Keep optional keys of unsealed shapes in falsey isset() narrowing

Removing HasOffsetType('k') from an unsealed shape like
array{k?: string, ...} drops the explicit key, which re-admits it through
the unsealed extras with their (wider) value type - the "narrowed" type
array{...} is in fact wider. Merged back with the truthy branch it
collapsed the subject to plain array, e.g. after `$a['k'] ?? ''`.

Skip the optional-key removal when any union member is not sealed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: robotomarvin

src/Analyser/ExprHandler/Helper/DefaultNarrowingHelper.php

@@ -729,6 +729,7 @@ public function createIssetSingleSubjectNonTrueTypes(
 					$typesToRemove = [];
 					$hasOptionalNonNullableOffset = false;
 					$hasPossiblyNullOffsetValue = false;
+					$hasUnsealedOptionalOffset = false;
 					foreach ($constantArrays as $constantArray) {
 						$hasOffset = $constantArray->hasOffsetValueType($dimType);
 						if ($hasOffset->no()) {
@@ -744,13 +745,21 @@ public function createIssetSingleSubjectNonTrueTypes(
 							continue;
 						}
 
+						// Removing the key from an unsealed shape re-admits it through
+						// the unsealed extras, widening its value type instead.
+						if ($constantArray->isUnsealed()->yes()) {
+							$hasUnsealedOptionalOffset = true;
+							continue;
+						}
+
 						$hasOptionalNonNullableOffset = true;
 					}
 
 					// !isset() on an optional key with a non-nullable value means the
 					// key is absent - but only when no member can hold null at that
-					// offset (the removal distributes over every union member).
-					if ($hasOptionalNonNullableOffset && !$hasPossiblyNullOffsetValue) {
+					// offset and no member is unsealed (the removal distributes over
+					// every union member).
+					if ($hasOptionalNonNullableOffset && !$hasPossiblyNullOffsetValue && !$hasUnsealedOptionalOffset) {
 						$typesToRemove[] = new HasOffsetType($dimType);
 					}
 

tests/PHPStan/Analyser/Bug15428Test.php

@@ -0,0 +1,33 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Analyser;
+
+use PHPStan\Testing\TypeInferenceTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+/**
+ * Runs without bleedingEdge.neon, where a sealed PHPDoc shape carries no
+ * sealedness information and reports isUnsealed() as maybe.
+ */
+class Bug15428Test extends TypeInferenceTestCase
+{
+
+	public static function dataFileAsserts(): iterable
+	{
+		yield from self::gatherAssertTypes(__DIR__ . '/data/bug-15428.php');
+	}
+
+	/**
+	 * @param mixed ...$args
+	 */
+	#[DataProvider('dataFileAsserts')]
+	public function testFileAsserts(
+		string $assertType,
+		string $file,
+		...$args,
+	): void
+	{
+		$this->assertFileAsserts($assertType, $file, ...$args);
+	}
+
+}

tests/PHPStan/Analyser/data/bug-15428.php

@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace Bug15428Data;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param array{a?: string, ...} $c
+ */
+function unsealed(array $c): void
+{
+	$x = $c['a'] ?? '';
+	assertType('array{a?: string, ...}', $c);
+}
+
+/**
+ * @param array{a?: string} $c
+ */
+function sealed(array $c): void
+{
+	if (!isset($c['a'])) {
+		assertType('array{}', $c);
+	}
+}

tests/PHPStan/Analyser/nsrt/bug-15428.php

@@ -0,0 +1,48 @@
+<?php declare(strict_types = 1);
+
+namespace Bug15428;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param array{a?: string, ...} $c
+ */
+function repro(array &$c): void
+{
+	$x = $c['a'] ?? ''; // this causes $c to lose it's type
+	assertType('array{a?: string, ...}', $c);
+	$c['a'] = '1';
+}
+
+/**
+ * @param array{a?: string, ...} $c
+ */
+function ifIsset(array $c): void
+{
+	if (!isset($c['a'])) {
+		assertType('array{a?: string, ...}', $c);
+	}
+	assertType('array{a?: string, ...}', $c);
+}
+
+/**
+ * @param array{a?: string, ...<string, int>} $c
+ */
+function typedUnsealed(array $c): void
+{
+	if (!isset($c['a'])) {
+		assertType('array{a?: string, ...<string, int>}', $c);
+	}
+	assertType('array{a?: string, ...<string, int>}', $c);
+}
+
+/**
+ * @param array{a?: string} $c
+ */
+function sealed(array $c): void
+{
+	if (!isset($c['a'])) {
+		assertType('array{}', $c);
+	}
+	assertType('array{}|array{a: string}', $c);
+}

