Fix array_splice not resetting integer keys of the input array

- Generalize specific integer key types (e.g. 10|20|30) to int in ArrayType::spliceArray()
- Uses TypeTraverser to only affect integer parts of union key types, preserving string keys
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14037.php
- The root cause was that ArrayType::spliceArray() preserved the original key type verbatim, but PHP's array_splice re-indexes integer keys to 0, 1, 2, ...

Author: VincentLanglet

src/Type/ArrayType.php

@@ -521,8 +521,20 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 			return new ConstantArrayType([], []);
 		}
 
+		$keyType = TypeTraverser::map($this->getIterableKeyType(), static function (Type $type, callable $traverse): Type {
+			if ($type instanceof UnionType) {
+				return $traverse($type);
+			}
+
+			if ($type->isInteger()->yes()) {
+				return new IntegerType();
+			}
+
+			return $type;
+		});
+
 		$arrayType = new self(
-			TypeCombinator::union($this->getIterableKeyType(), $replacementArrayType->getKeysArray()->getIterableKeyType()),
+			TypeCombinator::union($keyType, $replacementArrayType->getKeysArray()->getIterableKeyType()),
 			TypeCombinator::union($this->getIterableValueType(), $replacementArrayType->getIterableValueType()),
 		);
 

tests/PHPStan/Analyser/nsrt/bug-14037.php

@@ -0,0 +1,13 @@
+<?php declare(strict_types=1);
+
+namespace Bug14037;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param array<10|20|30|'a', mixed> $a
+ */
+function splice(array $a): void {
+	array_splice($a, 0, 0);
+	assertType("array<'a'|int, mixed>", $a);
+}