Fix array_key_exists false positive on list types with optional trailing keys

When `ConstantArrayType::unsetOffset()` removed an optional trailing key
from a list type, it unconditionally set `isList` to `No`. This caused
`TypeCombinator::remove()` to produce `NeverType` when re-intersecting
with `AccessoryArrayListType`, since the list accessor rejects non-list
arrays. The `NeverType` falsy branch then collapsed scope merging after
conditionals like ternaries, propagating the narrowed (truthy) type
beyond the conditional and triggering false "always true" reports on
subsequent `array_key_exists()` calls.

The fix preserves the original `isList` value when unsetting an optional
key whose removal leaves the remaining keys as consecutive integers
starting from 0.

Fixes phpstan/phpstan#14177

Author: ondrejmirtes

src/Type/Constant/ConstantArrayType.php

@@ -741,7 +741,21 @@ public function unsetOffset(Type $offsetType): Type
 					$k++;
 				}
 
-				return new self($newKeyTypes, $newValueTypes, $this->nextAutoIndexes, $newOptionalKeys, TrinaryLogic::createNo());
+				$newIsList = TrinaryLogic::createNo();
+				if (!$this->isList->no() && in_array($i, $this->optionalKeys, true)) {
+					$preserveIsList = true;
+					foreach ($newKeyTypes as $k2 => $newKeyType2) {
+						if (!$newKeyType2 instanceof ConstantIntegerType || $newKeyType2->getValue() !== $k2) {
+							$preserveIsList = false;
+							break;
+						}
+					}
+					if ($preserveIsList) {
+						$newIsList = $this->isList;
+					}
+				}
+
+				return new self($newKeyTypes, $newValueTypes, $this->nextAutoIndexes, $newOptionalKeys, $newIsList);
 			}
 
 			return $this;

tests/PHPStan/Analyser/nsrt/bug-14177.php

@@ -0,0 +1,21 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14177;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/**
+	 * @param list{0: string, 1: string, 2?: string, 3?: string} $b
+	 */
+	public function testList(array $b): void
+	{
+		if (array_key_exists(3, $b)) {
+			assertType('list{0: string, 1: string, 2?: string, 3: string}', $b);
+		} else {
+			assertType('list{0: string, 1: string, 2?: string}', $b);
+		}
+		assertType('list{0: string, 1: string, 2?: string, 3?: string}', $b);
+	}
+}

tests/PHPStan/Rules/Comparison/ImpossibleCheckTypeFunctionCallRuleTest.php

@@ -1145,4 +1145,10 @@ public function testPr4375(): void
 		$this->analyse([__DIR__ . '/data/pr-4375.php'], []);
 	}
 
+	public function testBug14177(): void
+	{
+		$this->treatPhpDocTypesAsCertain = true;
+		$this->analyse([__DIR__ . '/data/bug-14177.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Comparison/data/bug-14177.php

@@ -0,0 +1,27 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14177;
+
+class HelloWorld
+{
+	public function placeholderToEditor(string $html): void
+	{
+		$result = preg_replace_callback(
+			'~\[image\\sid="(\\d+)"(?:\\shref="([^"]*)")?(?:\\sclass="([^"]*)")?]~',
+			function (array $matches): string {
+				$id = (int) $matches[1];
+
+				$replacement = sprintf(
+					'<img src="%s"%s/>',
+					$id,
+					array_key_exists(3, $matches) ? sprintf(' class="%s"', $matches[3]) : '',
+				);
+
+				return array_key_exists(2, $matches) && $matches[2] !== ''
+					? sprintf('<a href="%s">%s</a>', $matches[2], $replacement)
+					: $replacement;
+			},
+			$html,
+		);
+	}
+}