tests/PHPStan/Rules/Variables/IssetRuleWithoutBleedingEdgeTest.php

@@ -0,0 +1,47 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Rules\Variables;
+
+use PHPStan\Rules\Comparison\ConstantConditionInTraitHelper;
+use PHPStan\Rules\IssetCheck;
+use PHPStan\Rules\Properties\PropertyDescriptor;
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+
+/**
+ * Runs without bleedingEdge.neon, where a sealed PHPDoc shape carries no
+ * sealedness information and reports isUnsealed() as maybe.
+ *
+ * @extends RuleTestCase<IssetRule>
+ */
+class IssetRuleWithoutBleedingEdgeTest extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		return new IssetRule(
+			new IssetCheck(
+				new PropertyDescriptor(),
+				true,
+				true,
+			),
+			self::getContainer()->getByType(ConstantConditionInTraitHelper::class),
+		);
+	}
+
+	public function testBug15428(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-15428.php'], [
+			[
+				'Offset \'a\' on array{} in isset() does not exist.',
+				15,
+			],
+		]);
+	}
+
+	public static function getAdditionalConfigFiles(): array
+	{
+		return [];
+	}
+
+}

tests/PHPStan/Rules/Variables/data/bug-15428.php

@@ -0,0 +1,17 @@
+<?php declare(strict_types = 1);
+
+namespace Bug15428Rule;
+
+/**
+ * @param array{a?: string, ...} $c
+ * @param array{a?: string} $d
+ */
+function repro(array $c, array $d): void
+{
+	if (!isset($c['a'])) {
+		isset($c['a']);
+	}
+	if (!isset($d['a'])) {
+		isset($d['a']);
+	}
+}

turbo-ext/src/DefaultNarrowingHelper.cpp

@@ -1586,6 +1586,7 @@ class DefaultNarrowingHelper
 		zv::Arr typesToRemove = zv::Arr::empty();
 		bool hasOptionalNonNullableOffset = false;
 		bool hasPossiblyNullOffsetValue = false;
+		bool hasUnsealedOptionalOffset = false;
 		if (Z_TYPE_P(constantArrays.raw()) == IS_ARRAY) {
 			for (zv::ArrayEntry entry : zv::ArrRef(constantArrays.raw())) {
 				zval *constantArray = entry.value().deref().raw();
@@ -1607,14 +1608,24 @@ class DefaultNarrowingHelper
 					continue;
 				}
 
+				// Removing the key from an unsealed shape re-admits it through
+				// the unsealed extras, widening its value type instead.
+				zend_long isUnsealed = pt_type_op_trinary(Z_OBJ_P(constantArray), PT_OP_IS_UNSEALED, 0, NULL);
+				if (UNEXPECTED(isUnsealed < 0)) return zv::Val();
+				if (isUnsealed == PT_TRI_YES) {
+					hasUnsealedOptionalOffset = true;
+					continue;
+				}
+
 				hasOptionalNonNullableOffset = true;
 			}
 		}
 
 		// !isset() on an optional key with a non-nullable value means the
 		// key is absent - but only when no member can hold null at that
-		// offset (the removal distributes over every union member).
-		if (hasOptionalNonNullableOffset && !hasPossiblyNullOffsetValue) {
+		// offset and no member is unsealed (the removal distributes over
+		// every union member).
+		if (hasOptionalNonNullableOffset && !hasPossiblyNullOffsetValue && !hasUnsealedOptionalOffset) {
 			zval hasOffsetZv;
 			if (UNEXPECTED(!pt_has_offset_type_new(&hasOffsetZv, dimType.raw()))) return zv::Val();
 			typesToRemove.push(zv::Val::adopt(hasOffsetZv));