Report only the function's own flags for a parameter without an allowed constant list

The fallback branch rejected every builtin constant passed to a parameter whose
type matched the type of some mapped parameter of the same function. For
str_pad() that made $length, an unmapped int, reject any int constant, so
str_pad('bla', PHP_INT_SIZE, 'bla') was reported even though it is a valid
length. The branch now reports a constant only when some other parameter of the
function allows it, which is the misplaced-flag case it exists for.

Closes phpstan/phpstan#15308

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011M5uTyCU4WcNTsPvGrErDo

Author: dylanpulver

src/Rules/FunctionCallParametersCheck.php

@@ -110,12 +110,14 @@ public function check(
 		$functionParametersMinCount = 0;
 		$functionParametersMaxCount = 0;
 		$allowedConstantsTypes = [];
+		$parametersWithAllowedConstants = [];
 		foreach ($parametersAcceptor->getParameters() as $parameter) {
 			if (
 				$parameter instanceof ExtendedParameterReflection
 				&& $parameter->getAllowedConstants() !== null
 			) {
 				$allowedConstantsTypes[] = $parameter->getType();
+				$parametersWithAllowedConstants[] = $parameter;
 			}
 			if (!$parameter->isOptional()) {
 				$functionParametersMinCount++;
@@ -491,6 +493,13 @@ public function check(
 								if ($constantReflection->isBuiltin()->no()) {
 									continue;
 								}
+								// This parameter has no constant list of its own, so the only mistake
+								// to report is one of the function's own flags in the wrong position.
+								// Any other builtin constant is a plain value there: PHP_INT_SIZE is
+								// a valid str_pad() length.
+								if (!$this->isAllowedByAnotherParameter($constantReflection, $parametersWithAllowedConstants)) {
+									continue;
+								}
 								$errors[] = RuleErrorBuilder::message(sprintf(
 									$invalidConstantMessage,
 									$constantReflection->describe(),
@@ -808,6 +817,23 @@ private function describeParameter(ParameterReflection $parameter, int|string|nu
 		return implode(' ', $parts);
 	}
 
+	/**
+	 * Whether the constant belongs to the allowed list of some other parameter of the same
+	 * function, which makes it a flag passed in the wrong position rather than a value.
+	 *
+	 * @param list<ExtendedParameterReflection> $parameters Parameters that have an allowed list
+	 */
+	private function isAllowedByAnotherParameter(ConstantReflection $constantReflection, array $parameters): bool
+	{
+		foreach ($parameters as $parameter) {
+			if ($parameter->checkAllowedConstants([$constantReflection])->getDisallowedConstants() === []) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * @return list<ConstantReflection>|null Null when the expression is not a constant or bitmask of constants
 	 */

tests/PHPStan/Rules/Functions/CallToFunctionParametersRuleTest.php

@@ -2875,6 +2875,17 @@ public function testBug14312b(): void
 		$this->analyse([__DIR__ . '/data/bug-14312b.php'], []);
 	}
 
+	#[RequiresPhp('>= 8.0.0')]
+	public function testBug15308(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-15308.php'], [
+			[
+				'Constant STR_PAD_LEFT is not allowed for parameter #2 $length of function str_pad.',
+				10,
+			],
+		]);
+	}
+
 	#[RequiresPhp('>= 8.0.0')]
 	public function testConstantParameterCheck(): void
 	{

tests/PHPStan/Rules/Functions/data/bug-15308.php

@@ -0,0 +1,10 @@
+<?php // lint >= 8.0
+
+namespace Bug15308;
+
+// $length has no constant list of its own, so a numeric constant is a valid length.
+str_pad('bla', PHP_INT_SIZE, 'bla');
+str_pad('bla', SODIUM_CRYPTO_PWHASH_SALTBYTES, 'bla');
+
+// One of str_pad()'s own flags in the $length position is still reported.
+str_pad('bla', STR_PAD_LEFT, 'bla');