Fix phpstan/phpstan#14407: !in_array with enum values incorrectly narrows to *NEVER*

- In false context (!in_array), compute guaranteed array value type by
  intersecting value types across union members instead of using the
  full union of all possible values
- For array{A}|array{B}, neither A nor B is guaranteed in every variant,
  so no narrowing should occur
- For array{A, B}, both A and B are guaranteed, so narrowing to *NEVER*
  remains correct
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14407.php

Author: phpstan-bot

src/Type/Php/InArrayFunctionTypeSpecifyingExtension.php

@@ -19,6 +19,7 @@
 use PHPStan\Type\FunctionTypeSpecifyingExtension;
 use PHPStan\Type\MixedType;
 use PHPStan\Type\TypeCombinator;
+use PHPStan\Type\UnionType;
 use function count;
 use function strtolower;
 
@@ -113,25 +114,45 @@ public function specifyTypes(FunctionReflection $functionReflection, FuncCall $n
 		}
 
 		$specifiedTypes = new SpecifiedTypes();
+		$narrowingValueType = $arrayValueType;
+		if ($context->false()) {
+			// In false context (!in_array), we can only remove values guaranteed
+			// to be in every possible array variant. For union types like
+			// array{A}|array{B}, getIterableValueType() returns A|B but neither
+			// value is guaranteed to be in every variant.
+			$innerTypes = $arrayType instanceof UnionType ? $arrayType->getTypes() : [$arrayType];
+			$guaranteedValueType = null;
+			foreach ($innerTypes as $innerType) {
+				$innerValueType = $innerType->getIterableValueType();
+				if ($guaranteedValueType === null) {
+					$guaranteedValueType = $innerValueType;
+				} else {
+					$guaranteedValueType = TypeCombinator::intersect($guaranteedValueType, $innerValueType);
+				}
+			}
+			if ($guaranteedValueType !== null) {
+				$narrowingValueType = $guaranteedValueType;
+			}
+		}
 		if (
 			$context->true()
 			|| (
 				$context->false()
-				&& count($arrayValueType->getFiniteTypes()) > 0
+				&& count($narrowingValueType->getFiniteTypes()) > 0
 				&& count($needleType->getFiniteTypes()) > 0
 				&& $arrayType->isIterableAtLeastOnce()->yes()
 			)
 		) {
 			$specifiedTypes = $this->typeSpecifier->create(
 				$needleExpr,
-				$arrayValueType,
+				$narrowingValueType,
 				$context,
 				$scope,
 			);
 			if ($needleExpr instanceof AlwaysRememberedExpr) {
 				$specifiedTypes = $specifiedTypes->unionWith($this->typeSpecifier->create(
 					$needleExpr->getExpr(),
-					$arrayValueType,
+					$narrowingValueType,
 					$context,
 					$scope,
 				));

tests/PHPStan/Analyser/nsrt/bug-14407.php

@@ -0,0 +1,76 @@
+<?php // lint >= 8.1
+
+declare(strict_types = 1);
+
+namespace Bug14407;
+
+use function PHPStan\Testing\assertType;
+
+enum SomeEnum {
+	case A;
+	case B;
+}
+
+function () {
+	$arr = [];
+
+	if (rand(0, 1) === 0) {
+		$arr[] = SomeEnum::A;
+	} else {
+		$arr[] = SomeEnum::B;
+	}
+
+	if (rand(0, 1) === 0) {
+		$x = SomeEnum::A;
+	} else {
+		$x = SomeEnum::B;
+	}
+
+	if (!in_array($x, $arr)) {
+		// either $x=A, $arr=[B] or $x=B, $arr=[A]
+		assertType('Bug14407\SomeEnum::A|Bug14407\SomeEnum::B', $x);
+	}
+
+	if (!in_array($x, $arr) && $x === SomeEnum::A) {
+		// $x=A, $arr=[B]
+		assertType('Bug14407\SomeEnum::A', $x);
+	}
+};
+
+function () {
+	$arr = [SomeEnum::A, SomeEnum::B];
+
+	if (rand(0, 1) === 0) {
+		$x = SomeEnum::A;
+	} else {
+		$x = SomeEnum::B;
+	}
+
+	if (!in_array($x, $arr)) {
+		// array always contains both A and B, so this is correctly *NEVER*
+		assertType('*NEVER*', $x);
+	}
+};
+
+function () {
+	$arr = [];
+
+	$r = rand(0, 2);
+
+	if ($r === 0) {
+		$arr[] = SomeEnum::A;
+	} elseif ($r === 1) {
+		$arr[] = SomeEnum::B;
+	}
+
+	if (rand(0, 1) === 0) {
+		$x = SomeEnum::A;
+	} else {
+		$x = SomeEnum::B;
+	}
+
+	// arr might be empty, so no narrowing possible
+	if (!in_array($x, $arr) && $x === SomeEnum::A) {
+		assertType('Bug14407\SomeEnum::A', $x);
+	}
+};