Fix signature type for default-null parameters

src/Reflection/SignatureMap/Php8SignatureMapProvider.php

@@ -3,6 +3,7 @@
 namespace PHPStan\Reflection\SignatureMap;
 
 use PhpParser\Node\AttributeGroup;
+use PhpParser\Node\Expr\ConstFetch;
 use PhpParser\Node\Expr\Variable;
 use PhpParser\Node\Scalar\String_;
 use PhpParser\Node\Stmt\ClassConst;
@@ -22,6 +23,7 @@
 use PHPStan\Type\MixedType;
 use PHPStan\Type\ParserNodeTypeToPHPStanType;
 use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
 use PHPStan\Type\TypehintHelper;
 use ReflectionFunctionAbstract;
 use function array_key_exists;
@@ -409,10 +411,23 @@ private function getSignature(
 				throw new ShouldNotHappenException();
 			}
 			$parameterType = ParserNodeTypeToPHPStanType::resolve($param->type, $classReflection);
+			$phpDocParameterType = $phpDocParameterTypes[$name->name] ?? null;
+
+			if ($param->default instanceof ConstFetch) {
+				$constName = (string) $param->default->name;
+				$loweredConstName = strtolower($constName);
+				if ($loweredConstName === 'null') {
+					$parameterType = TypeCombinator::addNull($parameterType);
+					if ($phpDocParameterType !== null) {
+						$phpDocParameterType = TypeCombinator::addNull($phpDocParameterType);
+					}
+				}
+			}
+
 			$parameters[] = new ParameterSignature(
 				$name->name,
 				$param->default !== null || $param->variadic,
-				TypehintHelper::decideType($parameterType, $phpDocParameterTypes[$name->name] ?? null),
+				TypehintHelper::decideType($parameterType, $phpDocParameterType),
 				$parameterType,
 				$param->byRef ? PassedByReference::createCreatesNewVariable() : PassedByReference::createNo(),
 				$param->variadic,

tests/PHPStan/Rules/Functions/CallToFunctionParametersRuleTest.php

@@ -2047,4 +2047,10 @@ public function testBug12499(): void
 		$this->analyse([__DIR__ . '/data/bug-12499.php'], []);
 	}
 
+	public function testBug7522(): void
+	{
+		$this->checkExplicitMixed = true;
+		$this->analyse([__DIR__ . '/data/bug-7522.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Functions/data/bug-7522.php

@@ -0,0 +1,8 @@
+<?php declare(strict_types=1);
+
+namespace Bug7522;
+
+function doFoo() {
+	// Example #2 from https://www.php.net/manual/en/function.ob-start.php
+	\ob_start(null, 0, PHP_OUTPUT_HANDLER_STDFLAGS ^ PHP_OUTPUT_HANDLER_REMOVABLE);
+}