Fix count-based type narrowing for constant array unions

- Fixed specifyTypesForCountFuncCall to use direct type assignment instead
  of TypeCombinator::remove for falsey context with fixed-size constant arrays
- The root cause was ConstantArrayType::isSuperTypeOf using structural
  subtyping (array{mixed} is supertype of array{mixed, string|null, mixed}),
  which made TypeCombinator::remove overly aggressive
- New regression test in tests/PHPStan/Analyser/nsrt/bug-11488.php

Closes phpstan/phpstan#11488

Author: VincentLanglet

src/Analyser/TypeSpecifier.php

@@ -1272,13 +1272,20 @@ private function specifyTypesForCountFuncCall(
 		}
 
 		$resultTypes = [];
+		$nonMatchingTypes = [];
+		$allArraysHaveDefiniteSize = true;
 		foreach ($type->getArrays() as $arrayType) {
+			if (!$arrayType->getArraySize()->isConstantScalarValue()->yes()) {
+				$allArraysHaveDefiniteSize = false;
+			}
 			$isSizeSuperTypeOfArraySize = $sizeType->isSuperTypeOf($arrayType->getArraySize());
 			if ($isSizeSuperTypeOfArraySize->no()) {
+				$nonMatchingTypes[] = $arrayType;
 				continue;
 			}
 
 			if ($context->falsey() && $isSizeSuperTypeOfArraySize->maybe()) {
+				$nonMatchingTypes[] = $arrayType;
 				continue;
 			}
 
@@ -1371,6 +1378,13 @@ private function specifyTypesForCountFuncCall(
 			$resultTypes[] = TypeCombinator::intersect($arrayType, new NonEmptyArrayType());
 		}
 
+		if ($context->falsey() && $isConstantArray->yes() && $allArraysHaveDefiniteSize) {
+			if ($nonMatchingTypes === []) {
+				return $this->create($countFuncCall->getArgs()[0]->value, new NeverType(), TypeSpecifierContext::createTrue(), $scope)->setAlwaysOverwriteTypes()->setRootExpr($rootExpr);
+			}
+			return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$nonMatchingTypes), TypeSpecifierContext::createTrue(), $scope)->setAlwaysOverwriteTypes()->setRootExpr($rootExpr);
+		}
+
 		return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$resultTypes), $context, $scope)->setRootExpr($rootExpr);
 	}
 

tests/PHPStan/Analyser/nsrt/bug-11488.php

@@ -0,0 +1,53 @@
+<?php declare(strict_types = 1);
+
+namespace Bug11488;
+
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+	/**
+	 * @param array{mixed}|array{mixed, string|null, mixed} $row
+	 */
+	protected function test(array $row): string
+	{
+		if (count($row) !== 1) {
+			assertType('array{mixed, string|null, mixed}', $row);
+
+			[$field, $operator, $value] = $row;
+			assertType('string|null', $operator);
+			return $operator ?? '=';
+		}
+
+		return '';
+	}
+
+	/**
+	 * @param array{bool}|array{mixed, string|null, mixed} $row
+	 */
+	protected function test2(array $row): string
+	{
+		if (count($row) !== 1) {
+			assertType('array{mixed, string|null, mixed}', $row);
+
+			[$field, $operator, $value] = $row;
+			assertType('string|null', $operator);
+			return $operator ?? '=';
+		}
+
+		return '';
+	}
+
+	/**
+	 * @param array{mixed}|array{mixed, string|null, mixed} $row
+	 */
+	protected function test3(array $row): string
+	{
+		if (count($row) === 3) {
+			assertType('array{mixed, string|null, mixed}', $row);
+			return '';
+		}
+
+		return '';
+	}
+}