Use before-scope for evaluating array_push/array_unshift/array_splice argument types

- When `array_unshift($this->arr, array_pop($this->arr))` was processed,
  `getArrayFunctionAppendingType` re-evaluated argument types using
  `$scope->getType()` on the post-args scope. By that point, the inner
  `array_pop` had already modified `$this->arr` to be possibly empty,
  causing `array_pop` to be re-evaluated as returning `T|null` instead
  of `T`.
- Pre-compute argument types from `ExpressionResultStorage::findBeforeScope()`
  which gives the scope that existed when each argument was originally
  evaluated. Pass pre-computed PHPDoc and native types separately to
  `getArrayFunctionAppendingType`.
- Apply the same fix to `array_splice` handler, which also re-evaluated
  offset, length, and replacement argument types in the post-args scope.
- Probed sort/shuffle/arsort handlers: these only read the array argument
  itself (not other args from the scope), so they are not affected.

Author: VincentLanglet

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -435,9 +435,22 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			$arrayArgType = $scope->getType($arrayArg);
 			$arrayArgNativeType = $scope->getNativeType($arrayArg);
 
-			$offsetType = $scope->getType($normalizedExpr->getArgs()[1]->value);
-			$lengthType = isset($normalizedExpr->getArgs()[2]) ? $scope->getType($normalizedExpr->getArgs()[2]->value) : new NullType();
-			$replacementType = isset($normalizedExpr->getArgs()[3]) ? $scope->getType($normalizedExpr->getArgs()[3]->value) : new ConstantArrayType([], []);
+			$offsetType = $scopeBeforeArgs->getType($normalizedExpr->getArgs()[1]->value);
+
+			if (isset($normalizedExpr->getArgs()[2])) {
+				$lengthType = $scopeBeforeArgs->getType($normalizedExpr->getArgs()[2]->value);
+			} else {
+				$lengthType = new NullType();
+			}
+
+			if (isset($normalizedExpr->getArgs()[3])) {
+				$replacementArg = $normalizedExpr->getArgs()[3]->value;
+				$replacementType = $scopeBeforeArgs->getType($replacementArg);
+				$replacementNativeType = $scopeBeforeArgs->getNativeType($replacementArg);
+			} else {
+				$replacementType = new ConstantArrayType([], []);
+				$replacementNativeType = new ConstantArrayType([], []);
+			}
 
 			$scope = $nodeScopeResolver->processVirtualAssign(
 				$scope,
@@ -446,7 +459,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				$arrayArg,
 				new NativeTypeExpr(
 					$arrayArgType->spliceArray($offsetType, $lengthType, $replacementType),
-					$arrayArgNativeType->spliceArray($offsetType, $lengthType, $replacementType),
+					$arrayArgNativeType->spliceArray($offsetType, $lengthType, $replacementNativeType),
 				),
 				$nodeCallback,
 			)->getScope();

tests/PHPStan/Analyser/nsrt/bug-13510.php

@@ -21,5 +21,56 @@ public function testTwoLines(array $arr): void
 		array_unshift($arr, $popped);
 		assertType('non-empty-list<int>', $arr);
 	}
+}
+
+class Bar
+{
+	/** @var array<int> */
+	public array $arr = [];
+
+	public function test(): void
+	{
+		if (count($this->arr) === 0) {
+			throw new \Exception();
+		}
+		assertType('non-empty-array<int>', $this->arr);
+		array_unshift($this->arr, array_pop($this->arr));
+		assertType('non-empty-array<int>', $this->arr);
+	}
+
+	public function testArrayPush(): void
+	{
+		if (count($this->arr) === 0) {
+			throw new \Exception();
+		}
+		array_push($this->arr, array_pop($this->arr));
+		assertType('non-empty-array<int>', $this->arr);
+	}
 
+	public function testArrayUnshiftWithArrayShift(): void
+	{
+		if (count($this->arr) === 0) {
+			throw new \Exception();
+		}
+		array_unshift($this->arr, array_shift($this->arr));
+		assertType('non-empty-array<int>', $this->arr);
+	}
+
+	public function testArrayPushWithArrayShift(): void
+	{
+		if (count($this->arr) === 0) {
+			throw new \Exception();
+		}
+		array_push($this->arr, array_shift($this->arr));
+		assertType('non-empty-array<int>', $this->arr);
+	}
+
+	public function testArraySplice(): void
+	{
+		if (count($this->arr) === 0) {
+			throw new \Exception();
+		}
+		array_splice($this->arr, 0, 0, [array_pop($this->arr)]);
+		assertType('non-empty-array<(int<0, max>|string), int>', $this->arr);
+	}
 }

tests/PHPStan/Rules/Properties/TypesAssignedToPropertiesRuleTest.php

@@ -1071,4 +1071,9 @@ public function testBug10749(): void
 		$this->analyse([__DIR__ . '/data/bug-10749.php'], []);
 	}
 
+	public function testBug13510(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-13510.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Properties/data/bug-13510.php

@@ -0,0 +1,29 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13510;
+
+class Foo {
+	/** @var array<int> */
+	public array $arr = [];
+
+	public function testArrayUnshift(): void {
+		if (count($this->arr) === 0) {
+			throw new \Exception('Narrow to non-empty-array');
+		}
+		array_unshift($this->arr, array_pop($this->arr));
+	}
+
+	public function testArrayPush(): void {
+		if (count($this->arr) === 0) {
+			throw new \Exception('Narrow to non-empty-array');
+		}
+		array_push($this->arr, array_pop($this->arr));
+	}
+
+	public function testArraySplice(): void {
+		if (count($this->arr) === 0) {
+			throw new \Exception('Narrow to non-empty-array');
+		}
+		array_splice($this->arr, 0, 0, [array_pop($this->arr)]);
+	}
+}