Intersect stored FuncCall expression types with dynamically computed types in MutatingScope::resolveType()

- When a FuncCall expression (e.g. `count($arr)`) has a stored expression
  type from a prior condition, `resolveType()` now also computes the
  dynamic type via the ExprHandler and returns the intersection of both.
- This prevents stale stored types from overriding the correct type when
  function arguments have been narrowed after scope merging.
- The bug occurred when `count($arr)` was used in a comparison (e.g.
  `count($arr) > 2`), storing `count($arr) = int<0, max>` after merge,
  and then `$arr` was narrowed to non-empty by a different condition.
- The fix also covers analogous cases: `sizeof()`, `strlen()`,
  `mb_strlen()`, and any other FuncCall with stored expression types.

Author: github-actions[bot]

src/Analyser/MutatingScope.php

@@ -973,7 +973,25 @@ private function resolveType(string $exprString, Expr $node): Type
 			&& !$node instanceof Expr\ArrowFunction
 			&& $this->hasExpressionType($node)->yes()
 		) {
-			return $this->expressionTypes[$exprString]->getType();
+			$storedType = $this->expressionTypes[$exprString]->getType();
+
+			if ($node instanceof FuncCall) {
+				// Stored expression types for function calls can become stale
+				// when arguments are narrowed after scope merging.
+				// Intersect with the dynamically computed type to stay correct.
+				$this->resolvedTypes[$exprString] = $storedType;
+				foreach ($this->container->getServicesByTag(ExprHandler::EXTENSION_TAG) as $exprHandler) {
+					if (!$exprHandler->supports($node)) {
+						continue;
+					}
+					$dynamicType = $exprHandler->resolveType($this, $node);
+					unset($this->resolvedTypes[$exprString]);
+					return TypeCombinator::intersect($storedType, $dynamicType);
+				}
+				unset($this->resolvedTypes[$exprString]);
+			}
+
+			return $storedType;
 		}
 
 		/** @var ExprHandler<Expr> $exprHandler */

tests/PHPStan/Analyser/nsrt/bug-13750.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Bug13750;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/** @param array<mixed> $arr */
+	public function forgetCount(array $arr): void
+	{
+		if (count($arr) > 2) {
+			assertType('non-empty-array<mixed>', $arr);
+			assertType('int<3, max>', count($arr));
+		}
+		assertType('array<mixed>', $arr);
+		assertType('int<0, max>', count($arr));
+		if (count($arr, COUNT_RECURSIVE) > 2) {
+			assertType('non-empty-array<mixed>', $arr);
+			assertType('int<1, max>', count($arr));
+		}
+	}
+
+	/** @param array<mixed> $arr */
+	public function forgetCountDifferentNarrowing(array $arr): void
+	{
+		if (count($arr) > 2) {
+		}
+		if ($arr !== []) {
+			assertType('int<1, max>', count($arr));
+		}
+	}
+
+	/** @param array<mixed> $arr */
+	public function sizeofAfterSizeof(array $arr): void
+	{
+		if (sizeof($arr) > 2) {
+		}
+		if ($arr !== []) {
+			assertType('int<1, max>', sizeof($arr));
+		}
+	}
+
+	public function strlenAfterStrlen(string $str): void
+	{
+		if (strlen($str) > 5) {
+		}
+		if ($str !== '') {
+			assertType('int<1, max>', strlen($str));
+		}
+	}
+}