Require array_search()'s haystack argument before reading it (#6239)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: SanderMuller

src/Analyser/ExprHandler/AssignHandler.php

@@ -1912,7 +1912,7 @@ private function shouldKeepList(ArrayDimFetch $arrayDimFetch, Scope $scope, Type
 			$arrayDimFetch->dim instanceof Expr\FuncCall
 			&& $arrayDimFetch->dim->name instanceof Name
 			&& $arrayDimFetch->dim->name->toLowerString() === 'array_search'
-			&& count($arrayDimFetch->dim->getArgs()) >= 1
+			&& count($arrayDimFetch->dim->getArgs()) >= 2 // the haystack is the second argument
 			&& $this->isSameVariable($arrayDimFetch->var, $arrayDimFetch->dim->getArgs()[1]->value)
 		) {
 			return true;

tests/PHPStan/Analyser/nsrt/array-search-offset-argument-count.php

@@ -0,0 +1,24 @@
+<?php declare(strict_types = 1);
+
+namespace ArraySearchOffsetArgumentCount;
+
+use function PHPStan\Testing\assertType;
+
+function singleArgument(): void
+{
+	$list = [1, 2, 3];
+	// the haystack is array_search()'s second argument, so a call without one cannot be the
+	// list-preserving idiom - the call itself is reported as invalid
+	$list[array_search($list)] = 4;
+	assertType('array{1|4, 2|4, 3|4, ...<int<min, -1>|int<3, max>|string, 4>}', $list);
+}
+
+/**
+ * @param array{int, list<int>} $args
+ */
+function unpackedArguments(array $args): void
+{
+	$list = [1, 2, 3];
+	$list[array_search(...$args)] = 4;
+	assertType('array{1|4, 2|4, 3|4, ...<int<min, -1>|int<3, max>|string, 4>}', $list);
+}