Fix false positive on array item modification with non-constant key

- When modifying a sub-key of an array element at a non-constant offset
  (e.g. $list[$k]['test'] = true), PHPStan incorrectly replaced the item
  type for ALL elements instead of unioning with the original item type
- Added shouldUnionExistingItemType() check in AssignHandler to detect
  when the composed value changes existing constant-array key values,
  forcing a union to preserve unmodified elements' types
- Updated test expectations in bug-11679 and slevomat-foreach tests to
  reflect the more correct union behavior
- New regression test in tests/PHPStan/Analyser/nsrt/bug-8270.php

Closes phpstan/phpstan#8270

Author: github-actions[bot]

src/Analyser/ExprHandler/AssignHandler.php

@@ -940,7 +940,9 @@ private function produceArrayDimFetchAssignValueToWrite(array $dimFetchStack, ar
 			$offsetValueTypeStack[] = $offsetValueType;
 		}
 
-		foreach (array_reverse($offsetTypes) as $i => [$offsetType]) {
+		$reversedOffsetTypes = array_reverse($offsetTypes);
+		$lastOffsetIndex = count($reversedOffsetTypes) - 1;
+		foreach ($reversedOffsetTypes as $i => [$offsetType]) {
 			/** @var Type $offsetValueType */
 			$offsetValueType = array_pop($offsetValueTypeStack);
 			if (
@@ -981,7 +983,11 @@ private function produceArrayDimFetchAssignValueToWrite(array $dimFetchStack, ar
 				}
 
 			} else {
-				$valueToWrite = $offsetValueType->setOffsetValueType($offsetType, $valueToWrite, $i === 0);
+				$unionValues = $i === 0;
+				if (!$unionValues && $i === $lastOffsetIndex && $offsetType !== null) {
+					$unionValues = $this->shouldUnionExistingItemType($offsetValueType, $valueToWrite);
+				}
+				$valueToWrite = $offsetValueType->setOffsetValueType($offsetType, $valueToWrite, $unionValues);
 			}
 
 			if ($arrayDimFetch === null || !$offsetValueType->isList()->yes()) {
@@ -1076,4 +1082,34 @@ private function isSameVariable(Expr $a, Expr $b): bool
 		return false;
 	}
 
+	/**
+	 * When modifying a nested array dimension with a non-constant key,
+	 * check if the composed value changes any existing constant-array
+	 * key values. If it does, the existing item type should be unioned
+	 * because unmodified elements still have their original types.
+	 */
+	private function shouldUnionExistingItemType(Type $offsetValueType, Type $composedValue): bool
+	{
+		$existingItemType = $offsetValueType->getIterableValueType();
+
+		if (!$existingItemType->isConstantArray()->yes() || !$composedValue->isConstantArray()->yes()) {
+			return false;
+		}
+
+		foreach ($existingItemType->getConstantArrays() as $existingArray) {
+			foreach ($existingArray->getKeyTypes() as $i => $keyType) {
+				$existingValue = $existingArray->getValueTypes()[$i];
+				if ($composedValue->hasOffsetValueType($keyType)->no()) {
+					continue;
+				}
+				$newValue = $composedValue->getOffsetValueType($keyType);
+				if (!$newValue->isSuperTypeOf($existingValue)->yes()) {
+					return true;
+				}
+			}
+		}
+
+		return false;
+	}
+
 }

tests/PHPStan/Analyser/nsrt/bug-8270.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Bug8270;
+
+use function PHPStan\Testing\assertType;
+
+function () {
+	/** @var non-empty-list<array{test: false, value: int}> $list */
+	$list = [];
+	$list[0]['test'] = true;
+
+	foreach ($list as $item) {
+		assertType('array{test: bool, value: int}', $item);
+		if ($item['test']) {
+			assertType('true', $item['test']);
+			echo $item['value'];
+		}
+	}
+};
+
+function () {
+	$list = [];
+
+	for ($i = 0; $i < 10; $i++) {
+		$list[] = [
+			'test' => false,
+			'value' => rand(),
+		];
+	}
+
+	if ($list === []) {
+		return;
+	}
+
+	$k = array_key_first($list);
+	assertType('int<0, max>', $k);
+	$list[$k]['test'] = true;
+
+	foreach ($list as $item) {
+		assertType('array{test: bool, value: int<0, max>}', $item);
+		if ($item['test']) {
+			echo $item['value'];
+		}
+	}
+};

tests/PHPStan/Rules/Arrays/data/bug-11679.php

@@ -31,7 +31,7 @@ public function sayHello(int $index): bool
 		assertType('array<int, array{foo?: bool}>', $this->arr);
 		if (!isset($this->arr[$index]['foo'])) {
 			$this->arr[$index]['foo'] = true;
-			assertType('non-empty-array<int, array{foo: true}>', $this->arr);
+			assertType('non-empty-array<int, array{foo?: bool}>', $this->arr);
 		}
 		assertType('array<int, array{foo?: bool}>', $this->arr);
 		return $this->arr[$index]['foo']; // PHPStan does not realize 'foo' is set

tests/PHPStan/Rules/Arrays/data/slevomat-foreach-array-key-exists-bug.php

@@ -18,7 +18,7 @@ public function doFoo(array $percentageIntervals, array $changes): void
 						assertType('non-empty-array<array{itemsCount: mixed, interval: mixed}>', $intervalResults);
 						assertType('array{itemsCount: mixed, interval: mixed}', $intervalResults[$key]);
 						$intervalResults[$key]['itemsCount'] += $itemsCount;
-						assertType('non-empty-array<array{itemsCount: (array|float|int), interval: mixed}>', $intervalResults);
+						assertType('non-empty-array<array{itemsCount: mixed, interval: mixed}>', $intervalResults);
 						assertType('array{itemsCount: (array|float|int), interval: mixed}', $intervalResults[$key]);
 					} else {
 						assertType('array<array{itemsCount: mixed, interval: mixed}>', $intervalResults);