Fix count comparison with IntegerRangeType narrowing array too aggressively

- Fixed TypeSpecifier to properly compute sizeType for count() comparisons
  when the compared value is an IntegerRangeType (e.g. int<1, 42>)
- In falsey context, use max of range to avoid incorrectly removing arrays
  whose count falls within the range but can still satisfy the condition
- In truthy context, use min of range for correct minimum count constraint
- Updated test expectations in bug11480.php and list-count.php to reflect
  the more correct narrowing behavior
- New regression test in tests/PHPStan/Analyser/nsrt/bug-13705.php

Author: VincentLanglet

src/Analyser/TypeSpecifier.php

@@ -287,7 +287,21 @@ public function specifyTypesInCondition(
 						$sizeType = IntegerRangeType::createAllGreaterThan($leftType->getValue());
 					}
 				} elseif ($leftType instanceof IntegerRangeType) {
-					$sizeType = $leftType->shift($offset);
+					if ($context->falsey() && $leftType->getMax() !== null) {
+						if ($orEqual) {
+							$sizeType = IntegerRangeType::createAllGreaterThanOrEqualTo($leftType->getMax());
+						} else {
+							$sizeType = IntegerRangeType::createAllGreaterThan($leftType->getMax());
+						}
+					} elseif ($leftType->getMin() !== null) {
+						if ($orEqual) {
+							$sizeType = IntegerRangeType::createAllGreaterThanOrEqualTo($leftType->getMin());
+						} else {
+							$sizeType = IntegerRangeType::createAllGreaterThan($leftType->getMin());
+						}
+					} else {
+						$sizeType = $leftType->shift($offset);
+					}
 				} else {
 					$sizeType = $leftType;
 				}

tests/PHPStan/Analyser/nsrt/bug-13705.php

@@ -0,0 +1,35 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13705;
+
+use function PHPStan\Testing\assertType;
+
+function whileLoop(): void
+{
+	$quantity = random_int(1, 42);
+	$codes = [];
+	while (count($codes) < $quantity) {
+		assertType('list<non-empty-string>', $codes);
+		$code = random_bytes(16);
+		if (!in_array($code, $codes, true)) {
+			$codes[] = $code;
+		}
+	}
+}
+
+function whileLoopOriginal(int $length, int $quantity): void
+{
+	if ($length < 8) {
+		throw new \InvalidArgumentException();
+	}
+	$codes = [];
+	while ($quantity >= 1 && count($codes) < $quantity) {
+		$code = '';
+		for ($i = 0; $i < $length; $i++) {
+			$code .= 'x';
+		}
+		if (!in_array($code, $codes, true)) {
+			$codes[] = $code;
+		}
+	}
+}

tests/PHPStan/Analyser/nsrt/bug11480.php

@@ -106,7 +106,7 @@ public function intRangeCount($count): void
 		if (count($x) >= $count) {
 			assertType("array{'xy'}|array{0: 'ab', 1?: 'xy'}", $x);
 		} else {
-			assertType("array{}", $x);
+			assertType("array{}|array{'xy'}|array{0: 'ab', 1?: 'xy'}", $x);
 		}
 		assertType("array{}|array{'xy'}|array{0: 'ab', 1?: 'xy'}", $x);
 	}

tests/PHPStan/Analyser/nsrt/list-count.php

@@ -352,7 +352,7 @@ protected function testOptionalKeysInUnionArray($row): void
 	protected function testOptionalKeysInUnionListWithIntRange($row, $listRow, $twoOrThree, $twoOrMore, int $maxThree, $tenOrEleven, $threeOrMoreInRangeLimit, $threeOrMoreOverRangeLimit): void
 	{
 		if (count($row) >= $twoOrThree) {
-			assertType('array{0: int, 1: string|null, 2?: int|null}', $row);
+			assertType('list{0: int, 1: string|null, 2?: int|null, 3?: float|null}', $row);
 		} else {
 			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
 		}
@@ -376,25 +376,25 @@ protected function testOptionalKeysInUnionListWithIntRange($row, $listRow, $twoO
 		}
 
 		if (count($row) >= $threeOrMoreInRangeLimit) {
-			assertType('list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
+			assertType('array{0: int, 1: string|null, 2: int|null, 3?: float|null}', $row);
 		} else {
 			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
 		}
 
 		if (count($listRow) >= $threeOrMoreInRangeLimit) {
-			assertType('list{0: string, 1: string, 2: string, 3?: string, 4?: string, 5?: string, 6?: string, 7?: string, 8?: string, 9?: string, 10?: string, 11?: string, 12?: string, 13?: string, 14?: string, 15?: string, 16?: string, 17?: string, 18?: string, 19?: string, 20?: string, 21?: string, 22?: string, 23?: string, 24?: string, 25?: string, 26?: string, 27?: string, 28?: string, 29?: string, 30?: string, 31?: string}', $listRow);
+			assertType('non-empty-list<string>&hasOffsetValue(1, string)&hasOffsetValue(2, string)', $listRow);
 		} else {
 			assertType('list<string>', $listRow);
 		}
 
 		if (count($row) >= $threeOrMoreOverRangeLimit) {
-			assertType('list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
+			assertType('array{0: int, 1: string|null, 2: int|null, 3?: float|null}', $row);
 		} else {
 			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
 		}
 
 		if (count($listRow) >= $threeOrMoreOverRangeLimit) {
-			assertType('non-empty-list<string>', $listRow);
+			assertType('non-empty-list<string>&hasOffsetValue(1, string)&hasOffsetValue(2, string)', $listRow);
 		} else {
 			assertType('list<string>', $listRow);
 		}