Treat decimal-int-string as a numeric string in looseCompare() instead of assuming inequality with non-decimal strings

[phpstan-bot]

Summary

PHPStan reported Loose comparison using == between decimal-int-string and non-decimal-int-string will always evaluate to false (and inferred the result type false) for comparisons that are actually true at runtime. Because PHP compares numeric strings numerically, '2' == '02' and '2' == '2.0' are both true. The fix teaches AccessoryDecimalIntegerStringType::looseCompare() to behave like a numeric string.

Changes

• src/Type/Accessory/AccessoryDecimalIntegerStringType.php: rewrote looseCompare().
  • Non-inverse (decimal-int-string): a decimal-int-string is a numeric, non-empty string, so it mirrors AccessoryNumericStringType::looseCompare() — false only against null or a definitely non-numeric string, otherwise bool.
  • Inverse (non-decimal-int-string): always returns bool, since the value may be numeric ("02", "2.0", "1e1") or empty ("") and therefore can be loosely equal to a decimal-int-string, another numeric value, or null.
• tests/PHPStan/Analyser/nsrt/bug-14793.php: new regression test.

Root cause

The old implementation assumed a decimal-int-string can never be loosely equal to a string that is not a decimal-int-string. That ignores PHP's numeric-string juggling: a non-decimal string such as "02", "2.0" or "1e1" is still numeric and compares numerically. The same flawed assumption applied symmetrically to the inverse non-decimal-int-string type, and the unconditional null short-circuit was wrong for the inverse type because "" is a valid non-decimal-int-string and '' == null is true.

I probed the parallel accessory string types on the same axis (loose comparison of refined string types): AccessoryNumericStringType, AccessoryNonEmptyStringType, and AccessoryLowercaseStringType/AccessoryUppercaseStringType already handle the numeric-string case correctly (the lowercase/uppercase variants explicitly fall back to bool when either side may be numeric), so no analogous fix was required there.

Test

tests/PHPStan/Analyser/nsrt/bug-14793.php asserts:

• decimal-int-string == non-decimal-int-string (both directions), == numeric-string, == '2.0', == '02' infer bool (previously false).
• decimal-int-string == 'foo' and == null still infer false (correct: non-numeric string / non-empty string vs null).
• non-decimal-int-string == null infers bool (previously false), because '' == null is true.

Verified the test fails on the unpatched source (Expected: bool, Actual: false) and passes with the fix.

Fixes phpstan/phpstan#14793