Fix incorrect narrowing of nested array dim fetch after assignment in loop

When a constant array shape (e.g. array{-1: 0, 0: 0, 2: 0, 1: 0}) was
assigned to a nested property dim fetch like $this->prop[$key], and then
an inner loop modified it via ++$this->prop[$key][$offset], the constant
shape was lost during loop processing. This caused false positive
"Offset might not exist" errors even though all offsets were explicitly
set.

Two changes fix this:

1. In AssignHandler's descending phase, when the scope tracks a more
   precise type for an intermediate dim fetch and that type has all the
   offsets needed by the next level, use the scope's tracked type instead
   of recomputing from the parent's general array type.

2. In MutatingScope::generalizeVariableTypeHolders, when a parent
   expression is generalized and both scopes track a child expression as
   constant arrays with matching keys, generalize the child instead of
   invalidating it. This preserves the constant array shape through loop
   generalization.

Fixes phpstan/phpstan#13669

Author: staabm

src/Analyser/ExprHandler/AssignHandler.php

@@ -948,7 +948,8 @@ private function produceArrayDimFetchAssignValueToWrite(array $dimFetchStack, ar
 
 		$offsetValueTypeStack = [$offsetValueType];
 		$generalizeOnWrite = $offsetTypes[array_key_last($offsetTypes)][0] !== null;
-		foreach (array_slice($offsetTypes, 0, -1) as [$offsetType, $dimFetch]) {
+		$slicedOffsets = array_slice($offsetTypes, 0, -1);
+		foreach ($slicedOffsets as $k => [$offsetType, $dimFetch]) {
 			if ($offsetType === null) {
 				$offsetValueType = new ConstantArrayType([], []);
 				$generalizeOnWrite = false;
@@ -959,7 +960,13 @@ private function produceArrayDimFetchAssignValueToWrite(array $dimFetchStack, ar
 				} elseif ($has->maybe()) {
 					if ($scope->hasExpressionType($dimFetch)->yes()) {
 						$generalizeOnWrite = false;
-						$offsetValueType = $offsetValueType->getOffsetValueType($offsetType);
+						$scopeType = $scope->getType($dimFetch);
+						$nextOffsetType = $offsetTypes[$k + 1][0] ?? null;
+						if ($nextOffsetType !== null && $scopeType->hasOffsetValueType($nextOffsetType)->yes()) {
+							$offsetValueType = $scopeType;
+						} else {
+							$offsetValueType = $offsetValueType->getOffsetValueType($offsetType);
+						}
 					} else {
 						$offsetValueType = TypeCombinator::union($offsetValueType->getOffsetValueType($offsetType), new ConstantArrayType([], []));
 					}

src/Analyser/MutatingScope.php

@@ -3852,6 +3852,18 @@ private function generalizeVariableTypeHolders(
 					continue;
 				}
 
+				if (isset($otherVariableTypeHolders[$variableExprString])) {
+					$thisType = $variableTypeHolder->getType();
+					$otherType = $otherVariableTypeHolders[$variableExprString]->getType();
+					if (
+						$thisType->isConstantArray()->yes()
+						&& $otherType->isConstantArray()->yes()
+						&& $thisType->getIterableKeyType()->equals($otherType->getIterableKeyType())
+					) {
+						break;
+					}
+				}
+
 				continue 2;
 			}
 			if (!isset($otherVariableTypeHolders[$variableExprString])) {

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1263,4 +1263,11 @@ public function testBug14308(): void
 		$this->analyse([__DIR__ . '/data/bug-14308.php'], []);
 	}
 
+	public function testBug13669(): void
+	{
+		$this->reportPossiblyNonexistentGeneralArrayOffset = true;
+
+		$this->analyse([__DIR__ . '/data/bug-13669.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-13669.php

@@ -0,0 +1,48 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13669;
+
+final class Foo
+{
+	/**
+	 * @var array<int, array<MailStatus::CODE_*, int>>
+	 */
+	private array $mailCounts;
+
+	/** @var array<int, array<MailStatus::CODE_*>> */
+	private array $sources;
+
+	/** @param array<int, array<MailStatus::CODE_*>> $sources */
+	private function __construct(array $sources)
+	{
+		$this->mailCounts = [];
+		$this->sources = $sources;
+	}
+
+	public function countMailStates(): void
+	{
+		foreach ($this->sources as $templateId => $mails) {
+			$this->mailCounts[$templateId] = [
+				MailStatus::CODE_DELETED => 0,
+				MailStatus::CODE_NOT_ACTIVE => 0,
+				MailStatus::CODE_ACTIVE => 0,
+				MailStatus::CODE_SIMULATION => 0,
+			];
+
+			foreach ($mails as $mail) {
+				++$this->mailCounts[$templateId][$mail];
+			}
+		}
+	}
+}
+
+final class MailStatus
+{
+	public const CODE_DELETED = -1;
+
+	public const CODE_NOT_ACTIVE = 0;
+
+	public const CODE_SIMULATION = 1;
+
+	public const CODE_ACTIVE = 2;
+}