Fix phpstan/phpstan#14319: Prevent exponential type growth in array dim fetch narrowing

- Added ARRAY_DIM_FETCH_UNION_TYPE_LIMIT (8) to MutatingScope to cap parent type narrowing
- When array dim fetch narrows a parent variable type that is already a UnionType with
  more than 8 members, skip propagating HasOffsetValueType intersections to the parent
- This prevents 2^N exponential growth when N consecutive if-blocks check different array
  offsets on an array|object typed variable
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14319.php
- New benchmark test in tests/bench/data/bug-14319.php

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -139,6 +139,8 @@ class MutatingScope implements Scope, NodeCallbackInvoker
 	public const KEEP_VOID_ATTRIBUTE_NAME = 'keepVoid';
 	private const CONTAINS_SUPER_GLOBAL_ATTRIBUTE_NAME = 'containsSuperGlobal';
 
+	private const ARRAY_DIM_FETCH_UNION_TYPE_LIMIT = 8;
+
 	/** @var Type[] */
 	private array $resolvedTypes = [];
 
@@ -2690,27 +2692,30 @@ public function specifyExpressionType(Expr $expr, Type $type, Type $nativeType,
 				$isArray = $exprVarType->isArray();
 				if (!$exprVarType instanceof MixedType && !$isArray->no()) {
 					$varType = $exprVarType;
-					if (!$isArray->yes()) {
+					$tooComplex = $exprVarType instanceof UnionType && count($exprVarType->getTypes()) > self::ARRAY_DIM_FETCH_UNION_TYPE_LIMIT;
+					if (!$tooComplex && !$isArray->yes()) {
 						if ($dimType->isInteger()->yes()) {
 							$varType = TypeCombinator::intersect($exprVarType, StaticTypeFactory::intOffsetAccessibleType());
 						} else {
 							$varType = TypeCombinator::intersect($exprVarType, StaticTypeFactory::generalOffsetAccessibleType());
 						}
 					}
 
-					if ($dimType instanceof ConstantIntegerType || $dimType instanceof ConstantStringType) {
+					if (!$tooComplex && ($dimType instanceof ConstantIntegerType || $dimType instanceof ConstantStringType)) {
 						$varType = TypeCombinator::intersect(
 							$varType,
 							new HasOffsetValueType($dimType, $type),
 						);
 					}
 
-					$scope = $scope->specifyExpressionType(
-						$expr->var,
-						$varType,
-						$scope->getNativeType($expr->var),
-						$certainty,
-					);
+					if (!$tooComplex) {
+						$scope = $scope->specifyExpressionType(
+							$expr->var,
+							$varType,
+							$scope->getNativeType($expr->var),
+							$certainty,
+						);
+					}
 				}
 			}
 		}

tests/PHPStan/Analyser/nsrt/bug-14319.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Bug14319;
+
+use function PHPStan\Testing\assertType;
+
+function foo(string $a, int $b): array|object
+{
+	return $a;
+}
+
+
+final class test
+{
+	protected function edit(int|string|null $IdNum = null): void
+	{
+		$rows = foo("SELECT *", $IdNum);
+		assertType('array|object', $rows);
+
+		if ($_POST['edycja'] === 'edycja' ) {
+			$raport = '';
+			if ($rows['rap_tr']) {
+				$raport .= 'T: '.$rows['rap_tr'].", \n";
+			}
+			assertType('string', $raport);
+			if ($rows['rap_ks']) {
+				$raport .= 'K: '.$rows['rap_ks'].", \n";
+			}
+			if ($rows['rap_br']) {
+				$raport .= 'B: '.$rows['rap_br'].", \n";
+			}
+			if ($rows['rap_cz']) {
+				$raport .= 'C: '.$rows['rap_cz'].", \n";
+			}
+			if ($rows['rap_fil']) {
+				$raport .= 'Fil: '.$rows['rap_fil'].", \n";
+			}
+			if ($rows['rap_roz']) {
+				$raport .= 'Roz: '.$rows['rap_roz'].", \n";
+			}
+			assertType('string', $raport);
+		}
+	}
+}

tests/bench/data/bug-14319.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace BenchBug14319;
+
+function foo(string $a, int $b): array|object
+{
+	return $a;
+}
+
+
+final class test
+{
+	protected function edit(int|string|null $IdNum = null): void
+	{
+		$rows = foo("SELECT *", $IdNum);
+
+		if ($_POST['edycja'] === 'edycja' ) {
+			$raport = '';
+			if ($rows['rap_tr']) {
+				$raport .= 'T: '.$rows['rap_tr'].", \n";
+			}
+			if ($rows['rap_ks']) {
+				$raport .= 'K: '.$rows['rap_ks'].", \n";
+			}
+			if ($rows['rap_br']) {
+				$raport .= 'B: '.$rows['rap_br'].", \n";
+			}
+			if ($rows['rap_cz']) {
+				$raport .= 'C: '.$rows['rap_cz'].", \n";
+			}
+			if ($rows['rap_fil']) {
+				$raport .= 'Fil: '.$rows['rap_fil'].", \n";
+			}
+			if ($rows['rap_roz']) {
+				$raport .= 'Roz: '.$rows['rap_roz'].", \n";
+			}
+		}
+	}
+}