SuppressWarnings(CyclomaticComplexity, NPathComplexity) fails in function with internal docblock

[SilkAndSlug]

• PHPMD version: 2.10.2
• PHP Version: 7.4.24
• Installation type: composer
• Operating System / Distribution & Version: Debian 11

Current Behavior

Adding a docblock (e.g. a @todo) inside the function prevents warnings from being suppressed.

doesNothing.php:6    The function doesNothing() has a Cyclomatic Complexity of 13. The configured cyclomatic complexity threshold is 10.
doesNothing.php:6    The function doesNothing() has an NPath complexity of 256. The configured NPath complexity threshold is 200.

Expected Behavior

Warnings should be suppressed, even with a docblock present.

[No output]

Steps To Reproduce:

doesNothing.php :

<?php
/**
 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
 * @SuppressWarnings(PHPMD.NPathComplexity)
 */
function doesNothing() {
	if (true AND true AND false) return;
	/** This comment breaks SuppressWarnings */
	if (true AND true AND false) return;
	if (true AND true AND false) return;
	if (true AND true AND false) return;
}

From the command-line: phpmd doesNothing.php text codesize

Note that the bug doesn't occur if the @todo is on the first line.

[vertexvaar]

Annotations of functions inside conditions are also ignored.

if (!function_exists('doesNothing')) {
    /**
     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
     * @SuppressWarnings(PHPMD.NPathComplexity)
     */
    function doesNothing() {
        if (true AND true AND false) return;
        if (true AND true AND false) return;
        if (true AND true AND false) return;
        if (true AND true AND false) return;
    }
}

 390 | VIOLATION | The function doesNothing() has a Cyclomatic Complexity of 13. The configured cyclomatic complexity threshold is 10.
 390 | VIOLATION | The function doesNothing() has an NPath complexity of 256. The configured NPath complexity threshold is 200.

[vever001]

I'm seeing the same issue.
It looks like it is coming from pdepend, specifically \PDepend\Source\Language\PHP\AbstractPHPParser::parseFunctionOrClosureDeclaration
The comment for the ASTFunction is the wrong one (it is set to the last one inside the function and not the doc block of the function). Then of course it fails in phpmd when it checks if the comment contains the SuppressWarning.

One workaround seems to be to put those internal docblocks at the top of the function.

[kylekatarnls]

Good catch! I was able to confirm with a unit test:
pdepend/pdepend#687

[kylekatarnls]

Fix found and tested, it should be in the next PDepend release.

[vever001]

Amazing, thanks @kylekatarnls

[kylekatarnls]

2.16.0 should soon be released.

BTW you can already test it using:

composer require "pdepend/pdepend:dev-master as 2.16.0"