Account for callback return type in array_reduce carry parameter

The carry parameter type should be the union of the initial value type
and the callback's return type, since after the first iteration $carry
receives the callback's return value, not the initial value. Previously,
only the initial type was used, which was incorrect for subsequent
iterations (e.g., array{starts: array{}, ends: array{}} was wrong when
the callback returns a modified array, and null was wrong when the
callback returns int).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Type/Php/ArrayReduceCallbackClosureTypeExtension.php

@@ -2,6 +2,8 @@
 
 namespace PHPStan\Type\Php;
 
+use PhpParser\Node\Expr\ArrowFunction;
+use PhpParser\Node\Expr\Closure;
 use PhpParser\Node\Expr\FuncCall;
 use PHPStan\Analyser\Scope;
 use PHPStan\DependencyInjection\AutowiredService;
@@ -13,7 +15,9 @@
 use PHPStan\Type\GeneralizePrecision;
 use PHPStan\Type\MixedType;
 use PHPStan\Type\NullType;
+use PHPStan\Type\ParserNodeTypeToPHPStanType;
 use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
 
 #[AutowiredService]
 final class ArrayReduceCallbackClosureTypeExtension implements FunctionParameterClosureTypeExtension
@@ -43,6 +47,14 @@ public function getTypeFromFunctionCall(FunctionReflection $functionReflection,
 
 		$carryType = $initialType->generalize(GeneralizePrecision::templateArgument());
 
+		$callbackExpr = $args[1]->value ?? null;
+		if ($callbackExpr instanceof Closure || $callbackExpr instanceof ArrowFunction) {
+			$callbackReturnType = ParserNodeTypeToPHPStanType::resolve($callbackExpr->returnType, null);
+			if (!$callbackReturnType instanceof MixedType) {
+				$carryType = TypeCombinator::union($carryType, $callbackReturnType);
+			}
+		}
+
 		return new ClosureType(
 			[
 				new NativeParameterReflection('carry', false, $carryType, $parameter->passedByReference(), false, null),

tests/PHPStan/Analyser/nsrt/bug-7280.php

@@ -10,7 +10,7 @@
 $result1 = array_reduce(
 	['test1', 'test2'],
 	static function (array $carry, string $value): array {
-		assertType("array{starts: array{}, ends: array{}}", $carry);
+		assertType("array", $carry);
 		$carry['starts'][] = $value;
 		$carry['ends'][] = $value;
 
@@ -31,7 +31,7 @@ static function (array $carry, string $value): array {
 $result3 = array_reduce(
 	[1, 2, 3],
 	static function (?int $carry, int $value): int {
-		assertType('null', $carry);
+		assertType('int|null', $carry);
 		return ($carry ?? 0) + $value;
 	},
 );