Fix false positive "Empty array passed to foreach" in closure with object use

- Don't carry forward property fetch expression types for dynamic (undeclared) properties on objects captured by value in closures
- Objects are references in PHP, so their properties can change between closure definition and invocation
- Only affects dynamic properties (e.g. stdClass); declared/native properties still carry forward type narrowings
- New regression test in tests/PHPStan/Rules/Arrays/data/bug-10345.php

Closes phpstan/phpstan#10345

Author: github-actions[bot]

src/Analyser/MutatingScope.php

@@ -2152,6 +2152,10 @@ public function enterAnonymousFunctionWithoutReflection(
 				}
 			}
 
+			if ($this->shouldNotCarryForwardPropertyFetchInClosure($expr)) {
+				continue;
+			}
+
 			$expressionTypes[$exprString] = $typeHolder;
 		}
 
@@ -2218,6 +2222,28 @@ public function enterAnonymousFunctionWithoutReflection(
 		);
 	}
 
+	private function shouldNotCarryForwardPropertyFetchInClosure(Expr $expr): bool
+	{
+		if (!$expr instanceof PropertyFetch) {
+			return false;
+		}
+
+		if (!$expr->name instanceof Identifier) {
+			return false;
+		}
+
+		$objectType = $this->getType($expr->var);
+		$propertyName = $expr->name->name;
+
+		foreach ($objectType->getObjectClassReflections() as $classReflection) {
+			if ($classReflection->hasNativeProperty($propertyName)) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
 	private function expressionTypeIsUnchangeable(ExpressionTypeHolder $typeHolder): bool
 	{
 		$expr = $typeHolder->getExpr();

tests/PHPStan/Rules/Arrays/DeadForeachRuleTest.php

@@ -55,4 +55,9 @@ public function testBug2457(): void
 		$this->analyse([__DIR__ . '/data/bug-2457.php'], []);
 	}
 
+	public function testBug10345(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-10345.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-10345.php

@@ -0,0 +1,15 @@
+<?php declare(strict_types = 1);
+
+namespace Bug10345;
+
+$container = new \stdClass();
+$container->items = [];
+
+$func = function() use ($container): int {
+	foreach ($container->items as $item) {}
+	return 1;
+};
+
+$container->items[] = '1';
+
+$a = $func();