Fix phpstan/phpstan#4560: Unexpected array shape error

src/Analyser/MutatingScope.php

@@ -3072,15 +3072,57 @@
 
 		if ($originalExprType->equals($nativeType)) {
 			$newType = TypeCombinator::intersect($type, $originalExprType);
-			return $this->specifyExpressionType($expr, $newType, $newType, TrinaryLogic::createYes());
+			$scope = $this->specifyExpressionType($expr, $newType, $newType, TrinaryLogic::createYes());
+		} else {
+			$newType = TypeCombinator::intersect($type, $originalExprType);
+			$scope = $this->specifyExpressionType(
+				$expr,
+				$newType,
+				TypeCombinator::intersect($type, $nativeType),
+				TrinaryLogic::createYes(),
+			);
 		}
 
-		return $this->specifyExpressionType(
-			$expr,
-			TypeCombinator::intersect($type, $originalExprType),
-			TypeCombinator::intersect($type, $nativeType),
-			TrinaryLogic::createYes(),
-		);
+		if ($originalExprType instanceof MixedType && $newType->isArray()->yes()) {
+			$exprKey = $this->getNodeKey($expr);
+			foreach ($this->expressionTypes as $holder) {
+				$holderExpr = $holder->getExpr();
+				if (!$holderExpr instanceof Node\Expr\ArrayDimFetch || $holderExpr->dim === null) {
+					continue;
+				}
+				if ($this->getNodeKey($holderExpr->var) !== $exprKey) {
+					continue;
+				}
+				if (!$holder->getCertainty()->yes()) {
+					continue;
+				}
+				$dimType = $scope->getType($holderExpr->dim)->toArrayKey();
+				$constantStrings = $dimType->getConstantStrings();
+				$offsetKey = null;
+				if (count($constantStrings) === 1) {
+					$offsetKey = $constantStrings[0];
+				} elseif ($dimType instanceof ConstantIntegerType) {
+					$offsetKey = $dimType;
+				}
+				if ($offsetKey === null) {
+					continue;
+				}
+
+				$currentType = $scope->getType($expr);
+				$enrichedType = TypeCombinator::intersect(
+					$currentType,
+					new HasOffsetValueType($offsetKey, $holder->getType()),
+				);
+				$scope = $scope->specifyExpressionType(
+					$expr,
+					$enrichedType,
+					$scope->getNativeType($expr),
+					TrinaryLogic::createYes(),
+				);
+			}
+		}
+
+		return $scope;
 	}
 
 	public function removeTypeFromExpression(Expr $expr, Type $typeToRemove): self

tests/PHPStan/Analyser/nsrt/bug-4560.php

@@ -0,0 +1,32 @@
+<?php declare(strict_types = 1);
+
+namespace Bug4560;
+
+use function PHPStan\Testing\assertType;
+
+final class ResetPasswordForm
+{
+	/**
+	 * @param array{token: string, password: string, email: string} $data
+	 */
+	public static function fromArray(array $data): self
+	{
+		return new self();
+	}
+}
+
+class HelloWorld
+{
+	public function sayHello(): void
+	{
+		if (!empty($_POST['resetPassword'])) {
+			$data = $_POST['resetPassword'];
+			$data['token'] = $_POST['token'];
+
+			assert(array_key_exists('password', $data));
+			assert(array_key_exists('email', $data));
+
+			assertType("non-empty-array&hasOffset('email')&hasOffset('password')&hasOffsetValue('token', mixed)", $data);
+		}
+	}
+}