Do not map the sealed-never sentinel value type in ConstantArrayType::mapValueType

- In bleeding edge, a sealed constant array carries an `unsealed` descriptor of
  `[never, never]` (explicit never) meaning "no extra elements". `mapValueType`
  applied the callback to that sentinel value type, which for `array_map` (and the
  str_replace family, both routed through `mapValueType`) resolves the callback
  against a `never` argument and yields an `ErrorType`.
- The `ErrorType` was hidden inside the sealed array's unsealed slot, so
  `UnresolvableTypeHelper` (which traverses the whole type) reported false-positive
  `function.unresolvableReturnType` / `argument.unresolvableType` errors even though
  the visible inferred type was correct.
- Guard `mapValueType` to leave the unsealed sentinel untouched when the array is
  sealed (`isUnsealed()->no()`), only mapping the unsealed value type for genuinely
  (or maybe) unsealed arrays.
- Probed the sibling transforms `traverse` / `traverseSimultaneously`, nested
  `array_map`, `str_replace`, generic identity pass-through, array spread and `+`
  union: all leaks originate from the single `mapValueType` chokepoint and are fixed
  at the source; the sibling traversals only propagate types and never plant the
  `ErrorType`.

Author: staabm

src/Type/Constant/ConstantArrayType.php

@@ -3186,8 +3186,12 @@ public function mapValueType(callable $cb): Type
 			$newValueTypes[] = $cb($valueType);
 		}
 
-		$newUnsealed = $this->unsealed === null
-			? null
+		// A sealed array's unsealed value type is the explicit-never sentinel for
+		// "no extra elements". Mapping it through $cb would invent a bogus type for
+		// elements that cannot exist (e.g. an ErrorType from an enum property fetch
+		// on never), so leave the sentinel untouched.
+		$newUnsealed = $this->unsealed === null || $this->isUnsealed()->no()
+			? $this->unsealed
 			: [$this->unsealed[0], $cb($this->unsealed[1])];
 
 		return $this->recreate(

tests/PHPStan/Analyser/nsrt/bug-14844.php

@@ -0,0 +1,41 @@
+<?php // lint >= 8.1
+
+declare(strict_types = 1);
+
+namespace Bug14844;
+
+use function PHPStan\Testing\assertType;
+
+enum Someenum: string
+{
+	case FOO = 'foo';
+}
+
+/**
+ * @template TReturn
+ * @param callable(): TReturn $callable
+ * @return TReturn
+ */
+function doFoo(callable $callable)
+{
+	return $callable();
+}
+
+class A
+{
+
+	/**
+	 * @return array<string>
+	 */
+	public function doBar(): array
+	{
+		assertType("array{'foo'}", doFoo(
+			fn () => array_map(fn (Someenum $type) => $type->value, Someenum::cases()),
+		));
+
+		return doFoo(
+			fn () => array_map(fn (Someenum $type) => $type->value, Someenum::cases()),
+		);
+	}
+
+}

tests/PHPStan/Rules/Functions/Bug14844Test.php

@@ -0,0 +1,61 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Rules\Functions;
+
+use PHPStan\Rules\FunctionCallParametersCheck;
+use PHPStan\Rules\NullsafeCheck;
+use PHPStan\Rules\PhpDoc\UnresolvableTypeHelper;
+use PHPStan\Rules\Properties\PropertyReflectionFinder;
+use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleLevelHelper;
+use PHPStan\Testing\RuleTestCase;
+use PHPUnit\Framework\Attributes\RequiresPhp;
+
+/**
+ * @extends RuleTestCase<CallToFunctionParametersRule>
+ */
+class Bug14844Test extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		$broker = self::createReflectionProvider();
+		return new CallToFunctionParametersRule(
+			$broker,
+			new FunctionCallParametersCheck(
+				new RuleLevelHelper(
+					$broker,
+					checkNullables: true,
+					checkThisOnly: false,
+					checkUnionTypes: true,
+					checkExplicitMixed: true,
+					checkImplicitMixed: true,
+					checkBenevolentUnionTypes: false,
+					discoveringSymbolsTip: true,
+				),
+				new NullsafeCheck(),
+				new UnresolvableTypeHelper(),
+				new PropertyReflectionFinder(),
+				$broker,
+				checkArgumentTypes: true,
+				checkArgumentsPassedByReference: true,
+				checkExtraArguments: true,
+				checkMissingTypehints: true,
+			),
+		);
+	}
+
+	#[RequiresPhp('>= 8.1.0')]
+	public function testBug14844(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-14844.php'], []);
+	}
+
+	public static function getAdditionalConfigFiles(): array
+	{
+		return [
+			__DIR__ . '/../../../../conf/bleedingEdge.neon',
+		];
+	}
+
+}

tests/PHPStan/Rules/Functions/data/bug-14844.php

@@ -0,0 +1,35 @@
+<?php // lint >= 8.1
+
+declare(strict_types = 1);
+
+namespace Bug14844Rule;
+
+enum Someenum: string
+{
+	case FOO = 'foo';
+}
+
+/**
+ * @template TReturn
+ * @param callable(): TReturn $callable
+ * @return TReturn
+ */
+function doFoo(callable $callable)
+{
+	return $callable();
+}
+
+class A
+{
+
+	/**
+	 * @return array<string>
+	 */
+	public function doBar(): array
+	{
+		return doFoo(
+			fn () => array_map(fn (Someenum $type) => $type->value, Someenum::cases()),
+		);
+	}
+
+}