Fix list type lost in for loop

Author: staabm

src/Analyser/NodeScopeResolver.php

@@ -1487,6 +1487,8 @@ private function processStmtNode(
 $initScope = $condResult->getScope();
 $condResultScope = $condResult->getScope();
 
+// only the last condition expression is relevant whether the loop continues
+// see https://www.php.net/manual/en/control-structures.for.php
 if ($condExpr === $lastCondExpr) {
 $condTruthiness = ($this->treatPhpDocTypesAsCertain ? $condResultScope->getType($condExpr) : $condResultScope->getNativeType($condExpr))->toBoolean();
 $isIterableAtLeastOnce = $isIterableAtLeastOnce->and($condTruthiness->isTrue());
@@ -1513,6 +1515,7 @@ private function processStmtNode(
 foreach ($bodyScopeResult->getExitPointsByType(Continue_::class) as $continueExitPoint) {
 $bodyScope = $bodyScope->mergeWith($continueExitPoint->getScope());
 }
+
 foreach ($stmt->loop as $loopExpr) {
 $exprResult = $this->processExprNode($stmt, $loopExpr, $bodyScope, static function (): void {
 }, ExpressionContext::createTopLevel());
@@ -1539,6 +1542,7 @@ private function processStmtNode(
 if ($lastCondExpr !== null) {
 $alwaysIterates = $alwaysIterates->and($bodyScope->getType($lastCondExpr)->toBoolean()->isTrue());
 $bodyScope = $this->processExprNode($stmt, $lastCondExpr, $bodyScope, $nodeCallback, ExpressionContext::createDeep())->getTruthyScope();
+$bodyScope = $this->inferForLoopExpressions($stmt, $lastCondExpr, $bodyScope);
 }
 
 $finalScopeResult = $this->processStmtNodes($stmt, $stmt->stmts, $bodyScope, $nodeCallback, $context)->filterOutLoopExitPoints();
@@ -7116,4 +7120,66 @@ private function getFilteringExprForMatchArm(Expr\Match_ $expr, array $condition
 );
 }
 
+private function inferForLoopExpressions(For_ $stmt, Expr $lastCondExpr, MutatingScope $bodyScope): MutatingScope
+{
+// infer $items[$i] type from for ($i = 0; $i < count($items); $i++) {...}
+
+if (
+// $i = 0
+count($stmt->init) === 1
+&& $stmt->init[0] instanceof Assign
+&& $stmt->init[0]->var instanceof Variable
+&& $stmt->init[0]->expr instanceof Node\Scalar\Int_
+&& $stmt->init[0]->expr->value === 0
+// $i++ or ++$i
+&& count($stmt->loop) === 1
+&& ($stmt->loop[0] instanceof Expr\PreInc || $stmt->loop[0] instanceof Expr\PostInc)
+&& $stmt->loop[0]->var instanceof Variable
+) {
+// $i < count($items)
+if (
+$lastCondExpr instanceof BinaryOp\Smaller
+&& $lastCondExpr->left instanceof Variable
+&& $lastCondExpr->right instanceof FuncCall
+&& $lastCondExpr->right->name instanceof Name
+&& $lastCondExpr->right->name->toLowerString() === 'count'
+&& count($lastCondExpr->right->getArgs()) > 0
+&& $lastCondExpr->right->getArgs()[0]->value instanceof Variable
+&& is_string($stmt->init[0]->var->name)
+&& $stmt->init[0]->var->name === $stmt->loop[0]->var->name
+&& $stmt->init[0]->var->name === $lastCondExpr->left->name
+) {
+$arrayArg = $lastCondExpr->right->getArgs()[0]->value;
+$bodyScope = $bodyScope->assignExpression(
+new ArrayDimFetch($lastCondExpr->right->getArgs()[0]->value, $lastCondExpr->left),
+$bodyScope->getType($arrayArg)->getIterableValueType(),
+$bodyScope->getNativeType($arrayArg)->getIterableValueType(),
+);
+}
+
+// count($items) > $i
+if (
+$lastCondExpr instanceof BinaryOp\Greater
+&& $lastCondExpr->right instanceof Variable
+&& $lastCondExpr->left instanceof FuncCall
+&& $lastCondExpr->left->name instanceof Name
+&& $lastCondExpr->left->name->toLowerString() === 'count'
+&& count($lastCondExpr->left->getArgs()) > 0
+&& $lastCondExpr->left->getArgs()[0]->value instanceof Variable
+&& is_string($stmt->init[0]->var->name)
+&& $stmt->init[0]->var->name === $stmt->loop[0]->var->name
+&& $stmt->init[0]->var->name === $lastCondExpr->right->name
+) {
+$arrayArg = $lastCondExpr->left->getArgs()[0]->value;
+$bodyScope = $bodyScope->assignExpression(
+new ArrayDimFetch($lastCondExpr->left->getArgs()[0]->value, $lastCondExpr->right),
+$bodyScope->getType($arrayArg)->getIterableValueType(),
+$bodyScope->getNativeType($arrayArg)->getIterableValueType(),
+);
+}
+}
+
+return $bodyScope;
+}
+
 }

tests/PHPStan/Analyser/nsrt/for-loop-expr.php

@@ -0,0 +1,52 @@
+<?php declare(strict_types=1);
+
+namespace Bug12807;
+
+use function PHPStan\debugScope;
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param non-empty-list<int> $items
+ *
+ * @return non-empty-list<int>
+ */
+function getItemsWithForLoop(array $items): array
+{
+for ($i = 0; $i < count($items); $i++) {
+$items[$i] = 1;
+}
+
+assertType('non-empty-list<int>', $items);
+return $items;
+}
+
+/**
+ * @param list<string> $items
+ *
+ * @return list<string>
+ */
+function getItemsWithForLoopInvertLastCond(array $items): array
+{
+for ($i = 0; count($items) > $i; ++$i) {
+$items[$i] = 'hello';
+}
+
+assertType('list<string>', $items);
+return $items;
+}
+
+
+/**
+ * @param array<string> $items
+ *
+ * @return array<string>
+ */
+function getItemsArray(array $items): array
+{
+for ($i = 0; count($items) > $i; ++$i) {
+$items[$i] = 'hello';
+}
+
+assertType('array<string>', $items);
+return $items;
+}

tests/PHPStan/Rules/Arrays/NonexistentOffsetInArrayDimFetchRuleTest.php

@@ -867,16 +867,7 @@ public function testBug12406b(): void
 {
 $this->reportPossiblyNonexistentGeneralArrayOffset = true;
 
-$this->analyse([__DIR__ . '/data/bug-12406b.php'], [
-[
-'Offset int<0, max> might not exist on non-empty-list<array{0: string, 1: non-empty-string, 2: non-falsy-string, 3: numeric-string, 4?: numeric-string, 5?: numeric-string}>.',
-22,
-],
-[
-'Offset int<0, max> might not exist on non-empty-list<array{0: string, 1: non-empty-string, 2: non-falsy-string, 3: numeric-string, 4?: numeric-string, 5?: numeric-string}>.',
-23,
-],
-]);
+$this->analyse([__DIR__ . '/data/bug-12406b.php'], []);
 }
 
 public function testBug11679(): void