From 7fb4a370be1b322e50b7e812722f21fd94c29492 Mon Sep 17 00:00:00 2001
From: VincentLanglet <9052536+VincentLanglet@users.noreply.github.com>
Date: Sun, 8 Mar 2026 12:24:50 +0000
Subject: [PATCH] Fix phpstan/phpstan#11488: count() narrowing on union of
 constant arrays

- Fixed specifyTypesForCountFuncCall falsey context to build complement types directly
  instead of removing matching types, avoiding structural subtyping issues with
  TypeCombinator::remove
- Added regression test in tests/PHPStan/Analyser/nsrt/bug-11488.php
---
 src/Analyser/TypeSpecifier.php            | 16 +++++++++++++--
 tests/PHPStan/Analyser/nsrt/bug-11488.php | 24 +++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 tests/PHPStan/Analyser/nsrt/bug-11488.php

diff --git a/src/Analyser/TypeSpecifier.php b/src/Analyser/TypeSpecifier.php
index 1d8ca2608a9..78181834ae0 100644
--- a/src/Analyser/TypeSpecifier.php
+++ b/src/Analyser/TypeSpecifier.php
@@ -1274,11 +1274,16 @@ private function specifyTypesForCountFuncCall(
 		$resultTypes = [];
 		foreach ($type->getArrays() as $arrayType) {
 			$isSizeSuperTypeOfArraySize = $sizeType->isSuperTypeOf($arrayType->getArraySize());
-			if ($isSizeSuperTypeOfArraySize->no()) {
+
+			if ($context->falsey()) {
+				if ($isSizeSuperTypeOfArraySize->yes()) {
+					continue;
+				}
+				$resultTypes[] = $arrayType;
 				continue;
 			}
 
-			if ($context->falsey() && $isSizeSuperTypeOfArraySize->maybe()) {
+			if ($isSizeSuperTypeOfArraySize->no()) {
 				continue;
 			}
 
@@ -1371,6 +1376,13 @@ private function specifyTypesForCountFuncCall(
 			$resultTypes[] = TypeCombinator::intersect($arrayType, new NonEmptyArrayType());
 		}
 
+		if ($context->falsey()) {
+			if (count($resultTypes) === 0) {
+				return null;
+			}
+			return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$resultTypes), TypeSpecifierContext::createTrue(), $scope)->setRootExpr($rootExpr);
+		}
+
 		return $this->create($countFuncCall->getArgs()[0]->value, TypeCombinator::union(...$resultTypes), $context, $scope)->setRootExpr($rootExpr);
 	}
 
diff --git a/tests/PHPStan/Analyser/nsrt/bug-11488.php b/tests/PHPStan/Analyser/nsrt/bug-11488.php
new file mode 100644
index 00000000000..dd7c35c38f6
--- /dev/null
+++ b/tests/PHPStan/Analyser/nsrt/bug-11488.php
@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace Bug11488;
+
+use function PHPStan\Testing\assertType;
+
+class Foo
+{
+	/**
+	 * @param array{mixed}|array{mixed, string|null, mixed} $row
+	 */
+	protected function test(array $row): string
+	{
+		if (count($row) !== 1) {
+			assertType('array{mixed, string|null, mixed}', $row);
+
+			[$field, $operator, $value] = $row;
+			assertType('string|null', $operator);
+			return $operator ?? '=';
+		}
+
+		return '';
+	}
+}