = $scope->getType($args[0]->value);
 		if ($objectType->isString()->yes()) {
 			if ($objectType->isClassString()->yes()) {
-				return $this->typeSpecifier->create(
+				$result = $this->typeSpecifier->create(
 					$args[0]->value,
 					new IntersectionType([
 						$objectType,
@@ -73,6 +76,31 @@ public function specifyTypes(
 					$context,
 					$scope,
 				);
+
+				if (!$args[0]->value instanceof ClassConstFetch) {
+					foreach ($objectType->getConstantStrings() as $constantString) {
+						$className = ltrim($constantString->getValue(), '\\');
+						if ($className === '') {
+							continue;
+						}
+						$classConstFetch = new Expr\ClassConstFetch(
+							new FullyQualified($className),
+							'class',
+						);
+						$classConstFetchType = $scope->getType($classConstFetch);
+						$result = $result->unionWith($this->typeSpecifier->create(
+							$classConstFetch,
+							new IntersectionType([
+								$classConstFetchType,
+								new HasMethodType($methodNameType->getValue()),
+							]),
+							$context,
+							$scope,
+						));
+					}
+				}
+
+				return $result;
 			}
 
 			return new SpecifiedTypes([], []);

tests/PHPStan/Analyser/nsrt/bug-9592.php

@@ -0,0 +1,19 @@
+<?php declare(strict_types = 1);
+
+namespace Bug9592Nsrt;
+
+use function PHPStan\Testing\assertType;
+
+class rex_response {}
+
+class HelloWorld
+{
+	public function sayHello(): void
+	{
+		if (!method_exists('Bug9592Nsrt\rex_response', 'getNonce')) {
+			return;
+		}
+		// The ClassConstFetch expression gets narrowed via the fix
+		assertType("'Bug9592Nsrt\\\\rex_response'&hasMethod(getNonce)", rex_response::class);
+	}
+}

tests/PHPStan/Rules/Methods/CallStaticMethodsRuleTest.php

@@ -600,6 +600,13 @@ public function testHasMethodStaticCall(): void
 		]);
 	}
 
+	public function testBug9592(): void
+	{
+		$this->checkThisOnly = false;
+		$this->checkExplicitMixed = false;
+		$this->analyse([__DIR__ . '/data/bug-9592.php'], []);
+	}
+
 	public function testBug1267(): void
 	{
 		$this->checkThisOnly = false;

tests/PHPStan/Rules/Methods/data/bug-9592.php

@@ -0,0 +1,30 @@
+<?php declare(strict_types = 1);
+
+namespace Bug9592;
+
+class rex_response {}
+
+class HelloWorld
+{
+	public function sayHello(): void
+	{
+		// method_exists with string literal, then static call
+		$nonce = method_exists('Bug9592\rex_response', 'getNonce') ? rex_response::getNonce() : '';
+	}
+
+	public function sayHello2(): void
+	{
+		if (!method_exists('Bug9592\rex_response', 'getNonce')) {
+			return;
+		}
+
+		rex_response::getNonce();
+	}
+
+	public function sayHello3(): void
+	{
+		if (method_exists('Bug9592\rex_response', 'getNonce')) {
+			rex_response::getNonce();
+		}
+	}
+}