Fix phpstan/phpstan#14063: Readonly property modification through clone() is not reported outside allowed scope

[phpstan-bot]

Summary

When using clone($obj, ['value' => 'newVal']) on a readonly class from outside the declaring class scope, PHPStan was not reporting an error even though PHP 8.5 throws a fatal error at runtime: "Cannot modify protected(set) readonly property".

Changes

• Added regression test data file tests/PHPStan/Rules/Properties/data/bug-14063.php with readonly class scenarios for clone-with
• Added testBug14063() to AccessPropertiesInAssignRuleTest.php verifying the "Assign to protected(set) property" error is reported when modifying readonly class properties via clone() from outside the declaring class
• Added testBug14063() to ReadOnlyPropertyAssignRuleTest.php verifying no duplicate errors from the readonly property assign rule

Root cause

The bug was in BetterReflection (updated from 6.65 to 6.70 in commit b4c5164). BetterReflection's computeModifiers() method in ReflectionProperty had logic to set the IS_PROTECTED_SET_COMPATIBILITY flag for public readonly properties (making them behave as protected(set) for write visibility checks). However, the check only considered the IS_READONLY_COMPATIBILITY modifier on the property itself, not the getDeclaringClass()->isReadOnly() case. This meant properties in a readonly class that don't have explicit readonly on the property (e.g., constructor-promoted properties like public string $value in a readonly class) were not treated as protected(set), causing AccessPropertiesCheck::canWriteProperty() to incorrectly return true from outside the class scope.

BetterReflection 6.70 added the $this->getDeclaringClass()->isReadOnly() check, which correctly handles readonly class properties.

Test

The regression test covers:

• final readonly class with constructor-promoted property — clone from global scope (should error)
• readonly class with constructor-promoted property — clone from function scope (should error)
• Clone from within the declaring class (should be allowed)
• Clone from a child class (should be allowed for protected(set))

Fixes phpstan/phpstan#14063

[VincentLanglet]

Remove test from ReadOnlyPropertyAssignRuleTest.php‎

[phpstan-bot]

Done. Removed the testBug14063() method from ReadOnlyPropertyAssignRuleTest.php as requested by the reviewer. The test was asserting zero errors, which adds no value since that rule isn't expected to handle this case. Tests and static analysis both pass.

[VincentLanglet]

Non-readonly class Bug14063\Child cannot extend readonly class Bug14063\Base

[phpstan-bot]

Tests background task also completed successfully (11780 tests passing). Both checks confirmed — the fix has been committed and pushed.