From dd3af96a94a6722f9da631a6d5fe8529a76f488c Mon Sep 17 00:00:00 2001
From: Markus Staab <m.staab@complex-it.de>
Date: Tue, 22 Feb 2022 12:31:10 +0100
Subject: [PATCH] don't crash on negative multiplier

---
 src/Type/Php/StrRepeatFunctionReturnTypeExtension.php | 5 +++++
 tests/PHPStan/Analyser/data/literal-string.php        | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/Type/Php/StrRepeatFunctionReturnTypeExtension.php b/src/Type/Php/StrRepeatFunctionReturnTypeExtension.php
index 8bb6556277f..71e2a6e479c 100644
--- a/src/Type/Php/StrRepeatFunctionReturnTypeExtension.php
+++ b/src/Type/Php/StrRepeatFunctionReturnTypeExtension.php
@@ -12,6 +12,7 @@
 use PHPStan\Type\DynamicFunctionReturnTypeExtension;
 use PHPStan\Type\IntegerRangeType;
 use PHPStan\Type\IntersectionType;
+use PHPStan\Type\NeverType;
 use PHPStan\Type\StringType;
 use PHPStan\Type\Type;
 use function count;
@@ -42,6 +43,10 @@ public function getTypeFromFunctionCall(
 			return new ConstantStringType('');
 		}
 
+		if ($multiplierType instanceof ConstantIntegerType && $multiplierType->getValue() < 0){
+			return new NeverType();
+		}
+
 		if ($inputType instanceof ConstantStringType && $multiplierType instanceof ConstantIntegerType) {
 			return new ConstantStringType(str_repeat($inputType->getValue(), $multiplierType->getValue()));
 		}
diff --git a/tests/PHPStan/Analyser/data/literal-string.php b/tests/PHPStan/Analyser/data/literal-string.php
index 4787fbd356f..c55c34feff6 100644
--- a/tests/PHPStan/Analyser/data/literal-string.php
+++ b/tests/PHPStan/Analyser/data/literal-string.php
@@ -28,6 +28,7 @@ public function doFoo($literalString, string $string)
 		assertType("''", str_repeat('', 10));
 		assertType("'foofoofoofoofoofoofoofoofoofoo'", str_repeat('foo', 10));
 		assertType("'?,?,?,'", str_repeat('?,', 3));
+		assertType("*NEVER*", str_repeat('?,', -3));
 
 		assertType('non-empty-string', str_pad($string, 5, $string));
 		assertType('non-empty-string', str_pad($literalString, 5, $string));