fix array_splice with non-array replacement

src/Analyser/NodeScopeResolver.php

@@ -2010,7 +2010,8 @@ function (MutatingScope $scope) use ($expr, $nodeCallback, $context): Expression
 				$arrayArgType = $scope->getType($arrayArg);
 				$valueType = $arrayArgType->getIterableValueType();
 				if (count($expr->getArgs()) >= 4) {
-					$valueType = TypeCombinator::union($valueType, $scope->getType($expr->getArgs()[3]->value)->getIterableValueType());
+					$replacementType = $scope->getType($expr->getArgs()[3]->value)->toArray();
+					$valueType = TypeCombinator::union($valueType, $replacementType->getIterableValueType());
 				}
 				$scope = $scope->invalidateExpression($arrayArg)->assignExpression(
 					$arrayArg,

tests/PHPStan/Analyser/NodeScopeResolverTest.php

@@ -1288,6 +1288,7 @@ public function dataFileAsserts(): iterable
 		}
 
 		yield from $this->gatherAssertTypes(__DIR__ . '/data/gettype.php');
+		yield from $this->gatherAssertTypes(__DIR__ . '/data/array_splice.php');
 	}
 
 	/**

tests/PHPStan/Analyser/data/array_splice.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace ArraySplice;
+
+use function PHPStan\Testing\assertType;
+
+final class Foo
+{
+	/** @var bool */
+	public $abc = false;
+
+	/** @var string */
+	public $def = 'def';
+}
+
+/**
+ * @param array<int, int> $arr
+ * @return void
+ */
+function insertViaArraySplice(array $arr): void
+{
+	$brr = $arr;
+	array_splice($brr, 0, 0, 1);
+	assertType('array<int, int>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, [1]);
+	assertType('array<int, int>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, '');
+	assertType('array<int, \'\'|int>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, ['']);
+	assertType('array<int, \'\'|int>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, null);
+	assertType('array<int, int>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, [null]);
+	assertType('array<int, int|null>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, new Foo());
+	assertType('array<int, bool|int|string>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, [new \stdClass()]);
+	assertType('array<int, int|stdClass>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, false);
+	assertType('array<int, int|false>', $brr);
+
+	$brr = $arr;
+	array_splice($brr, 0, 0, [false]);
+	assertType('array<int, int|false>', $brr);
+}