Carry unsealed slots through array_combine() all-constant fast path

`ArrayCombineHelper` paired only the explicit `getValueTypes()` of the
keys and values arrays, dropping unsealed extras —
`array_combine(array{'a', 'b', ...<int, string>}, array{1, 2, ...<int,
int>})` inferred a sealed `array{a: 1, b: 2}` even though the matching
extras pair up into further entries.

When both inputs are unsealed (their extra counts are both unbounded
and must match for the call to succeed), attach the result's unsealed
slot: the keys' unsealed value (as an array key) mapped to the values'
unsealed value. If only one side is unsealed the sealed side caps the
size, so no extras survive and the result stays sealed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Type/Php/ArrayCombineHelper.php

@@ -66,6 +66,22 @@ public function getReturnAndThrowType(Expr $firstArg, Expr $secondArg, Scope $sc
 					$builder->setOffsetValueType($keyType, $valueType);
 				}
 
+				// When both inputs carry unsealed extras (of matching,
+				// unbounded count) the extra positions pair up: the keys'
+				// unsealed value becomes a key, the values' unsealed value
+				// becomes its value. If only one side is unsealed, the
+				// sealed side caps the size, so no extras can survive.
+				$keysUnsealed = $constantKeysArray->getUnsealedTypes();
+				$valuesUnsealed = $constantValueArrays->getUnsealedTypes();
+				if (
+					$constantKeysArray->isUnsealed()->yes()
+					&& $constantValueArrays->isUnsealed()->yes()
+					&& $keysUnsealed !== null
+					&& $valuesUnsealed !== null
+				) {
+					$builder->makeUnsealed($keysUnsealed[1]->toArrayKey(), $valuesUnsealed[1]);
+				}
+
 				$results[] = $builder->getArray();
 			}
 

tests/PHPStan/Analyser/nsrt/array-combine-php8.php

@@ -162,3 +162,27 @@ function withUnionAsKey(int|bool $oneOrBool)
 
 	assertType("array{1: 'bar'}", array_combine($keys, ['bar']));
 }
+
+/**
+ * @param array{'a', 'b', ...<int, string>} $keys
+ * @param array{1, 2, ...<int, int>} $values
+ */
+function bothUnsealed(array $keys, array $values)
+{
+	// Both arrays carry unsealed extras of matching (unbounded) count;
+	// the extra key/value pairs become the result's unsealed slot:
+	// `<string, int>` (the keys' unsealed value, as a key, mapped to the
+	// values' unsealed value).
+	assertType('array{a: 1, b: 2, ...<string, int>}', array_combine($keys, $values));
+}
+
+/**
+ * @param array{'a', 'b', ...<int, string>} $keys
+ */
+function onlyKeysUnsealed(array $keys)
+{
+	// The values array is sealed (exactly 2), so array_combine only
+	// succeeds when the keys array also has exactly 2 — the extras can't
+	// exist. Result stays sealed.
+	assertType('array{a: 1, b: 2}', array_combine($keys, [1, 2]));
+}