Fix phpstan/phpstan#14347: Array key set via ??= lost after modifying different key

- When an array dim fetch assignment (e.g. $arr['all']++) reassigns the root variable,
  expression types for dynamic array dim fetches (e.g. $arr[$card->value]) are now preserved
- Added getDynamicArrayDimFetchExpressionTypes() and restoreExpressionTypes() to MutatingScope
- New regression test in tests/PHPStan/Rules/Arrays/data/bug-14347.php

Author: phpstan-bot

src/Analyser/ExprHandler/AssignHandler.php

@@ -469,6 +469,7 @@ public function processAssignVar(
 
 			if ($varType->isArray()->yes() || !(new ObjectType(ArrayAccess::class))->isSuperTypeOf($varType)->yes()) {
 				if ($var instanceof Variable && is_string($var->name)) {
+					$preservedDimFetchTypes = $scope->getDynamicArrayDimFetchExpressionTypes($var->name);
 					$nodeScopeResolver->callNodeCallback($nodeCallback, new VariableAssignNode($var, new TypeExpr($valueToWrite)), $scopeBeforeAssignEval, $storage);
 					$scope = $scope->assignVariable($var->name, $valueToWrite, $nativeValueToWrite, TrinaryLogic::createYes());
 				} else {
@@ -505,6 +506,11 @@ public function processAssignVar(
 				$scope = $scope->assignExpression($expr, $type, $nativeType);
 			}
 
+			if (isset($preservedDimFetchTypes)) {
+				$scope = $scope->restoreExpressionTypes($preservedDimFetchTypes);
+				unset($preservedDimFetchTypes);
+			}
+
 			$setVarType = $scope->getType($originalVar->var);
 			if (
 				!$setVarType instanceof ErrorType

src/Analyser/MutatingScope.php

@@ -2857,6 +2857,68 @@ public function assignInitializedProperty(Type $fetchedOnType, string $propertyN
 		return $this->assignExpression(new PropertyInitializationExpr($propertyName), new MixedType(), new MixedType());
 	}
 
+	/**
+	 * @return list<array{string, ExpressionTypeHolder, ExpressionTypeHolder}>
+	 */
+	public function getDynamicArrayDimFetchExpressionTypes(string $variableName): array
+	{
+		$result = [];
+		foreach ($this->expressionTypes as $exprString => $exprTypeHolder) {
+			$expr = $exprTypeHolder->getExpr();
+			if (!$expr instanceof Expr\ArrayDimFetch) {
+				continue;
+			}
+			if (!$expr->var instanceof Variable || !is_string($expr->var->name) || $expr->var->name !== $variableName) {
+				continue;
+			}
+			if ($expr->dim === null || $expr->dim instanceof Scalar) {
+				continue;
+			}
+			$nativeHolder = $this->nativeExpressionTypes[$exprString] ?? $exprTypeHolder;
+			$result[] = [$exprString, $exprTypeHolder, $nativeHolder];
+		}
+		return $result;
+	}
+
+	/**
+	 * @param list<array{string, ExpressionTypeHolder, ExpressionTypeHolder}> $holders
+	 */
+	public function restoreExpressionTypes(array $holders): self
+	{
+		$expressionTypes = $this->expressionTypes;
+		$nativeExpressionTypes = $this->nativeExpressionTypes;
+		$changed = false;
+		foreach ($holders as [$exprString, $holder, $nativeHolder]) {
+			if (isset($expressionTypes[$exprString])) {
+				continue;
+			}
+			$expressionTypes[$exprString] = $holder;
+			$nativeExpressionTypes[$exprString] = $nativeHolder;
+			$changed = true;
+		}
+		if (!$changed) {
+			return $this;
+		}
+		return $this->scopeFactory->create(
+			$this->context,
+			$this->isDeclareStrictTypes(),
+			$this->getFunction(),
+			$this->getNamespace(),
+			$expressionTypes,
+			$nativeExpressionTypes,
+			$this->conditionalExpressions,
+			$this->inClosureBindScopeClasses,
+			$this->anonymousFunctionReflection,
+			$this->inFirstLevelStatement,
+			$this->currentlyAssignedExpressions,
+			$this->currentlyAllowedUndefinedExpressions,
+			$this->inFunctionCallsStack,
+			$this->afterExtractCall,
+			$this->parentScope,
+			$this->nativeTypesPromoted,
+		);
+	}
+
 	public function invalidateExpression(Expr $expressionToInvalidate, bool $requireMoreCharacters = false, ?ClassReflection $invalidatingClass = null): self
 	{
 		$expressionTypes = $this->expressionTypes;

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1263,4 +1263,12 @@ public function testBug14308(): void
 		$this->analyse([__DIR__ . '/data/bug-14308.php'], []);
 	}
 
+	#[RequiresPhp('>= 8.1')]
+	public function testBug14347(): void
+	{
+		$this->reportPossiblyNonexistentConstantArrayOffset = true;
+
+		$this->analyse([__DIR__ . '/data/bug-14347.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-14347.php

@@ -0,0 +1,38 @@
+<?php // lint >= 8.1
+
+declare(strict_types = 1);
+
+namespace Bug14347;
+
+enum Suit: string {
+	case Clubs = 'c';
+	case Diamonds = 'd';
+	case Hearts = 'h';
+	case Spades = 's';
+}
+/**
+ * @param array<array-key, Suit> $cards
+ * @return array<non-empty-string, non-negative-int>
+ */
+function countCards(array $cards): array {
+	$cardCounts = ['all' => 0];
+	foreach ($cards as $card) {
+		$cardCounts['all']++;
+		$cardCounts[$card->value] ??= 0;
+		$cardCounts[$card->value]++;
+	}
+	return $cardCounts;
+}
+/**
+ * @param array<array-key, Suit> $cards
+ * @return array<non-empty-string, non-negative-int>
+ */
+function countCardsBroken(array $cards): array {
+	$cardCounts = ['all' => 0];
+	foreach ($cards as $card) {
+		$cardCounts[$card->value] ??= 0;
+		$cardCounts['all']++;
+		$cardCounts[$card->value]++;
+	}
+	return $cardCounts;
+}