Extract Type::toObjectTypeForInstanceofCheck() for instanceof RHS

Replaces the duplicate `TypeTraverser::map` callback in
`TypeSpecifier::specifyTypesInCondition()` (the
`instanceof <expr>` branch) and the `InstanceOfClassTypeTraverser`
helper used by `InstanceofHandler` with one polymorphic `Type`
method. Both sites needed an out-of-band by-ref `$uncertainty` flag
to carry "we kept this symbolically, don't decide yes/no
definitively"; the new method returns a small `ClassNameToObjectTypeResult`
value object (`Type $type, bool $uncertainty`) so each leaf can carry
its own answer through composite-type distribution.

Per leaf:

- `ObjectType` and `ObjectTypeTrait` users (and `ClosureType`,
  `NonexistentParentClassType`, `StaticType`): keep `$this` as the
  comparison target and mark uncertain — the runtime class is only
  known when `instanceof` actually executes.
- `GenericClassStringType`: project to `getGenericType()` and mark
  uncertain (the class name is symbolic).
- `ConstantStringType`: collapse to `new ObjectType($value)` with no
  uncertainty (the class name is concrete).
- All other non-objects (via `NonObjectTypeTrait`,
  `MaybeObjectTypeTrait`): `MixedType`, no uncertainty (matches the
  original `return new MixedType()` fallback).
- `MixedType` / `StrictMixedType`: same `MixedType` fallback.
- `NeverType`: pass through.
- `UnionType`/`IntersectionType`: distribute, OR-folding the
  uncertainty across members (matches the original closure-captured
  behavior).
- `LateResolvableTypeTrait`: delegate to `resolve()`.

`InstanceOfClassTypeTraverser` is removed (no longer used).

Pure refactor: full test suite + phpstan + cs pass.

Author: ondrejmirtes

src/Analyser/ExprHandler/InstanceofHandler.php

@@ -12,7 +12,6 @@
 use PHPStan\Analyser\ExprHandler;
 use PHPStan\Analyser\MutatingScope;
 use PHPStan\Analyser\NodeScopeResolver;
-use PHPStan\Analyser\Traverser\InstanceOfClassTypeTraverser;
 use PHPStan\DependencyInjection\AutowiredService;
 use PHPStan\Type\BooleanType;
 use PHPStan\Type\Constant\ConstantBooleanType;
@@ -21,7 +20,6 @@
 use PHPStan\Type\ObjectType;
 use PHPStan\Type\StaticType;
 use PHPStan\Type\Type;
-use PHPStan\Type\TypeTraverser;
 use PHPStan\Type\TypeUtils;
 use function array_merge;
 use function strtolower;
@@ -94,9 +92,9 @@ public function resolveType(MutatingScope $scope, Expr $expr): Type
 			}
 		} else {
 			$classType = $scope->getType($expr->class);
-			$traverser = new InstanceOfClassTypeTraverser();
-			$classType = TypeTraverser::map($classType, $traverser);
-			$uncertainty = $traverser->getUncertainty();
+			$result = $classType->toObjectTypeForInstanceofCheck();
+			$classType = $result->type;
+			$uncertainty = $result->uncertainty;
 		}
 
 		if ($classType->isSuperTypeOf(new MixedType())->yes()) {

src/Analyser/Traverser/InstanceOfClassTypeTraverser.php

@@ -165,24 +165,9 @@ public function specifyTypesInCondition(
 			}
 
 			$classType = $scope->getType($expr->class);
-			$uncertainty = false;
-			$type = TypeTraverser::map($classType, static function (Type $type, callable $traverse) use (&$uncertainty): Type {
-				if ($type instanceof UnionType || $type instanceof IntersectionType) {
-					return $traverse($type);
-				}
-				if ($type->getObjectClassNames() !== []) {
-					$uncertainty = true;
-					return $type;
-				}
-				if ($type instanceof GenericClassStringType) {
-					$uncertainty = true;
-					return $type->getGenericType();
-				}
-				if ($type instanceof ConstantStringType) {
-					return new ObjectType($type->getValue());
-				}
-				return new MixedType();
-			});
+			$result = $classType->toObjectTypeForInstanceofCheck();
+			$type = $result->type;
+			$uncertainty = $result->uncertainty;
 
 			if (!$type->isSuperTypeOf(new MixedType())->yes()) {
 				if ($context->true()) {

