Track array value type overwrites in by-reference foreach on constant arrays

- Allow the post-foreach array value type rewrite to apply to constant arrays
  when the foreach is by-reference (`$stmt->byRef`), since
  `tryProcessUnrolledConstantArrayForeach` skips by-ref iteration
- Move the `isConstantArray()->yes()` check before `instanceof ArrayType` in
  the TypeTraverser callbacks, since `ConstantArrayType` implements `Type`
  directly and does not extend `ArrayType`
- Use `ConstantArrayType::traverse()` to replace value types while preserving
  the constant array structure (key types, optional keys, list status)
- For by-ref foreach with key on constant arrays, use the value variable's type
  as the dim fetch type when the value was reassigned, since the
  `IntertwinedVariableByReferenceWithExpr` mechanism is not set up for constant
  arrays

Author: VincentLanglet

src/Analyser/NodeScopeResolver.php

@@ -1352,7 +1352,7 @@ public function processStmtNode(
 				&& ($stmt->keyVar !== null || $byRefWithoutKey)
 				&& (!$hasExpr->no() || !$stmt->expr instanceof Variable)
 				&& $exprType->isArray()->yes()
-				&& $exprType->isConstantArray()->no()
+				&& ($exprType->isConstantArray()->no() || $stmt->byRef)
 			) {
 				$nativeExprType = $scope->getNativeType($stmt->expr);
 				$arrayDimFetchLoopType = $exprType->getIterableValueType();
@@ -1372,17 +1372,13 @@ public function processStmtNode(
 					$keyLoopTypes = [];
 					foreach ($scopesWithIterableValueType as $scopeWithIterableValueType) {
 						$dimFetchType = $scopeWithIterableValueType->getType($arrayExprDimFetch);
-						// Condition-based narrowings like `is_string($type)` apply to the value
-						// variable but not automatically to the array dim fetch, even though the
-						// two describe the same element for a given iteration. If the value var
-						// hasn't been reassigned (OriginalForeachValueExpr still tracked) we use
-						// the narrowed value-var type in place of the broader dim fetch type so
-						// the loop's final array rewrite below picks up the sharper element type.
 						if ($originalValueExpr !== null && $scopeWithIterableValueType->hasExpressionType($originalValueExpr)->yes()) {
 							$valueVarType = $scopeWithIterableValueType->getType($stmt->valueVar);
 							if ($dimFetchType->isSuperTypeOf($valueVarType)->yes()) {
 								$dimFetchType = $valueVarType;
 							}
+						} elseif ($stmt->byRef && $originalValueExpr !== null) {
+							$dimFetchType = $scopeWithIterableValueType->getType($stmt->valueVar);
 						}
 						$arrayDimFetchLoopTypes[] = $dimFetchType;
 						$keyLoopTypes[] = $scopeWithIterableValueType->getType($stmt->keyVar);
@@ -1400,6 +1396,8 @@ public function processStmtNode(
 							if ($dimFetchNativeType->isSuperTypeOf($valueVarNativeType)->yes()) {
 								$dimFetchNativeType = $valueVarNativeType;
 							}
+						} elseif ($stmt->byRef && $originalValueExpr !== null) {
+							$dimFetchNativeType = $scopeWithIterableValueType->getNativeType($stmt->valueVar);
 						}
 						$arrayDimFetchLoopNativeTypes[] = $dimFetchNativeType;
 						$keyLoopNativeTypes[] = $scopeWithIterableValueType->getType($stmt->keyVar);
@@ -1432,6 +1430,10 @@ public function processStmtNode(
 							return $traverse($type);
 						}
 
+						if ($type->isConstantArray()->yes() && $valueTypeChanged && !$keyTypeChanged) {
+							return $type->traverse(static fn () => $arrayDimFetchLoopType);
+						}
+
 						if (!$type instanceof ArrayType) {
 							return $type;
 						}
@@ -1446,6 +1448,10 @@ public function processStmtNode(
 							return $traverse($type);
 						}
 
+						if ($type->isConstantArray()->yes() && $valueTypeChanged && !$keyTypeChanged) {
+							return $type->traverse(static fn () => $arrayDimFetchLoopNativeType);
+						}
+
 						if (!$type instanceof ArrayType) {
 							return $type;
 						}

tests/PHPStan/Analyser/nsrt/bug-1311-constant-array.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Bug1311ConstantArray;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/**
+	 * @var array<int, string>
+	 */
+	private $list = [];
+
+	public function convertListByRefWithoutKey(): void
+	{
+		$temp = [1, 2, 3];
+
+		foreach ($temp as &$item) {
+			$item = (string) $item;
+		}
+
+		assertType("array{'1'|'2'|'3', '1'|'2'|'3', '1'|'2'|'3'}", $temp);
+
+		$this->list = $temp;
+	}
+
+	public function convertListByRefWithKey(): void
+	{
+		$temp = [1, 2, 3];
+
+		foreach ($temp as $k => &$item) {
+			$item = (string) $item;
+		}
+
+		assertType("array{'1'|'2'|'3', '1'|'2'|'3', '1'|'2'|'3'}", $temp);
+
+		$this->list = $temp;
+	}
+
+	public function byRefConstantArrayConditional(): void
+	{
+		$temp = [1, 2, 3];
+
+		foreach ($temp as &$item) {
+			if (rand(0, 1)) {
+				$item = (string) $item;
+			}
+		}
+
+		assertType("array{1|2|3|'1'|'2'|'3', 1|2|3|'1'|'2'|'3', 1|2|3|'1'|'2'|'3'}", $temp);
+	}
+
+	public function byRefConstantArrayWithBreak(): void
+	{
+		$temp = [1, 2, 3];
+
+		foreach ($temp as &$item) {
+			$item = (string) $item;
+			if (rand(0, 1)) {
+				break;
+			}
+		}
+
+		assertType('array{1, 2, 3}', $temp);
+	}
+
+	public function byRefConstantArrayIntval(): void
+	{
+		$temp = ['a', 'b', 'c'];
+
+		foreach ($temp as &$item) {
+			$item = strlen($item);
+		}
+
+		assertType('array{1, 1, 1}', $temp);
+	}
+
+	public function byRefConstantArrayStringKeys(): void
+	{
+		$temp = ['x' => 1, 'y' => 2];
+
+		foreach ($temp as &$v) {
+			$v = (string) $v;
+		}
+
+		assertType("array{x: '1'|'2', y: '1'|'2'}", $temp);
+	}
+
+	public function byRefConstantArrayNoOverwrite(): void
+	{
+		$temp = [1, 2, 3];
+
+		foreach ($temp as &$item) {
+			echo $item;
+		}
+
+		assertType('array{1, 2, 3}', $temp);
+	}
+}