[DeadCode] Skip private method removal in classes using reflection

Classes that instantiate a *Reflection* object can use private methods
dynamically (by name, or by reading their own source/body), which static
analysis cannot detect. Real-world false positive: spiral/framework
ReflectionFileTest::deadend(), kept via withSkip(). Keep all private
methods in such classes to stay on the safe side.

Author: TomasVotruba

rules-tests/DeadCode/Rector/ClassMethod/RemoveUnusedPrivateMethodRector/Fixture/keep_used_via_self_reflection.php.inc

@@ -0,0 +1,26 @@
+<?php
+
+namespace Rector\Tests\DeadCode\Rector\ClassMethod\RemoveUnusedPrivateMethodRector\Fixture;
+
+// real-world false positive (spiral/framework ReflectionFileTest::deadend):
+// the method body is read back via reflection over the current file and its
+// function invocations are asserted, so it is used only at runtime - invisible
+// to static analysis. The class instantiates a *Reflection* object, so the rule
+// keeps all private methods to stay on the safe side.
+final class KeepUsedViaSelfReflection
+{
+    public function testInvocations(): void
+    {
+        $reflection = new \ReflectionClass(self::class);
+        foreach ($reflection->getMethods() as $method) {
+            // inspect own methods dynamically
+        }
+    }
+
+    private function deadend(): void
+    {
+        $a = $b = null;
+        test_function_a($this, $a + $b);
+        test_function_b("string", 123);
+    }
+}

rules-tests/DeadCode/Rector/ClassMethod/RemoveUnusedPrivateMethodRector/Fixture/used_via_self_reflection.php.inc

@@ -6,7 +6,9 @@
 
 use PhpParser\Node;
 use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Expr\New_;
 use PhpParser\Node\Expr\Variable;
+use PhpParser\Node\Name;
 use PhpParser\Node\Stmt\Class_;
 use PhpParser\Node\Stmt\ClassMethod;
 use PHPStan\Reflection\ClassReflection;
@@ -89,6 +91,12 @@ public function refactor(Node $node): ?Node
             return null;
         }
 
+        // reflection-heavy classes can use private methods dynamically (by name,
+        // or by reading their own source/body), which is invisible to static analysis
+        if ($this->usesReflection($node)) {
+            return null;
+        }
+
         $dataProviderMethodNames = $this->resolveDataProviderMethodNames($node);
 
         foreach ($node->stmts as $classStmtKey => $classStmt) {
@@ -153,6 +161,24 @@ private function shouldSkip(ClassMethod $classMethod, ClassReflection $classRefl
         return $classReflection->hasMethod(MethodName::CALL);
     }
 
+    private function usesReflection(Class_ $class): bool
+    {
+        return (bool) $this->betterNodeFinder->findFirst(
+            $class->stmts,
+            static function (Node $subNode): bool {
+                if (! $subNode instanceof New_) {
+                    return false;
+                }
+
+                if (! $subNode->class instanceof Name) {
+                    return false;
+                }
+
+                return str_contains(strtolower($subNode->class->toString()), 'reflection');
+            }
+        );
+    }
+
     private function hasDynamicMethodCallOnFetchThis(ClassMethod $classMethod): bool
     {
         return (bool) $this->betterNodeFinder->findFirst(