Restrict list type preservation in IntersectionType::setOffsetValueType to offsets within list key range

- In `IntersectionType::setOffsetValueType`, change the condition for
  re-adding `AccessoryArrayListType` from checking if the offset is any
  integer (`$offsetType->toArrayKey()->isInteger()->yes()`) to checking
  if the offset is within the list's key type range
  (`$this->getIterableKeyType()->isSuperTypeOf($offsetType)->yes()`).
- This prevents list type from being incorrectly preserved when
  assigning with an arbitrary `int` key (which includes negative
  values and could create gaps), while still preserving list type for
  `int<0, max>` offsets (valid list key range) used in nested
  modifications like `$list[$k]['key'] = value`.
- Update bug-10089 test assertion: `$matrix[$size - 1][8] = 3` where
  `$size` is `int<min, 8>` correctly degrades the list since
  `int<min, 7>` is not within the `int<0, max>` key range.

Author: github-actions[bot]

src/Type/IntersectionType.php

@@ -987,7 +987,7 @@ public function setOffsetValueType(?Type $offsetType, Type $valueType, bool $uni
 		if (
 			$this->isList()->yes()
 			&& $offsetType !== null
-			&& $offsetType->toArrayKey()->isInteger()->yes()
+			&& $this->getIterableKeyType()->isSuperTypeOf($offsetType)->yes()
 			&& $this->getIterableValueType()->isArray()->yes()
 		) {
 			$result = TypeCombinator::intersect($result, new AccessoryArrayListType());

tests/PHPStan/Analyser/nsrt/bug-10089.php

@@ -24,7 +24,7 @@ protected function create_matrix(int $size): array
 		$matrix[$size - 1][8] = 3;
 
 		// non-empty-array<int, non-empty-array<int, 0|3>&hasOffsetValue(8, 3)>
-		assertType('non-empty-list<non-empty-array<int<0, max>, 0|3>>', $matrix);
+		assertType('non-empty-array<int, non-empty-array<int<0, max>, 0|3>>', $matrix);
 
 		for ($i = 0; $i <= $size; $i++) {
 			if ($matrix[$i][8] === 0) {

tests/PHPStan/Analyser/nsrt/bug-14336.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Bug14336;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * Assigning with arbitrary int key in a loop should degrade list to array.
+ *
+ * @param list<array{abc: string}> $list
+ * @param array<int, int> $intMap
+ */
+function testAssignAnyIntInLoop(array $list, array $intMap): void
+{
+	foreach ($intMap as $intKey => $intValue) {
+		$list[$intKey] = ['abc' => 'def'];
+	}
+	assertType("array<int, array{abc: string}>", $list);
+}
+
+/**
+ * @param list<string> $list
+ * @param int $intKey
+ */
+function testAssignAnyIntOutsideLoop(array $list, int $intKey): void
+{
+	$list[$intKey] = 'foo';
+	assertType("non-empty-array<int, string>", $list);
+}
+
+/**
+ * Safe patterns should still preserve list.
+ *
+ * @param list<string> $list
+ */
+function testKeepListWithAppend(array $list): void
+{
+	$list[] = 'foo';
+	assertType("non-empty-list<string>", $list);
+}
+
+/**
+ * @param list<string> $list
+ */
+function testKeepListWithConstantZero(array $list): void
+{
+	$list[0] = 'foo';
+	assertType("non-empty-list<string>&hasOffsetValue(0, 'foo')", $list);
+}
+
+/**
+ * Nested array assignment in loop should keep outer list when key comes from iteration.
+ *
+ * @param list<array<string, string>> $list
+ */
+function testNestedAssignKeepsList(array $list): void
+{
+	foreach ($list as $k => $v) {
+		$list[$k]['abc'] = 'world';
+	}
+	assertType("list<non-empty-array<string, string>&hasOffsetValue('abc', 'world')>", $list);
+}
+
+/**
+ * @param list<list<string>> $list
+ * @param int $intKey
+ */
+function testNestedListAssignWithAnyInt(array $list, int $intKey): void
+{
+	$list[$intKey] = ['foo'];
+	assertType("non-empty-array<int, list<string>>", $list);
+}
+
+/**
+ * Assigning with negative int key should also degrade list.
+ *
+ * @param list<string> $list
+ * @param int<min, -1> $negativeKey
+ */
+function testAssignNegativeInt(array $list, int $negativeKey): void
+{
+	$list[$negativeKey] = 'foo';
+	assertType("non-empty-array<int, string>", $list);
+}
+
+/**
+ * Assigning with int<0, max> should still keep list (valid range).
+ *
+ * @param list<array<string>> $list
+ * @param int<0, max> $nonNegativeKey
+ */
+function testAssignNonNegativeIntWithArrayValue(array $list, int $nonNegativeKey): void
+{
+	$list[$nonNegativeKey] = ['foo'];
+	assertType("non-empty-list<array<string>>", $list);
+}
+
+/**
+ * Direct scalar assignment with int<0, max> key.
+ *
+ * @param list<string> $list
+ * @param int<0, max> $nonNegativeKey
+ */
+function testAssignNonNegativeIntWithScalarValue(array $list, int $nonNegativeKey): void
+{
+	$list[$nonNegativeKey] = 'foo';
+	assertType("non-empty-array<int<0, max>, string>", $list);
+}