Fix phpstan/phpstan#8270: False positive on array item modification

[phpstan-bot]

Summary

When modifying a sub-key of an array element at a non-constant offset (e.g., $list[$k]['test'] = true), PHPStan incorrectly concluded that ALL array items had the modified value. This caused false positives like "If condition is always true" when iterating over the array and checking the modified key.

Changes

• Added shouldUnionExistingItemType() method in src/Analyser/ExprHandler/AssignHandler.php that checks whether a composed value changes existing constant-array key values
• Modified produceArrayDimFetchAssignValueToWrite() to force unionValues=true at the outermost dimension when the composed value has conflicting key values with the existing item type
• Updated test expectations in tests/PHPStan/Rules/Arrays/data/bug-11679.php and tests/PHPStan/Rules/Arrays/data/slevomat-foreach-array-key-exists-bug.php to match the more correct union behavior
• Added regression test in tests/PHPStan/Analyser/nsrt/bug-8270.php

Root cause

In produceArrayDimFetchAssignValueToWrite(), nested array dimension assignments like $list[$k]['test'] = true are processed bottom-up. The inner dimension correctly computes the modified element value (e.g., array{test: true, value: int}). However, at the outer dimension, setOffsetValueType() was called with unionValues=false, which replaced the entire item type with the composed value. Since the offset key is non-constant (could match any element), this incorrectly assumed ALL elements had the new value.

The fix detects when the composed value changes existing key values (e.g., test: false → test: true) by comparing key-by-key. When a conflict is found, it forces unionValues=true so the item type becomes the union of old and new (e.g., test: bool), correctly representing that some elements retain their original values.

The check is limited to the outermost dimension to avoid issues with deeply nested array building patterns (like bug-1388).

Test

Added tests/PHPStan/Analyser/nsrt/bug-8270.php with two test functions:

1. A simple case with a @var-annotated non-empty-list and constant offset $list[0]['test'] = true
2. A realistic case matching the original bug report: building a list in a loop, narrowing with array_key_first(), modifying one element, then iterating

Both verify that after modifying one element's sub-key, the foreach item type correctly shows bool (not true) for the modified key.

Fixes phpstan/phpstan#8270
Closes phpstan/phpstan#13623
Closes phpstan/phpstan#13857

[VincentLanglet]

Add non regression tests for the issues
phpstan/phpstan#13623
phpstan/phpstan#13857

[phpstan-bot]

Already handled — all 11604 tests passed and the commits have been pushed.

[staabm]

I don't see why we previously expected the (array|float|int) here

[phpstan-bot]

All tests pass.

Summary: The reviewer's comment on slevomat-foreach-array-key-exists-bug.php is an observation, not a change request. They're noting that the old expectation (array|float|int) was already wrong — and the new expectation mixed from our PR is correct. When itemsCount is mixed and += $itemsCount is performed, the old code (with unionValues=false) replaced ALL items' type with the arithmetic result, losing the mixed from unmodified elements. The fix correctly unions the types, preserving mixed.

No code changes are needed. I was unable to post a reply comment on the PR due to insufficient token permissions — you may want to reply directly acknowledging that the old (array|float|int) expectation was indeed incorrect and the new mixed correctly reflects that unmodified elements retain their original type.

[phpstan-bot]

The branch is clean and up to date. The review is an approval with no new changes requested — all previous feedback has been addressed. No action needed.

[phpstan-bot]

The review from VincentLanglet is an approval with no changes requested. There's nothing to address — the PR is ready to merge.

[staabm]

I cannot re-reproduce the failling phpbench error locally using hyperfine, or blackfire.

[VincentLanglet]

There is regression on shopwave code base

 ------ ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 
  Line   src/Core/Profiling/Doctrine/ConnectionProfiler.php                                                                                                                                                                                                                                                                                                                                                                                                                                                         
 ------ ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 
  156    Parameter #1 $array of function usort contains unresolvable type.                                                                                                                                                                                                                                                                                                                                                                                                                                          
         🪪  argument.unresolvableType                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
         ✏️  https://github.com/shopware/shopware/blob/061e131a2dffff2207bcc4585b1b3e090205304e/src/Core/Profiling/Doctrine/ConnectionProfiler.php#L156                                                                                                                                                                                                                                                                                                                                                             
  156    Parameter #2 $callback of function usort contains unresolvable type.                                                                                                                                                                                                                                                                                                                                                                                                                                       
         🪪  argument.unresolvableType                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
         ✏️  https://github.com/shopware/shopware/blob/061e131a2dffff2207bcc4585b1b3e090205304e/src/Core/Profiling/Doctrine/ConnectionProfiler.php#L156                                                                                                                                                                                                                                                                                                                                                             
  157    Property Shopware\Core\Profiling\Doctrine\ConnectionProfiler::$groupedQueries (array<string, array<int, array{sql: string, executionMS: float, types: array<int|string, Doctrine\DBAL\ParameterType|int>, params: Symfony\Component\VarDumper\Cloner\Data, runnable: bool, explainable: bool, backtrace?: list<array{function: string, line?: int, file?: string, class?: class-string, type?: '->'|'::', args?: list<mixed>, object?: object}>, count: int, ...}>>|null) does not accept non-empty-array  
         <string, array<int, non-empty-array<'backtrace'|'count'|'executionMS'|'executionPercent'|'explainable'|'index'|'params'|'runnable'|'sql'|'types', mixed>>>.                                                                                                                                                                                                                                                                                                                                                
         🪪  assign.propertyType                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
         ✏️  https://github.com/shopware/shopware/blob/061e131a2dffff2207bcc4585b1b3e090205304e/src/Core/Profiling/Doctrine/ConnectionProfiler.php#L157                                                                                                                                                                                                                                                                                                                                                             
  168    Method Shopware\Core\Profiling\Doctrine\ConnectionProfiler::getGroupedQueries() should return array<string, array<int, array{sql: string, executionMS: float, types: array<int|string, Doctrine\DBAL\ParameterType|int>, params: Symfony\Component\VarDumper\Cloner\Data, runnable: bool, explainable: bool, backtrace?: list<array{function: string, line?: int, file?: string, class?: class-string, type?: '->'|'::', args?: list<mixed>, object?: object}>, count: int, ...}>> but returns array<stri  
         ng, list<non-empty-array<'backtrace'|'count'|'executionMS'|'executionPercent'|'explainable'|'index'|'params'|'runnable'|'sql'|'types', mixed>>>.                                                                                                                                                                                                                                                                                                                                                           
         🪪  return.type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
         ✏️  https://github.com/shopware/shopware/blob/061e131a2dffff2207bcc4585b1b3e090205304e/src/Core/Profiling/Doctrine/ConnectionProfiler.php#L168                                                                                                                                                                                                                                                                                                                                                             
 ------ ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 

Regressions

[staabm]

fix the failling test

[phpstan-bot]

The fix has been pushed. Here's a summary of the changes:

Problem: The shouldUnionExistingItemType method used a unidirectional check ($newValue->isSuperTypeOf($existingValue)) which triggered union too aggressively. Operations like += executionMS (where existing type 0|float and new type float) incorrectly triggered union because float is not a supertype of 0|float. This cascaded through loop iterations, producing degraded *ERROR* types in the shopware-connection-profiler test.

Fix: Added a bidirectional supertype check — union is only triggered when neither type is a supertype of the other (genuinely incompatible types like false → true or 'foo' → 'bar'). When one direction holds (e.g., 0|float ⊇ float), the union is skipped since the modification doesn't create a type conflict.

Test results: All 11613 tests pass, make phpstan reports no errors.