Skip implicit-key by-ref tracking when index is uncertain due to non-constant keys

When a non-constant key appears in an array literal, the implicit index
counter becomes unreliable. Stop setting up intertwined refs for
implicit-keyed by-ref items after that point, since we can't know their
actual indices.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/AssignHandler.php

@@ -319,6 +319,7 @@ public function processAssignVar(
 
 				if ($assignedExpr instanceof Expr\Array_) {
 					$implicitIndex = 0;
+					$implicitIndexCertain = true;
 					foreach ($assignedExpr->items as $arrayItem) {
 						if ($arrayItem->key !== null) {
 							$keyType = $scope->getType($arrayItem->key);
@@ -329,7 +330,11 @@ public function processAssignVar(
 									if (is_int($keyValue) && $keyValue >= $implicitIndex) {
 										$implicitIndex = $keyValue + 1;
 									}
+								} else {
+									$implicitIndexCertain = false;
 								}
+							} else {
+								$implicitIndexCertain = false;
 							}
 						}
 
@@ -343,9 +348,12 @@ public function processAssignVar(
 						$refVarName = $arrayItem->value->name;
 						if ($arrayItem->key !== null) {
 							$dimExpr = $arrayItem->key;
-						} else {
+						} elseif ($implicitIndexCertain) {
 							$dimExpr = new Node\Scalar\Int_($implicitIndex);
 							$implicitIndex++;
+						} else {
+							$implicitIndex++;
+							continue;
 						}
 
 						$dimFetchExpr = new ArrayDimFetch(new Variable($var->name), $dimExpr);

tests/PHPStan/Analyser/nsrt/bug-14333.php

@@ -33,6 +33,21 @@ function testMultipleByRefInArray(): void
 	assertType("'bar'", $c);
 }
 
+function testNonConstantKeyBreaksImplicitIndex(int $key): void
+{
+	$a = 1;
+	$c = 'test';
+
+	$b = [$key => 'x', &$a, &$c];
+	assertType('1', $a);
+	assertType("'test'", $c);
+
+	// Since $key is non-constant, we don't know the implicit indices of &$a and &$c
+	// so we can't track the reference propagation
+	$b[0] = 2;
+	assertType('1', $a);
+}
+
 function testNested(): void
 {
 	$a = 1;