Narrow regex subject to non-decimal-int-string in the non-matching branch of preg_match

src/Type/Php/PregMatchTypeSpecifyingExtension.php

@@ -13,7 +13,11 @@
 use PHPStan\DependencyInjection\AutowiredService;
 use PHPStan\Reflection\FunctionReflection;
 use PHPStan\TrinaryLogic;
+use PHPStan\Type\Accessory\AccessoryDecimalIntegerStringType;
 use PHPStan\Type\FunctionTypeSpecifyingExtension;
+use PHPStan\Type\IntersectionType;
+use PHPStan\Type\StringType;
+use PHPStan\Type\Type;
 use function in_array;
 use function strtolower;
 
@@ -54,18 +58,24 @@ public function specifyTypes(FunctionReflection $functionReflection, FuncCall $n
 		$subjectTypes = new SpecifiedTypes();
 		if (
 			$subjectArg !== null
-			&& $context->true()
+			&& ($context->true() || $context->false())
 			&& $scope->getType($subjectArg->value)->isString()->yes()
 			&& !$this->isSubExprOfMatchesArg($subjectArg->value, $matchesArg !== null ? $matchesArg->value : null)
 		) {
 			$subjectType = $this->regexShapeMatcher->matchSubjectExpr($patternArg->value, $scope);
 			if ($subjectType !== null) {
-				$subjectTypes = $this->typeSpecifier->create(
-					$subjectArg->value,
-					$subjectType,
-					$context,
-					$scope,
-				)->setRootExpr($node);
+				if ($context->false()) {
+					$subjectType = $this->negateSubjectType($subjectType);
+				}
+
+				if ($subjectType !== null) {
+					$subjectTypes = $this->typeSpecifier->create(
+						$subjectArg->value,
+						$subjectType,
+						$context->false() ? TypeSpecifierContext::createTrue() : $context,
+						$scope,
+					)->setRootExpr($node);
+				}
 			}
 		}
 
@@ -114,6 +124,22 @@ public function specifyTypes(FunctionReflection $functionReflection, FuncCall $n
 		return $types->unionWith($subjectTypes);
 	}
 
+	/**
+	 * Negates the type a subject is narrowed to when the pattern matches, for the
+	 * branch where the pattern does not match. The only string refinement with a
+	 * complement representable within `string` is decimal-int-string, whose
+	 * complement is non-decimal-int-string. Returns null when no narrowing applies.
+	 */
+	private function negateSubjectType(Type $subjectType): ?Type
+	{
+		$decimalIntString = new IntersectionType([new StringType(), new AccessoryDecimalIntegerStringType()]);
+		if ($subjectType->equals($decimalIntString)) {
+			return new IntersectionType([new StringType(), new AccessoryDecimalIntegerStringType(true)]);
+		}
+
+		return null;
+	}
+
 	private function isSubExprOfMatchesArg(Expr $subject, ?Expr $matchesVar): bool
 	{
 		if ($matchesVar === null) {

tests/PHPStan/Analyser/nsrt/bug-14766.php

@@ -0,0 +1,65 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14766;
+
+use function PHPStan\Testing\assertType;
+
+function pregMatchNonDecimalIntStringTypeSubject(string $x): void
+{
+	if (preg_match('/^-?[0-9]+$/', $x)) {
+		assertType('decimal-int-string', $x);
+	} else {
+		assertType('non-decimal-int-string', $x);
+	}
+}
+
+function negatedCondition(string $x): void
+{
+	if (!preg_match('/^[0-9]+$/', $x)) {
+		assertType('non-decimal-int-string', $x);
+	} else {
+		assertType('decimal-int-string', $x);
+	}
+}
+
+function earlyReturn(string $x): void
+{
+	if (preg_match('/^[0-9]+$/', $x)) {
+		return;
+	}
+
+	assertType('non-decimal-int-string', $x);
+}
+
+function withMatchesArg(string $x): void
+{
+	if (preg_match('/^([0-9]+)$/', $x, $matches)) {
+		assertType('decimal-int-string', $x);
+		assertType('array{decimal-int-string, decimal-int-string}', $matches);
+	} else {
+		assertType('non-decimal-int-string', $x);
+		assertType('array{}', $matches);
+	}
+}
+
+function unanchoredIsNotNarrowedInElse(string $x): void
+{
+	// an unanchored pattern only proves the subject contains a digit when it
+	// matches; not matching tells us nothing representable, so no narrowing
+	if (preg_match('/[0-9]/', $x)) {
+		assertType('non-empty-string', $x);
+	} else {
+		assertType('string', $x);
+	}
+}
+
+function nonEmptySubjectIsNotNarrowedInElse(string $x): void
+{
+	// the complement of non-empty-string within string is not representable,
+	// so the else branch keeps the original string type
+	if (preg_match('/^\S+$/', $x)) {
+		assertType('non-empty-string', $x);
+	} else {
+		assertType('string', $x);
+	}
+}