src/Analyser/TypeSpecifier.php

@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Type;
+
+/**
+ * Result of projecting a "class-name-or-object" `Type` to its corresponding
+ * `ObjectType` for an `instanceof` / `is_a` check.
+ *
+ * `$uncertainty` is `true` when the projection lost information that prevents
+ * a definite yes/no decision later — e.g. a runtime class string was kept
+ * symbolically instead of being resolved to a concrete object type. Composite
+ * types OR-fold the flag across their members.
+ */
+final class ClassNameToObjectTypeResult
+{
+
+	public function __construct(
+		public readonly Type $type,
+		public readonly bool $uncertainty,
+	)
+	{
+	}
+
+}

src/Type/ClassNameToObjectTypeResult.php

@@ -526,6 +526,11 @@ public function toClassConstantType(ReflectionProvider $reflectionProvider): Typ
 		return $this->objectType->toClassConstantType($reflectionProvider);
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		return new ClassNameToObjectTypeResult($this, true);
+	}
+
 	public function toAbsoluteNumber(): Type
 	{
 		return new ErrorType();

src/Type/ClosureType.php

@@ -25,6 +25,7 @@
 use PHPStan\Type\Accessory\AccessoryNonFalsyStringType;
 use PHPStan\Type\Accessory\AccessoryNumericStringType;
 use PHPStan\Type\Accessory\AccessoryUppercaseStringType;
+use PHPStan\Type\ClassNameToObjectTypeResult;
 use PHPStan\Type\ClassStringType;
 use PHPStan\Type\CompoundType;
 use PHPStan\Type\ConstantScalarType;
@@ -293,6 +294,11 @@ public function toBitwiseNotType(): Type
 		return new ConstantStringType(~$this->value);
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		return new ClassNameToObjectTypeResult(new ObjectType($this->value), false);
+	}
+
 	public function toAbsoluteNumber(): Type
 	{
 		return $this->toNumber()->toAbsoluteNumber();

src/Type/Constant/ConstantStringType.php

@@ -7,6 +7,7 @@
 use PHPStan\PhpDocParser\Ast\Type\TypeNode;
 use PHPStan\Reflection\ReflectionProviderStaticAccessor;
 use PHPStan\Type\AcceptsResult;
+use PHPStan\Type\ClassNameToObjectTypeResult;
 use PHPStan\Type\ClassStringType;
 use PHPStan\Type\CompoundType;
 use PHPStan\Type\Constant\ConstantStringType;
@@ -45,6 +46,15 @@ public function getGenericType(): Type
 		return $this->type;
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		// `class-string<X>` narrows to `X` for the comparison target, but
+		// the actual runtime class can be any subclass of `X` — keep
+		// uncertainty so the caller falls back to `BooleanType` instead
+		// of a definite yes when `$x instanceof Y` and `Y === X`.
+		return new ClassNameToObjectTypeResult($this->getGenericType(), true);
+	}
+
 	public function getClassStringObjectType(): Type
 	{
 		return $this->getGenericType();

src/Type/Generic/GenericClassStringType.php

@@ -1427,6 +1427,23 @@ public function toClassConstantType(ReflectionProvider $reflectionProvider): Typ
 		return $this->intersectTypes(static fn (Type $type): Type => $type->toClassConstantType($reflectionProvider));
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		$types = [];
+		$uncertainty = false;
+		foreach ($this->getTypes() as $innerType) {
+			$result = $innerType->toObjectTypeForInstanceofCheck();
+			$types[] = $result->type;
+			if (!$result->uncertainty) {
+				continue;
+			}
+
+			$uncertainty = true;
+		}
+
+		return new ClassNameToObjectTypeResult(TypeCombinator::intersect(...$types), $uncertainty);
+	}
+
 	public function toAbsoluteNumber(): Type
 	{
 		$type = $this->intersectTypes(static fn (Type $type): Type => $type->toAbsoluteNumber());

src/Type/IntersectionType.php

@@ -642,6 +642,11 @@ public function toClassConstantType(ReflectionProvider $reflectionProvider): Typ
 		return new ErrorType();
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		return new ClassNameToObjectTypeResult(new MixedType(), false);
+	}
+
 	public function toAbsoluteNumber(): Type
 	{
 		return $this->toNumber()->toAbsoluteNumber();

src/Type/MixedType.php

@@ -450,6 +450,11 @@ public function toClassConstantType(ReflectionProvider $reflectionProvider): Typ
 		return $this;
 	}
 
+	public function toObjectTypeForInstanceofCheck(): ClassNameToObjectTypeResult
+	{
+		return new ClassNameToObjectTypeResult($this, false);
+	}
+
 	public function toAbsoluteNumber(): Type
 	{
 		return $this;