Fix phpstan/phpstan#14333: Setting an array key doesn't update a reference

- When creating an array with by-reference items (e.g. $b = ['key' => &$a]),
  register IntertwinedVariableByReferenceWithExpr entries so that subsequent
  assignments to array offsets propagate type changes to the referenced variables
- Preserve non-variable-to-variable intertwined refs in assignVariable() so they
  survive the recursive propagation chain without being invalidated
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14333.php

Author: VincentLanglet

src/Analyser/ExprHandler/AssignHandler.php

@@ -69,6 +69,7 @@
 use function array_slice;
 use function count;
 use function in_array;
+use function is_int;
 use function is_string;
 
 /**
@@ -315,6 +316,57 @@ public function processAssignVar(
 				foreach ($conditionalExpressions as $exprString => $holders) {
 					$scope = $scope->addConditionalExpressions($exprString, $holders);
 				}
+
+				if ($assignedExpr instanceof Expr\Array_) {
+					$implicitIndex = 0;
+					foreach ($assignedExpr->items as $arrayItem) {
+						if ($arrayItem->key !== null) {
+							$keyType = $scope->getType($arrayItem->key);
+							if ($keyType->isConstantScalarValue()->yes()) {
+								$keyValues = $keyType->getConstantScalarValues();
+								if (count($keyValues) === 1) {
+									$keyValue = $keyValues[0];
+									if (is_int($keyValue) && $keyValue >= $implicitIndex) {
+										$implicitIndex = $keyValue + 1;
+									}
+								}
+							}
+						}
+
+						if (!$arrayItem->byRef || !$arrayItem->value instanceof Variable || !is_string($arrayItem->value->name)) {
+							if ($arrayItem->key === null) {
+								$implicitIndex++;
+							}
+							continue;
+						}
+
+						$refVarName = $arrayItem->value->name;
+						if ($arrayItem->key !== null) {
+							$dimExpr = $arrayItem->key;
+						} else {
+							$dimExpr = new Node\Scalar\Int_($implicitIndex);
+							$implicitIndex++;
+						}
+
+						$dimFetchExpr = new ArrayDimFetch(new Variable($var->name), $dimExpr);
+						$refType = $scope->getType(new Variable($refVarName));
+						$refNativeType = $scope->getNativeType(new Variable($refVarName));
+
+						// When $varName's array key changes, update $refVarName
+						$scope = $scope->assignExpression(
+							new IntertwinedVariableByReferenceWithExpr($var->name, new Variable($refVarName), $dimFetchExpr),
+							$refType,
+							$refNativeType,
+						);
+
+						// When $refVarName changes, update $varName's array key
+						$scope = $scope->assignExpression(
+							new IntertwinedVariableByReferenceWithExpr($refVarName, $dimFetchExpr, new Variable($refVarName)),
+							$refType,
+							$refNativeType,
+						);
+					}
+				}
 			} else {
 				$nameExprResult = $nodeScopeResolver->processExprNode($stmt, $var->name, $scope, $storage, $nodeCallback, $context);
 				$hasYield = $hasYield || $nameExprResult->hasYield();

src/Analyser/MutatingScope.php

@@ -2573,6 +2573,29 @@ public function isUndefinedExpressionAllowed(Expr $expr): bool
 	public function assignVariable(string $variableName, Type $type, Type $nativeType, TrinaryLogic $certainty, array $intertwinedPropagatedFrom = []): self
 	{
 		$node = new Variable($variableName);
+
+		// Collect non-variable-to-variable intertwined refs for this variable before invalidation,
+		// as they may be lost during assignExpression and recursive propagation
+		$preservedIntertwinedRefs = [];
+		$preservedNativeIntertwinedRefs = [];
+		foreach ($this->expressionTypes as $exprString => $exprTypeHolder) {
+			$exprExpr = $exprTypeHolder->getExpr();
+			if (
+				!($exprExpr instanceof IntertwinedVariableByReferenceWithExpr)
+				|| $exprExpr->getVariableName() !== $variableName
+				|| $exprExpr->isVariableToVariableReference()
+			) {
+				continue;
+			}
+
+			$preservedIntertwinedRefs[$exprString] = $exprTypeHolder;
+			if (!array_key_exists($exprString, $this->nativeExpressionTypes)) {
+				continue;
+			}
+
+			$preservedNativeIntertwinedRefs[$exprString] = $this->nativeExpressionTypes[$exprString];
+		}
+
 		$scope = $this->assignExpression($node, $type, $nativeType);
 		if ($certainty->no()) {
 			throw new ShouldNotHappenException();
@@ -2620,6 +2643,22 @@ public function assignVariable(string $variableName, Type $type, Type $nativeTyp
 
 		}
 
+		// Re-add intertwined refs that were lost during propagation
+		foreach ($preservedIntertwinedRefs as $exprString => $exprTypeHolder) {
+			if (array_key_exists($exprString, $scope->expressionTypes)) {
+				continue;
+			}
+
+			$scope->expressionTypes[$exprString] = $exprTypeHolder;
+		}
+		foreach ($preservedNativeIntertwinedRefs as $exprString => $exprTypeHolder) {
+			if (array_key_exists($exprString, $scope->nativeExpressionTypes)) {
+				continue;
+			}
+
+			$scope->nativeExpressionTypes[$exprString] = $exprTypeHolder;
+		}
+
 		return $scope;
 	}
 

tests/PHPStan/Analyser/nsrt/bug-14333.php

@@ -0,0 +1,34 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14333;
+
+use function PHPStan\Testing\assertType;
+
+function testByRefInArrayWithKey(): void
+{
+	$a = 'hello';
+	assertType("'hello'", $a);
+
+	$b = ['key' => &$a];
+	assertType("'hello'", $a);
+
+	$b['key'] = 42;
+	assertType('42', $a);
+}
+
+function testMultipleByRefInArray(): void
+{
+	$a = 1;
+	$c = 'test';
+
+	$b = [&$a, 'normal', &$c];
+	assertType('1', $a);
+	assertType("'test'", $c);
+
+	$b[0] = 2;
+	$b[1] = 'foo';
+	$b[2] = 'bar';
+
+	assertType('2', $a);
+	assertType("'bar'", $c);
+}