Bail early in TypeUtils::flattenTypes() to avoid 2^N getAllArrays() expansion

Estimate the total power-set variant count before calling
`getAllArrays()`. When a `ConstantArrayType` has more than ~14 optional
keys (16384+ variants), return the type as-is instead of expanding.
Also apply pairwise `TypeCombinator::intersect` folding in the
combination loop.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Type/TypeUtils.php

@@ -10,10 +10,10 @@
 use PHPStan\Type\Generic\TemplateType;
 use PHPStan\Type\Generic\TemplateUnionType;
 use PHPStan\Type\Traverser\LateResolvableTraverser;
-use function array_filter;
-use function array_map;
 use function array_merge;
-use function iterator_to_array;
+use function count;
+use function max;
+use const PHP_INT_MAX;
 
 /**
  * @api
@@ -147,18 +147,46 @@ public static function flattenTypes(Type $type): array
 
 		$constantArrays = $type->getConstantArrays();
 		if ($constantArrays !== []) {
+			// Estimate the total number of power-set variants before expanding.
+			// Each ConstantArrayType with N optional keys produces 2^N variants
+			// from getAllArrays(). The cartesian product across multiple constant
+			// arrays multiplies these counts. Bail out to avoid O(2^N) allocation
+			// when the total would be large.
+			$estimatedCount = 1;
+			$bail = false;
+			foreach ($constantArrays as $constantArray) {
+				$optionalCount = count($constantArray->getOptionalKeys());
+				$arrayCount = $optionalCount <= 20 ? (1 << $optionalCount) : PHP_INT_MAX;
+				if ($arrayCount > 16384 || $estimatedCount > 16384 / max($arrayCount, 1)) {
+					$bail = true;
+					break;
+				}
+				$estimatedCount *= $arrayCount;
+			}
+
+			if ($bail) {
+				return [$type];
+			}
+
 			$newTypes = [];
 			foreach ($constantArrays as $constantArray) {
 				$newTypes[] = $constantArray->getAllArrays();
 			}
 
-			return array_filter(
-				array_map(
-					static fn (array $types): Type => TypeCombinator::intersect(...$types),
-					iterator_to_array(CombinationsHelper::combinations($newTypes)),
-				),
-				static fn (Type $type): bool => !$type instanceof NeverType,
-			);
+			$result = [];
+			foreach (CombinationsHelper::combinations($newTypes) as $combination) {
+				$intersected = $combination[0];
+				for ($i = 1, $count = count($combination); $i < $count; $i++) {
+					$intersected = TypeCombinator::intersect($intersected, $combination[$i]);
+				}
+				if ($intersected instanceof NeverType) {
+					continue;
+				}
+
+				$result[] = $intersected;
+			}
+
+			return $result;
 		}
 
 		return [$type];

tests/bench/data/flatten-types-optional-keys-blowup.php

@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace BenchFlattenTypesOptionalKeysBlowup;
+
+/**
+ * Regression test for TypeUtils::flattenTypes() calling getAllArrays() on arrays with many optional keys.
+ * getAllArrays() generates 2^N ConstantArrayType objects for N optional keys.
+ * The fix adds a bail-out check and also applies pairwise intersect folding.
+ *
+ * @param array{
+ *     a?: int, b?: int, c?: int, d?: int, e?: int,
+ *     f?: int, g?: int, h?: int, i?: int, j?: int,
+ *     k?: int, l?: int, m?: int, n?: int, o?: int,
+ *     p?: int, q?: int, r?: int
+ * } $data
+ */
+function checkOffset(array $data): void
+{
+	echo $data['a'];
+	echo $data['b'];
+	echo $data['c'];
+	echo $data['d'];
+	echo $data['e'];
+}