Fix phpstan/phpstan#11488: count() narrowing on union of constant arrays

- Fixed specifyTypesForCountFuncCall falsey context to build complement types directly
  instead of removing matching types, avoiding structural subtyping issues with
  TypeCombinator::remove
- Added regression test in tests/PHPStan/Analyser/nsrt/bug-11488.php

Author: VincentLanglet

src/Analyser/TypeSpecifier.php

@@ -1274,11 +1274,16 @@ private function specifyTypesForCountFuncCall(
 		$resultTypes = [];
 		foreach ($type->getArrays() as $arrayType) {
 			$isSizeSuperTypeOfArraySize = $sizeType->isSuperTypeOf($arrayType->getArraySize());
-			if ($isSizeSuperTypeOfArraySize->no()) {
+
+			if ($context->falsey()) {
+				if ($isSizeSuperTypeOfArraySize->yes()) {
+					continue;
+				}
+				$resultTypes[] = $arrayType;
 				continue;
 			}
 
-			if ($context->falsey() && $isSizeSuperTypeOfArraySize->maybe()) {
+			if ($isSizeSuperTypeOfArraySize->no()) {
 				continue;
 			}
 
@@ -1371,6 +1376,13 @@ private function specifyTypesForCountFuncCall(
 			$resultTypes[] = TypeCombinator::intersect($arrayType, new NonEmptyArrayType());
 		}
 
+		if ($context->falsey()) {
+			if (count($resultTypes) === 0) {
+				return null;
+			}
+			return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$resultTypes), TypeSpecifierContext::createTrue(), $scope)->setRootExpr($rootExpr);
+		}
+
 		return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$resultTypes), $context, $scope)->setRootExpr($rootExpr);
 	}
 

tests/PHPStan/Analyser/nsrt/bug-11488.php

@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace Bug11488;
+
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+	/**
+	 * @param array{mixed}|array{mixed, string|null, mixed} $row
+	 */
+	protected function test(array $row): string
+	{
+		if (count($row) !== 1) {
+			assertType('array{mixed, string|null, mixed}', $row);
+
+			[$field, $operator, $value] = $row;
+			assertType('string|null', $operator);
+			return $operator ?? '=';
+		}
+
+		return '';
+	}
+}