Use pre-args scope for value types in array_push/array_unshift to avoid false mutations from nested by-ref calls

Author: predictor2718

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -267,6 +267,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 			}
 		}
 
+		$scopeBeforeArgs = $scope;
 		$argsResult = $nodeScopeResolver->processArgs($stmt, $functionReflection, null, $parametersAcceptor, $normalizedExpr, $scope, $storage, $nodeCallbackForArgs, $context);
 		$scope = $argsResult->getScope();
 		$hasYield = $argsResult->hasYield();
@@ -395,8 +396,8 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				$stmt,
 				$arrayArg,
 				new NativeTypeExpr(
-					$this->getArrayFunctionAppendingType($functionReflection, $scope, $normalizedExpr),
-					$this->getArrayFunctionAppendingType($functionReflection, $scope->doNotTreatPhpDocTypesAsCertain(), $normalizedExpr),
+					$this->getArrayFunctionAppendingType($functionReflection, $scope, $scopeBeforeArgs, $normalizedExpr),
+					$this->getArrayFunctionAppendingType($functionReflection, $scope->doNotTreatPhpDocTypesAsCertain(), $scopeBeforeArgs->doNotTreatPhpDocTypesAsCertain(), $normalizedExpr),
 				),
 				$nodeCallback,
 			)->getScope();
@@ -621,7 +622,7 @@ private function getFunctionThrowPoint(
 		return null;
 	}
 
-	private function getArrayFunctionAppendingType(FunctionReflection $functionReflection, Scope $scope, FuncCall $expr): Type
+	private function getArrayFunctionAppendingType(FunctionReflection $functionReflection, Scope $scope, Scope $valuesScope, FuncCall $expr): Type
 	{
 		$arrayArg = $expr->getArgs()[0]->value;
 		$arrayType = $scope->getType($arrayArg);
@@ -667,7 +668,7 @@ private function getArrayFunctionAppendingType(FunctionReflection $functionRefle
 				$arrayTypeBuilder = $prepend ? ConstantArrayTypeBuilder::createEmpty() : ConstantArrayTypeBuilder::createFromConstantArray($constantArray);
 
 				$setOffsetValueTypes(
-					$scope,
+					$valuesScope,
 					$callArgs,
 					static function (?Type $offsetType, Type $valueType, bool $optional) use (&$arrayTypeBuilder): void {
 						$arrayTypeBuilder->setOffsetValueType($offsetType, $valueType, $optional);
@@ -707,7 +708,7 @@ static function (?Type $offsetType, Type $valueType, bool $optional) use (&$arra
 		}
 
 		$setOffsetValueTypes(
-			$scope,
+			$valuesScope,
 			$callArgs,
 			static function (?Type $offsetType, Type $valueType, bool $optional) use (&$arrayType): void {
 				$isIterableAtLeastOnce = $arrayType->isIterableAtLeastOnce()->yes() || !$optional;

tests/PHPStan/Analyser/nsrt/bug-13510.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Bug13510;
+
+use function PHPStan\Testing\assertType;
+
+final class Foo
+{
+
+	/** @param non-empty-list<int> $arr */
+	public function test(array $arr): void
+	{
+		array_unshift($arr, array_pop($arr));
+		assertType('non-empty-list<int>', $arr);
+	}
+
+	/** @param non-empty-list<int> $arr */
+	public function testTwoLines(array $arr): void
+	{
+		$popped = array_pop($arr);
+		array_unshift($arr, $popped);
+		assertType('non-empty-list<int>', $arr);
+	}
+
+}