Fix phpstan/phpstan#10172: foreach over array dim fetch losing template type

- Skip HasOffsetValueType propagation to parent variable in specifyExpressionType when the variable has a template type
- The root cause was that foreach's empty/non-empty scope split narrowed the parent variable through ArrayDimFetch, destroying the template identity
- New regression test in tests/PHPStan/Analyser/nsrt/bug-10172.php

Author: github-actions[bot]

src/Analyser/MutatingScope.php

@@ -78,6 +78,7 @@
 use PHPStan\Type\ErrorType;
 use PHPStan\Type\ExpressionTypeResolverExtensionRegistry;
 use PHPStan\Type\GeneralizePrecision;
+use PHPStan\Type\Generic\TemplateType;
 use PHPStan\Type\Generic\TemplateTypeHelper;
 use PHPStan\Type\Generic\TemplateTypeMap;
 use PHPStan\Type\IntegerRangeType;
@@ -2731,7 +2732,7 @@ public function specifyExpressionType(Expr $expr, Type $type, Type $nativeType,
 			if ($dimType->isInteger()->yes() || $dimType->isString()->yes()) {
 				$exprVarType = $scope->getType($expr->var);
 				$isArray = $exprVarType->isArray();
-				if (!$exprVarType instanceof MixedType && !$isArray->no()) {
+				if (!$exprVarType instanceof MixedType && !$isArray->no() && !$exprVarType instanceof TemplateType) {
 					$tooManyHasOffsetValueTypes = false;
 
 					$varType = $exprVarType;

tests/PHPStan/Analyser/nsrt/bug-10172.php

@@ -0,0 +1,27 @@
+<?php declare(strict_types = 1);
+
+namespace Bug10172;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/**
+	 * @template T of array{data: array<mixed>}
+	 *
+	 * @param T $a
+	 *
+	 * @return T
+	 */
+	public function foo(array $a): array
+	{
+		assertType('T of array{data: array<mixed>} (method Bug10172\HelloWorld::foo(), argument)', $a);
+
+		foreach ($a['data'] as $i) {
+		}
+
+		assertType('T of array{data: array<mixed>} (method Bug10172\HelloWorld::foo(), argument)', $a);
+
+		return $a;
+	}
+}