Track array value type overwrites in by-reference foreach without key variable

[phpstan-bot]

Summary

When iterating an array by reference without a key variable (foreach ($arr as &$v) { $v = X; }), PHPStan did not track that the array's element type was being overwritten. The same construct WITH a key variable (foreach ($arr as $k => &$v) { $v = X; }) already worked correctly.

This PR extends the post-loop array type rewrite mechanism in NodeScopeResolver to also handle the by-reference-without-key case.

Changes

• src/Analyser/NodeScopeResolver.php: Extended the foreach post-loop array type rewrite (around line 1293-1475) to handle $stmt->byRef && $stmt->keyVar === null:

  • Added $byRefWithoutKey flag detection
  • Extended initial scope collection to use OriginalForeachValueExpr (value was overwritten) instead of OriginalForeachKeyExpr (key was not modified)
  • Extended continue exit point handling with the same OriginalForeachValueExpr logic
  • Added a branch inside the rewrite block that reads the value variable's type directly (instead of reading from ArrayDimFetch($expr, $keyVar))
  • Relaxed the outer condition from $stmt->keyVar !== null to $stmt->keyVar !== null || $byRefWithoutKey

• Updated test assertions in existing files that were asserting the old imprecise behavior:

  • tests/PHPStan/Analyser/nsrt/overwritten-arrays.php — doFoo7: array<int, 1|string> → array<int, 1>
  • tests/PHPStan/Analyser/nsrt/bug-13809.php — foo(): list<mixed> → list<'foo'>, bar3(): list<mixed> → list<'foo'|'maybe'>, baz(): list<string> → list<'bar'>
  • tests/PHPStan/Analyser/nsrt/bug-14083.php — example(): list<string> → list<uppercase-string>
  • tests/PHPStan/Analyser/nsrt/bug-14084.php — example() and example2(): list<string> → list<uppercase-string>
  • tests/PHPStan/Rules/Variables/data/bug-14124.php — example3a(): list<string> → list<uppercase-string>
  • tests/PHPStan/Rules/Variables/data/bug-14124b.php — example3a(): list<list<string>> → list<list<uppercase-string>>

Root cause

The post-loop array type rewrite in NodeScopeResolver was gated on $stmt->keyVar !== null. This gate exists because the mechanism relies on:

1. Checking OriginalForeachKeyExpr to verify the key wasn't modified
2. Reading the type of $arr[$key] from the final scope to determine the new element type

Without a key variable, neither of these steps is possible. The fix adds a parallel mechanism for the by-reference case: it uses OriginalForeachValueExpr (already tracked for other purposes) to verify the value was overwritten, and reads the value variable's type directly instead of through an ArrayDimFetch.

Test

• tests/PHPStan/Analyser/nsrt/bug-1940.php: Comprehensive regression test covering:
  • Basic by-ref overwrite without key
  • Conditional overwrite (only some iterations)
  • Always overwritten via if/else branches
  • List types, string keys, non-empty arrays
  • Break (should NOT rewrite — not all elements visited)
  • Continue with full overwrite, continue with branch overwrites, continue with partial overwrite
  • Property as iteratee ($this->prop)
  • Function-based transformation (intval)
  • No overwrite at all (read-only loop)

Fixes phpstan/phpstan#1940

[VincentLanglet]

I don't understand how it's related to the fact it's "by ref without key" since the same issue exists when a key is used

foreach ($a as $k => &$testArray) {
	$testArray['two'] = 'two';
}

https://phpstan.org/r/b0dafda8-0a2f-4389-95c9-64a00039b0ff

[phpstan-bot]

I processed this review but have nothing to report.