Filter conditional expressions from foreach body in processAlwaysIterableForeachScopeWithoutPollute

When using $finalScope->conditionalExpressions, conditional expressions
referencing variables only defined inside the foreach body (like $key)
could leak into the outer scope. When those conditional expressions fired
(e.g. inside an if block), the foreach variable would be re-introduced
with Yes certainty, causing false "Foreach overwrites $key" errors.

Filter conditional expressions to only keep those where both the target
expression and all condition expressions reference variables that existed
before the foreach loop.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -3870,14 +3870,34 @@ public function processAlwaysIterableForeachScopeWithoutPollute(self $finalScope
 			);
 		}
 
+		$conditionalExpressions = [];
+		foreach ($finalScope->conditionalExpressions as $conditionalExprString => $holders) {
+			if (!isset($this->expressionTypes[$conditionalExprString])) {
+				continue;
+			}
+			$filteredHolders = [];
+			foreach ($holders as $holder) {
+				foreach (array_keys($holder->getConditionExpressionTypeHolders()) as $holderExprString) {
+					if (!isset($this->expressionTypes[$holderExprString])) {
+						continue 2;
+					}
+				}
+				$filteredHolders[] = $holder;
+			}
+			if ($filteredHolders === []) {
+				continue;
+			}
+			$conditionalExpressions[$conditionalExprString] = $filteredHolders;
+		}
+
 		return $this->scopeFactory->create(
 			$this->context,
 			$this->isDeclareStrictTypes(),
 			$this->getFunction(),
 			$this->getNamespace(),
 			$expressionTypes,
 			$nativeTypes,
-			$finalScope->conditionalExpressions,
+			$conditionalExpressions,
 			$this->inClosureBindScopeClasses,
 			$this->anonymousFunctionReflection,
 			$this->inFirstLevelStatement,

tests/PHPStan/Analyser/data/bug-14446.php

@@ -22,3 +22,28 @@ function test(bool $initial): void {
 
 	assertType('bool', $initial);
 }
+
+/**
+ * @param mixed $value
+ */
+function testForeachKeyOverwrite($value): void {
+	if (is_array($value) && $value !== []) {
+		$hasOnlyStringKey = true;
+		foreach (array_keys($value) as $key) {
+			if (is_int($key)) {
+				$hasOnlyStringKey = false;
+				break;
+			}
+		}
+
+		assertType('bool', $hasOnlyStringKey);
+
+		if ($hasOnlyStringKey) {
+			// $key should not be in scope here with polluteScopeWithAlwaysIterableForeach: false
+			// Second foreach should not report "Foreach overwrites $key with its key variable"
+			foreach ($value as $key => $element) {
+				assertType('(int|string)', $key);
+			}
+		}
+	}
+}