Fix false positive for list offset access after $index < count($list)

- Added type specification in TypeSpecifier for list dim fetch when a non-negative
  integer variable is compared with count() using strict less-than
- When $index < count($list) holds and $index is non-negative, $list[$index] is
  guaranteed to be a valid offset for a list (sequential 0-based keys)
- Excluded ConstantIntegerType left operands since those are already handled by
  specifyTypesForCountFuncCall
- New regression test in tests/PHPStan/Rules/Arrays/data/bug-13770.php

Author: staabm

src/Analyser/TypeSpecifier.php

@@ -333,6 +333,21 @@ public function specifyTypesInCondition(
 						);
 					}
 				}
+
+				// infer $list[$index] after $index < count($list)
+				if (
+					$context->true()
+					&& !$orEqual
+					&& !$leftType instanceof ConstantIntegerType
+					&& $argType->isList()->yes()
+					&& IntegerRangeType::fromInterval(0, null)->isSuperTypeOf($leftType)->yes()
+				) {
+					$arrayArg = $expr->right->getArgs()[0]->value;
+					$dimFetch = new ArrayDimFetch($arrayArg, $expr->left);
+					$result = $result->unionWith(
+						$this->create($dimFetch, $argType->getIterableValueType(), TypeSpecifierContext::createTrue(), $scope)->setRootExpr($expr),
+					);
+				}
 			}
 
 			if (

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1161,4 +1161,20 @@ public function testBug13526(): void
 		$this->analyse([__DIR__ . '/data/bug-13526.php'], []);
 	}
 
+	public function testBug13770(): void
+	{
+		$this->reportPossiblyNonexistentGeneralArrayOffset = true;
+
+		$this->analyse([__DIR__ . '/data/bug-13770.php'], [
+			[
+				'Offset int<1, max> might not exist on non-empty-list<int>.',
+				40,
+			],
+			[
+				'Offset int might not exist on list<int>.',
+				53,
+			],
+		]);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-13770.php

@@ -0,0 +1,58 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13770;
+
+class HelloWorld
+{
+	/**
+	 * @param list<int> $array
+	 * @param positive-int $index
+	 */
+	public function positiveIntLessThanCount(array $array, int $index): int
+	{
+		if ($index < count($array)) {
+			return $array[$index]; // should not report
+		}
+
+		return 0;
+	}
+
+	/**
+	 * @param list<int> $array
+	 * @param int<0, max> $index
+	 */
+	public function nonNegativeIntLessThanCount(array $array, int $index): int
+	{
+		if ($index < count($array)) {
+			return $array[$index]; // should not report
+		}
+
+		return 0;
+	}
+
+	/**
+	 * @param list<int> $array
+	 * @param positive-int $index
+	 */
+	public function positiveIntLessThanOrEqualCount(array $array, int $index): int
+	{
+		if ($index <= count($array)) {
+			return $array[$index]; // SHOULD still report - off by one
+		}
+
+		return 0;
+	}
+
+	/**
+	 * @param list<int> $array
+	 * @param int $index
+	 */
+	public function anyIntLessThanCount(array $array, int $index): int
+	{
+		if ($index < count($array)) {
+			return $array[$index]; // SHOULD still report - could be negative
+		}
+
+		return 0;
+	}
+}