ClassStatementsGatherer blindly collects all 2-element arrays into methodCalls, causing UnusedPrivateMethodRule to evaluate isCallable() and trigger class reflection for data arrays

[alfredbez]

Fixes phpstan/phpstan#15494

In ClassStatementsGatherer, any 2-element array is unconditionally added to ->methodCalls. When a class defines at least one unused private method, UnusedPrivateMethodRule evaluates ->isCallable() on every gathered array in the class. For 2-element data arrays whose first element names a class, ConstantArrayType::isCallable() triggers reflection on that class, even though private methods of the current class can only be called on ``, self, `static`, or the declaring class name.

Reproducer

See phpstan/phpstan#15494

class BigContainer
{
}

class Service
{
    private function unusedMethod(): void
    {
    }

    public function process(string ): bool
    {
         = ['BigContainer', 'packstation'];
        return in_array(, , true);
    }
}

Expected Behavior

Two-element arrays whose first item is not ``, self::class, `static::class`, `ClassName::class` (matching the current class), or `::class` should not be gathered into `ClassStatementsGatherer::`. This avoids reflecting unrelated classes as callable targets during unused private method analysis.

[staabm]

Please report a issue with a reproducer showcasing the problem you are trying to fix.

[alfredbez]

Reported with reproducer as requested: phpstan/phpstan#15494. Thank you!

[staabm]

doesn't work for

$a = [$this, rand(0, 1) ? 'method' : 'someOther'];

or

$m = rand(0, 1) ? 'method' : 'someOther';
$a = [$this, $m];

[staabm]

methodCalls is passed into ClassMethodsNode which is @api .. so there might be some rules or extensions which need methodCalls for non private methods.

just because phpstan-src itself is fine just with the private-method-calls, this might not apply in general.