Narrow array dim fetch types after isset+type guard in BooleanAnd falsey context

After `if (isset($array['key']) && !is_string($array['key'])) { throw; }`,
PHPStan now correctly narrows `$array['key'] ?? ''` to `string` instead of
`mixed|string`. The fix creates ConditionalExpressionHolders in the BooleanAnd
falsey handler that fire when the isset condition is later confirmed (e.g.,
during coalesce evaluation).

Closes phpstan/phpstan#6202

Author: VincentLanglet

src/Analyser/TypeSpecifier.php

@@ -750,6 +750,8 @@ public function specifyTypesInCondition(
 					$this->processBooleanNotSureConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, $scope),
 					$this->processBooleanSureConditionalTypes($scope, $leftTypesForHolders, $rightTypesForHolders, $rightScope),
 					$this->processBooleanSureConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, $scope),
+					$this->processBooleanTruthyConditionalTypes($scope, $expr->left, $leftTypesForHolders, $rightTypesForHolders, $rightScope),
+					$this->processBooleanTruthyConditionalTypes($scope, $expr->right, $rightTypesForHolders, $leftTypesForHolders, $scope),
 				))->setRootExpr($expr);
 			}
 
@@ -1115,6 +1117,7 @@ public function specifyTypesInCondition(
 							}
 						}
 					}
+
 				}
 
 				return new SpecifiedTypes();
@@ -2211,6 +2214,81 @@ private function processBooleanSureConditionalTypes(Scope $scope, SpecifiedTypes
 		return [];
 	}
 
+	/**
+	 * @return array<string, ConditionalExpressionHolder[]>
+	 */
+	private function processBooleanTruthyConditionalTypes(Scope $scope, Expr $leftExpr, SpecifiedTypes $leftFalseyTypes, SpecifiedTypes $rightFalseyTypes, Scope $rightScope): array
+	{
+		if ($leftFalseyTypes->getSureTypes() !== [] || $leftFalseyTypes->getSureNotTypes() !== []) {
+			return [];
+		}
+
+		$leftTruthyTypes = $this->specifyTypesInCondition($scope, $leftExpr, TypeSpecifierContext::createTrue());
+
+		$conditionExpressionTypes = [];
+		foreach ($leftTruthyTypes->getSureNotTypes() as $exprString => [$expr, $type]) {
+			if (!$this->isTrackableExpression($expr)) {
+				continue;
+			}
+
+			$scopeType = $scope->getType($expr);
+			$conditionType = TypeCombinator::remove($scopeType, $type);
+			if ($scopeType->equals($conditionType)) {
+				continue;
+			}
+
+			$conditionExpressionTypes[$exprString] = ExpressionTypeHolder::createYes(
+				$expr,
+				$conditionType,
+			);
+		}
+
+		foreach ($leftTruthyTypes->getSureTypes() as $exprString => [$expr, $type]) {
+			if (!$this->isTrackableExpression($expr)) {
+				continue;
+			}
+
+			if (isset($conditionExpressionTypes[$exprString])) {
+				continue;
+			}
+
+			$scopeType = $scope->getType($expr);
+			$conditionType = TypeCombinator::intersect($scopeType, $type);
+			if ($scopeType->equals($conditionType)) {
+				continue;
+			}
+
+			$conditionExpressionTypes[$exprString] = ExpressionTypeHolder::createYes(
+				$expr,
+				$conditionType,
+			);
+		}
+
+		if ($conditionExpressionTypes === []) {
+			return [];
+		}
+
+		$holders = [];
+		foreach ($rightFalseyTypes->getSureTypes() as $exprString => [$expr, $type]) {
+			if (!$this->isTrackableExpression($expr)) {
+				continue;
+			}
+
+			if (!isset($holders[$exprString])) {
+				$holders[$exprString] = [];
+			}
+
+			$targetScope = $expr instanceof Expr\Variable ? $scope : $rightScope;
+			$holder = new ConditionalExpressionHolder(
+				$conditionExpressionTypes,
+				ExpressionTypeHolder::createYes($expr, TypeCombinator::intersect($targetScope->getType($expr), $type)),
+			);
+			$holders[$exprString][$holder->getKey()] = $holder;
+		}
+
+		return $holders;
+	}
+
 	private function isTrackableExpression(Expr $expr): bool
 	{
 		if ($expr instanceof Expr\Variable) {

tests/PHPStan/Analyser/nsrt/bug-6202.php

@@ -0,0 +1,94 @@
+<?php declare(strict_types = 1);
+
+namespace Bug6202;
+
+use Exception;
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/**
+	 * @param array<string,mixed> $array
+	 */
+	public function sayHello(array $array): void
+	{
+		if (isset($array['mightExist']) && !is_string($array['mightExist'])) {
+			throw new Exception('Has to be string if set');
+		}
+
+		assertType('string', $array['mightExist'] ?? '');
+
+		if (!isset($array['hasToExist']) || !is_string($array['hasToExist'])) {
+			throw new Exception('Has to exist as string');
+		}
+		assertType('string', $array['hasToExist']);
+	}
+
+	/**
+	 * @param array<string, mixed> $array
+	 */
+	public function otherIsTypeFunctions(array $array): void
+	{
+		if (isset($array['intKey']) && !is_int($array['intKey'])) {
+			throw new Exception();
+		}
+		assertType('int', $array['intKey'] ?? 0);
+
+		if (isset($array['arrayKey']) && !is_array($array['arrayKey'])) {
+			throw new Exception();
+		}
+		assertType('array<mixed>', $array['arrayKey'] ?? []);
+
+		if (isset($array['boolKey']) && !is_bool($array['boolKey'])) {
+			throw new Exception();
+		}
+		assertType('bool', $array['boolKey'] ?? false);
+	}
+
+	/**
+	 * @param array<string, mixed> $array
+	 */
+	public function orPattern(array $array): void
+	{
+		if (!isset($array['key']) || !is_string($array['key'])) {
+			throw new Exception();
+		}
+		assertType('string', $array['key']);
+	}
+
+	/**
+	 * @param array<string, mixed> $array
+	 */
+	public function instanceofCheck(array $array): void
+	{
+		if (isset($array['obj']) && !$array['obj'] instanceof \stdClass) {
+			throw new Exception();
+		}
+		assertType('stdClass', $array['obj'] ?? new \stdClass());
+	}
+
+	/**
+	 * @param array<string, mixed> $array
+	 */
+	public function nestedArrayDimFetch(array $array): void
+	{
+		if (isset($array['nested']['key']) && !is_string($array['nested']['key'])) {
+			throw new Exception();
+		}
+		assertType('string', $array['nested']['key'] ?? '');
+	}
+
+	/**
+	 * @param array<string, mixed> $array
+	 */
+	public function directAccessAfterGuard(array $array): void
+	{
+		if (isset($array['mightExist']) && !is_string($array['mightExist'])) {
+			throw new Exception();
+		}
+
+		if (isset($array['mightExist'])) {
+			assertType('string', $array['mightExist']);
+		}
+	}
+}