Do not let conditional expression undo explicit type narrowing

When filterBySpecifiedTypes processes a condition like `$this->b !== null`,
it narrows the expression and then resolves conditional expression holders.
A CE chain could derive `$this->a = null` (from mutual exclusion) and then
use that to trigger a "remove $this->b from scope" CE, undoing the explicit
narrowing. This fix skips certainty-No CEs for expressions that were already
narrowed by the original type specifications.

Closes phpstan/phpstan#14645

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -3298,6 +3298,7 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 		}
 
 		$conditions = [];
+		$originallySpecifiedExprStrings = $specifiedExpressions;
 		$prevSpecifiedCount = -1;
 		while (count($specifiedExpressions) !== $prevSpecifiedCount) {
 			$prevSpecifiedCount = count($specifiedExpressions);
@@ -3308,6 +3309,12 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 
 				// Pass 1: Prefer exact matches
 				foreach ($conditionalExpressions as $conditionalExpression) {
+					if (
+						$conditionalExpression->getTypeHolder()->getCertainty()->no()
+						&& array_key_exists($conditionalExprString, $originallySpecifiedExprStrings)
+					) {
+						continue;
+					}
 					foreach ($conditionalExpression->getConditionExpressionTypeHolders() as $holderExprString => $conditionalTypeHolder) {
 						if (
 							!array_key_exists($holderExprString, $specifiedExpressions)

tests/PHPStan/Analyser/nsrt/bug-14645.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace Bug14645;
+
+use function PHPStan\Testing\assertType;
+
+final class C
+{
+	public function __construct(private ?self $a, private ?self $b)
+	{
+	}
+
+	public function check(): bool
+	{
+		if ($this->a !== null && $this->b !== null) {
+			throw new \LogicException();
+		}
+
+		if ($this->a !== null) {
+			$this->a->check();
+		}
+
+		if ($this->b !== null) {
+			assertType('Bug14645\C', $this->b);
+			$this->b->check();
+		}
+
+		return true;
+	}
+}
+
+final class VariableAnalog
+{
+	public function test(?\stdClass $a, ?\stdClass $b): void
+	{
+		if ($a !== null && $b !== null) {
+			throw new \LogicException();
+		}
+
+		if ($a !== null) {
+			echo $a->foo;
+		}
+
+		if ($b !== null) {
+			assertType('stdClass', $b);
+			echo $b->bar;
+		}
+	}
+}
+
+final class ReversedOrder
+{
+	public function __construct(private ?self $a, private ?self $b)
+	{
+	}
+
+	public function check(): bool
+	{
+		if ($this->a !== null && $this->b !== null) {
+			throw new \LogicException();
+		}
+
+		if ($this->b !== null) {
+			$this->b->check();
+		}
+
+		if ($this->a !== null) {
+			assertType('Bug14645\ReversedOrder', $this->a);
+			$this->a->check();
+		}
+
+		return true;
+	}
+}
+
+final class ThreeProperties
+{
+	public function __construct(
+		private ?self $a,
+		private ?self $b,
+		private ?self $c,
+	) {
+	}
+
+	public function check(): bool
+	{
+		if ($this->a !== null && $this->b !== null) {
+			throw new \LogicException();
+		}
+
+		if ($this->a !== null && $this->c !== null) {
+			throw new \LogicException();
+		}
+
+		if ($this->a !== null) {
+			$this->a->check();
+		}
+
+		if ($this->b !== null) {
+			assertType('Bug14645\ThreeProperties', $this->b);
+			$this->b->check();
+		}
+
+		if ($this->c !== null) {
+			assertType('Bug14645\ThreeProperties', $this->c);
+			$this->c->check();
+		}
+
+		return true;
+	}
+}