Fix non-negative-int generalized to int in for loop

- Fixed overly aggressive type generalization in MutatingScope::generalizeType()
  for constant integers when values expand in both directions across loop iterations
- Instead of widening to plain `int`, now computes actual observed bounds, allowing
  the next iteration to correctly determine stable vs growing bounds
- New regression test in tests/PHPStan/Analyser/nsrt/bug-12163.php

Closes phpstan/phpstan#12163

Author: github-actions[bot]

src/Analyser/MutatingScope.php

@@ -4112,7 +4112,19 @@ private function generalizeType(Type $a, Type $b, int $depth): Type
 					}
 
 					if ($gotGreater && $gotSmaller) {
-						$resultTypes[] = new IntegerType();
+						$newMin = $min;
+						$newMax = $max;
+						foreach ($constantIntegers['b'] as $int) {
+							if ($int->getValue() < $newMin) {
+								$newMin = $int->getValue();
+							}
+							if ($int->getValue() <= $newMax) {
+								continue;
+							}
+
+							$newMax = $int->getValue();
+						}
+						$resultTypes[] = IntegerRangeType::fromInterval($newMin, $newMax);
 					} elseif ($gotGreater) {
 						$resultTypes[] = IntegerRangeType::fromInterval($min, null);
 					} elseif ($gotSmaller) {

tests/PHPStan/Analyser/nsrt/bug-12163.php

@@ -0,0 +1,27 @@
+<?php declare(strict_types = 1);
+
+namespace Bug12163;
+
+use function PHPStan\Testing\assertType;
+
+class Test
+{
+	public function iterateRowColumnIndices(int $rows, int $columns): void
+	{
+		if ($rows < 1 || $columns < 1) return;
+		$size = $rows * $columns;
+
+		$rowIndex = 0;
+		$columnIndex = 0;
+		for ($i = 0; $i < $size; $i++) {
+			assertType('int<0, max>', $rowIndex);
+			assertType('int<0, max>', $columnIndex);
+			if ($columnIndex < $columns) {
+				$columnIndex++;
+			} else {
+				$columnIndex = 0;
+				$rowIndex++;
+			}
+		}
+	}
+}