Fix #14234: Infer list offset exists for $i < count($list) - N

- Added TypeSpecifier handling for BinaryOp\Minus with count() on the left side
- When $i < count($list) - N (N >= 0), $list[$i] is narrowed as existing
- New regression test in tests/PHPStan/Rules/Arrays/data/bug-14234.php

Author: phpstan-bot

src/Analyser/TypeSpecifier.php

@@ -351,6 +351,33 @@ public function specifyTypesInCondition(
 				}
 			}
 
+			// infer $list[$index] after $index < count($list) - N
+			if (
+				$context->true()
+				&& !$orEqual
+				&& $expr->right instanceof Expr\BinaryOp\Minus
+				&& $expr->right->left instanceof FuncCall
+				&& $expr->right->left->name instanceof Name
+				&& in_array(strtolower((string) $expr->right->left->name), ['count', 'sizeof'], true)
+				&& count($expr->right->left->getArgs()) >= 1
+				&& $leftType->isInteger()->yes()
+				&& !$leftType instanceof ConstantIntegerType
+				&& IntegerRangeType::fromInterval(0, null)->isSuperTypeOf($leftType)->yes()
+			) {
+				$countArgType = $scope->getType($expr->right->left->getArgs()[0]->value);
+				$subtractedType = $scope->getType($expr->right->right);
+				if (
+					$countArgType->isList()->yes()
+					&& IntegerRangeType::fromInterval(0, null)->isSuperTypeOf($subtractedType)->yes()
+				) {
+					$arrayArg = $expr->right->left->getArgs()[0]->value;
+					$dimFetch = new ArrayDimFetch($arrayArg, $expr->left);
+					$result = $result->unionWith(
+						$this->create($dimFetch, $countArgType->getIterableValueType(), TypeSpecifierContext::createTrue(), $scope)->setRootExpr($expr),
+					);
+				}
+			}
+
 			if (
 				!$context->null()
 				&& $expr->right instanceof FuncCall

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1189,4 +1189,11 @@ public function testBug13770(): void
 		]);
 	}
 
+	public function testBug14234(): void
+	{
+		$this->reportPossiblyNonexistentGeneralArrayOffset = true;
+
+		$this->analyse([__DIR__ . '/data/bug-14234.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-14234.php

@@ -0,0 +1,25 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14234;
+
+function getShortenedPath(string $identifier): string
+{
+	$parts = explode('/', $identifier);
+
+	for ($i = 0; $i < count($parts) - 1; $i++) {
+		$parts[$i] = substr($parts[$i], 0, 1);
+	}
+
+	return implode("/", $parts);
+}
+
+function getShortenedPath2(string $identifier): string
+{
+	$parts = explode('/', $identifier);
+
+	for ($i = 0; $i < count($parts); $i++) {
+		$parts[$i] = substr($parts[$i], 0, 1);
+	}
+
+	return implode("/", $parts);
+}