Apply symmetric fix for integer range generalization in both-directions case

When integer ranges expand in both directions across loop iterations,
compute actual observed min/max bounds instead of widening to plain int.
This mirrors the constant integers fix already applied earlier in the method.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -4160,8 +4160,8 @@ private function generalizeType(Type $a, Type $b, int $depth): Type
 						$max = $rangeMax;
 					}
 
-					$gotGreater = false;
-					$gotSmaller = false;
+					$newMin = $min;
+					$newMax = $max;
 					foreach ($integerRanges['b'] as $range) {
 						if ($range->getMin() === null) {
 							$rangeMin = PHP_INT_MIN;
@@ -4174,25 +4174,34 @@ private function generalizeType(Type $a, Type $b, int $depth): Type
 							$rangeMax = $range->getMax();
 						}
 
-						if ($rangeMax > $max) {
-							$gotGreater = true;
+						if ($rangeMax > $newMax) {
+							$newMax = $rangeMax;
 						}
-						if ($rangeMin >= $min) {
+						if ($rangeMin >= $newMin) {
 							continue;
 						}
 
-						$gotSmaller = true;
+						$newMin = $rangeMin;
 					}
 
+					$gotGreater = $newMax > $max;
+					$gotSmaller = $newMin < $min;
+
 					if ($min === PHP_INT_MIN) {
 						$min = null;
 					}
 					if ($max === PHP_INT_MAX) {
 						$max = null;
 					}
+					if ($newMin === PHP_INT_MIN) {
+						$newMin = null;
+					}
+					if ($newMax === PHP_INT_MAX) {
+						$newMax = null;
+					}
 
 					if ($gotGreater && $gotSmaller) {
-						$resultTypes[] = new IntegerType();
+						$resultTypes[] = IntegerRangeType::fromInterval($newMin, $newMax);
 					} elseif ($gotGreater) {
 						$resultTypes[] = IntegerRangeType::fromInterval($min, null);
 					} elseif ($gotSmaller) {

tests/PHPStan/Analyser/nsrt/bug-12163.php

@@ -70,6 +70,66 @@ public function iterateRowColumnIndicesDecrementing(int $rows, int $columns, int
 	}
 }
 
+class Test4
+{
+	/**
+	 * @param int<0, 10> $columnIndex
+	 */
+	public function integerRangeBothDirections(int $rows, int $columns, int $columnIndex): void
+	{
+		if ($rows < 1 || $columns < 1) return;
+		$size = $rows * $columns;
+
+		for ($i = 0; $i < $size; $i++) {
+			assertType('int<0, max>', $columnIndex);
+			if ($columnIndex < $columns) {
+				$columnIndex++;
+			} else {
+				$columnIndex--;
+			}
+		}
+	}
+}
+
+class Test5
+{
+	/**
+	 * @param int<0, 10> $columnIndex
+	 */
+	public function integerRangeOnlyGreater(int $rows, int $columns, int $columnIndex): void
+	{
+		if ($rows < 1 || $columns < 1) return;
+		$size = $rows * $columns;
+
+		for ($i = 0; $i < $size; $i++) {
+			assertType('int<0, max>', $columnIndex);
+			if ($columnIndex < $columns) {
+				$columnIndex++;
+			} else {
+				$columnIndex = 5;
+			}
+		}
+	}
+}
+
+class Test6
+{
+	/**
+	 * @param int<5, 10> $value
+	 */
+	public function integerRangeGrowsBothDirections(int $value): void
+	{
+		for ($i = 0; $i < 10; $i++) {
+			assertType('int<min, 10>', $value);
+			if ($value > 0) {
+				$value = $value - 2;
+			} else {
+				$value = $value + 3;
+			}
+		}
+	}
+}
+
 class Bug12163
 {
 	/**