Summary

PHPStan incorrectly reported array_key_exists() as always evaluating to false when checking an array that was modified through a by-reference variable assigned from an ArrayDimFetch expression (e.g. $ref = &$arr[$id]['data']). Writes through $ref were not propagated back to $arr, so in loop iterations the type of $arr[$id]['data'] remained array{} even after keys were added via the reference.

Changes

• src/Analyser/ExprHandler/AssignHandler.php: When processing AssignRef where the right side is an ArrayDimFetch, set up an IntertwinedVariableByReferenceWithExpr so that writes to the reference variable propagate back to the source array.
• src/Analyser/MutatingScope.php: Added propagateRefTypeToArrayDimFetch() method that uses setOffsetValueType (replacement semantics) instead of the default assignExpression path which uses HasOffsetValueType intersection (narrowing semantics). The narrowing path fails for constant-dim ArrayDimFetch because intersecting array{data: array{}} with HasOffsetValueType('data', array{id: int}) produces never. Added hasConstantDimInChain() helper to detect when this alternative propagation is needed.
• tests/PHPStan/Rules/Comparison/data/bug-14449.php: Regression test reproducing the original issue.
• tests/PHPStan/Rules/Comparison/ImpossibleCheckTypeFunctionCallRuleTest.php: Test method for the regression test.

Root cause

When $resultData = &$results[$id]['data'] was processed, PHPStan set up no IntertwinedVariableByReferenceWithExpr for this case (only Variable-to-Variable references were handled). This meant that $resultData['id'] = $id only updated the type of $resultData but not $results[$id]['data']. During loop fixpoint analysis, the type of $results[$id]['data'] converged to array{} (from the explicit $results[$id]['data'] = [] assignment) without accounting for modifications through the reference. Consequently, array_key_exists('id', $results[$id]['data']) was incorrectly reported as always false.

The existing assignExpression method couldn't be used directly for propagation because specifyExpressionType uses HasOffsetValueType intersection for constant-key ArrayDimFetch, which produces never when the existing value type is incompatible with the new value type (e.g., array{} intersected with HasOffsetValueType('data', array{id: int})). The fix uses setOffsetValueType instead, which replaces the offset value type rather than narrowing it.

Test

Added tests/PHPStan/Rules/Comparison/data/bug-14449.php — reproduces the exact code from the issue: a loop with array_key_exists checks, by-reference assignment to a nested array element, and modification through the reference. The test expects no errors (the false positive is eliminated).

Fixes phpstan/phpstan#14449