Fix false positive "offset might not exist" on array with all constant keys set in loop

When a constant array with all expected keys (e.g. array{-1: 0, 0: 0, 1: 0, 2: 0})
was modified inside a foreach loop via a union offset type covering all keys,
the intermediate expression type was derived top-down from the root property type,
producing a general array (array<-1|0|1|2, int>) that lost the constant structure.
During loop generalization, this general array couldn't confirm offset existence,
causing a false "Offset ... might not exist" error.

The fix computes improved intermediate types bottom-up using the scope's tracked
constant array types and setExistingOffsetValueType, preserving the constant array
structure through loop generalization.

Closes phpstan/phpstan#13669

Author: staabm

src/Analyser/NodeScopeResolver.php

@@ -6808,15 +6808,48 @@ private function produceArrayDimFetchAssignValueToWrite(array $dimFetchStack, ar
 		}
 
 		$additionalExpressions = [];
-		$offsetValueType = $valueToWrite;
 		$lastDimKey = array_key_last($dimFetchStack);
+
+		// Compute improved intermediate types bottom-up using scope types.
+		// The top-down derivation from the root type loses constant array
+		// precision (e.g. array{-1: 0, 0: 0} becomes array<-1|0, int>).
+		// By applying the write to the scope's tracked constant array type,
+		// we preserve the constant array structure through loop generalization.
+		$improvedTypes = [];
+		$childPostWriteType = $originalValueToWrite;
+		for ($key = ($lastDimKey ?? 0) - 1; $key >= 0; $key--) {
+			$dimFetch = $dimFetchStack[$key];
+			if ($dimFetch->dim === null) {
+				break;
+			}
+
+			$nextDimFetch = $dimFetchStack[$key + 1];
+			if ($nextDimFetch->dim === null || !$scope->hasExpressionType($dimFetch)->yes()) {
+				break;
+			}
+
+			$scopeType = $scope->getType($dimFetch);
+			$childOffset = $scope->getType($nextDimFetch->dim);
+
+			if (!$scopeType->hasOffsetValueType($childOffset)->yes()) {
+				break;
+			}
+
+			$improvedType = $scopeType->setExistingOffsetValueType($childOffset, $childPostWriteType);
+			$improvedTypes[$key] = $improvedType;
+			$childPostWriteType = $improvedType;
+		}
+
+		$offsetValueType = $valueToWrite;
 		foreach ($dimFetchStack as $key => $dimFetch) {
 			if ($dimFetch->dim === null) {
 				continue;
 			}
 
 			if ($key === $lastDimKey) {
 				$offsetValueType = $originalValueToWrite;
+			} elseif (isset($improvedTypes[$key])) {
+				$offsetValueType = $improvedTypes[$key];
 			} else {
 				$offsetType = $scope->getType($dimFetch->dim);
 				$offsetValueType = $offsetValueType->getOffsetValueType($offsetType);

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -1145,4 +1145,11 @@ public function testBug11276(): void
 		$this->analyse([__DIR__ . '/data/bug-11276.php'], []);
 	}
 
+	public function testBug13669(): void
+	{
+		$this->reportPossiblyNonexistentGeneralArrayOffset = true;
+
+		$this->analyse([__DIR__ . '/data/bug-13669.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-13669.php

@@ -0,0 +1,50 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13669;
+
+final class Foo
+{
+	/**
+	 * @var array<int, array<MailStatus::CODE_*, int>>
+	 */
+	private array $mailCounts;
+
+	/** @var array<int, array<MailStatus::CODE_*>> */
+	private array $sources;
+
+	/** @param array<int, array<MailStatus::CODE_*>> $sources */
+	private function __construct(array $sources)
+	{
+		$this->mailCounts = [];
+		$this->sources = $sources;
+	}
+
+
+	public function countMailStates(): void
+	{
+		foreach ($this->sources as $templateId => $mails) {
+			$this->mailCounts[$templateId] = [
+				MailStatus::CODE_DELETED => 0,
+				MailStatus::CODE_NOT_ACTIVE => 0,
+				MailStatus::CODE_ACTIVE => 0,
+				MailStatus::CODE_SIMULATION => 0,
+			];
+
+			foreach ($mails as $mail) {
+				++$this->mailCounts[$templateId][$mail];
+			}
+		}
+	}
+
+}
+
+final class MailStatus
+{
+	public const CODE_DELETED = -1;
+
+	public const CODE_NOT_ACTIVE = 0;
+
+	public const CODE_SIMULATION = 1;
+
+	public const CODE_ACTIVE = 2;
+}