Fix phpstan/phpstan#11565: Conditional return type takes wrong branch when variable is reassigned

- When processing `$items = iteratorToList($items)` as a statement, the TypeSpecifier
  evaluated the conditional return type using the post-assignment scope where `$items`
  was already `list<string>`, causing the condition `$iterable is list` to be true
  and the return type to resolve to `never`
- Added `removeExpr` method to SpecifiedTypes to filter out entries by expression key
- In TypeSpecifier, when processing an Assign in null context, remove specifiedTypes
  that target the assigned variable to prevent the post-assignment type from being
  incorrectly narrowed by the conditional return type evaluation
- New regression test in tests/PHPStan/Analyser/nsrt/bug-11565.php

Author: github-actions[bot]

src/Analyser/SpecifiedTypes.php

@@ -119,6 +119,21 @@ public function getRootExpr(): ?Expr
 		return $this->rootExpr;
 	}
 
+	public function removeExpr(string $exprString): self
+	{
+		$sureTypes = $this->sureTypes;
+		$sureNotTypes = $this->sureNotTypes;
+		unset($sureTypes[$exprString]);
+		unset($sureNotTypes[$exprString]);
+
+		$self = new self($sureTypes, $sureNotTypes);
+		$self->overwrite = $this->overwrite;
+		$self->newConditionalExpressionHolders = $this->newConditionalExpressionHolders;
+		$self->rootExpr = $this->rootExpr;
+
+		return $self;
+	}
+
 	/** @api */
 	public function intersectWith(SpecifiedTypes $other): self
 	{

src/Analyser/TypeSpecifier.php

@@ -788,6 +788,9 @@ public function specifyTypesInCondition(
 
 			if ($context->null()) {
 				$specifiedTypes = $this->specifyTypesInCondition($scope->exitFirstLevelStatements(), $expr->expr, $context)->setRootExpr($expr);
+				if ($expr->var instanceof Expr\Variable && is_string($expr->var->name)) {
+					$specifiedTypes = $specifiedTypes->removeExpr('$' . $expr->var->name);
+				}
 			} else {
 				$specifiedTypes = $this->specifyTypesInCondition($scope->exitFirstLevelStatements(), $expr->var, $context)->setRootExpr($expr);
 			}

tests/PHPStan/Analyser/nsrt/bug-11565.php

@@ -0,0 +1,36 @@
+<?php declare(strict_types = 1);
+
+namespace Bug11565;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @template T
+ * @param iterable<mixed, T> $iterable
+ * @return ($iterable is list ? never : list<T>)
+ */
+function iteratorToList(iterable $iterable): array {
+	$list = [];
+	foreach ($iterable as $item) {
+		$list[] = $item;
+	}
+	return $list;
+}
+
+/**
+ * @return iterable<string, string>
+ */
+function getItems(): iterable {
+	yield 'a' => 'foo';
+	yield 'b' => 'bar';
+}
+
+// Bug: when reassigning to the same variable, conditional return type resolves incorrectly
+$items = getItems();
+$items = iteratorToList($items);
+assertType('list<string>', $items);
+
+// Works fine when using a different variable
+$x = getItems();
+$items2 = iteratorToList($x);
+assertType('list<string>', $items2);