Limit int ranges when narrowing arrays via count()

And guard against non-existent offsets

Author: herndlm

src/Analyser/TypeSpecifier.php

@@ -1105,6 +1105,8 @@ private function specifyTypesForCountFuncCall(
 			if (
 				$sizeType instanceof IntegerRangeType
 				&& $sizeType->getMin() !== null
+				&& $sizeType->getMin() <= ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT
+				&& ($sizeType->getMax() === null || $sizeType->getMax() - $sizeType->getMin() <= ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT)
 				&& (
 					$isList->yes()
 					|| $isConstantArray->yes() && $arrayType->getKeyType()->isSuperTypeOf(IntegerRangeType::fromInterval(0, $sizeType->getMin() - 1))->yes()
@@ -1114,11 +1116,19 @@ private function specifyTypesForCountFuncCall(
 				$valueTypesBuilder = ConstantArrayTypeBuilder::createEmpty();
 				for ($i = 0; $i < $sizeType->getMin(); $i++) {
 					$offsetType = new ConstantIntegerType($i);
+					$hasOffset = $arrayType->hasOffsetValueType($offsetType);
+					if ($hasOffset->no()) {
+						break;
+					}
 					$valueTypesBuilder->setOffsetValueType($offsetType, $arrayType->getOffsetValueType($offsetType));
 				}
 				if ($sizeType->getMax() !== null) {
 					for ($i = $sizeType->getMin(); $i < $sizeType->getMax(); $i++) {
 						$offsetType = new ConstantIntegerType($i);
+						$hasOffset = $arrayType->hasOffsetValueType($offsetType);
+						if ($hasOffset->no()) {
+							break;
+						}
 						$valueTypesBuilder->setOffsetValueType($offsetType, $arrayType->getOffsetValueType($offsetType), true);
 					}
 				} elseif ($arrayType->isConstantArray()->yes()) {

tests/PHPStan/Analyser/AnalyserIntegrationTest.php

@@ -1542,6 +1542,12 @@ public function testBug12159(): void
 		$this->assertNoErrors($errors);
 	}
 
+	public function testBug12787(): void
+	{
+		$errors = $this->runAnalyse(__DIR__ . '/data/bug-12787.php');
+		$this->assertNoErrors($errors);
+	}
+
 	/**
 	 * @param string[]|null $allAnalysedFiles
 	 * @return Error[]

tests/PHPStan/Analyser/data/bug-12787.php

@@ -0,0 +1,22 @@
+<?php declare(strict_types = 1);
+
+namespace Bug12787;
+
+class HelloWorld
+{
+	protected const MAX_COUNT = 100000000;
+
+	/**
+	 * @return string[]
+	 */
+	public function accumulate(): array
+	{
+		$items = [];
+
+		do {
+			$items[] = 'something';
+		} while (count($items) < self::MAX_COUNT);
+
+		return $items;
+	}
+}

tests/PHPStan/Analyser/nsrt/list-count.php

@@ -345,8 +345,10 @@ protected function testOptionalKeysInUnionArray($row): void
 	 * @param int<2, max> $twoOrMore
 	 * @param int<min, 3> $maxThree
 	 * @param int<10, 11> $tenOrEleven
+	 * @param int<3, 256> $inRangeLimit
+	 * @param int<3, 512> $overRangeLimit
 	 */
-	protected function testOptionalKeysInUnionListWithIntRange($row, $twoOrThree, $twoOrMore, int $maxThree, $tenOrEleven): void
+	protected function testOptionalKeysInUnionListWithIntRange($row, $twoOrThree, $twoOrMore, int $maxThree, $tenOrEleven, $inRangeLimit, $overRangeLimit): void
 	{
 		if (count($row) >= $twoOrThree) {
 			assertType('array{0: int, 1: string|null, 2?: int|null}', $row);
@@ -371,6 +373,18 @@ protected function testOptionalKeysInUnionListWithIntRange($row, $twoOrThree, $t
 		} else {
 			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
 		}
+
+		if (count($row) >= $inRangeLimit) {
+			assertType('array{0: int, 1: string|null, 2: int|null, 3?: float|null}', $row);
+		} else {
+			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
+		}
+
+		if (count($row) >= $overRangeLimit) {
+			assertType('list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
+		} else {
+			assertType('array{string}|list{0: int, 1?: string|null, 2?: int|null, 3?: float|null}', $row);
+		}
 	}
 
 	/**