Fix incorrect dependent type inference after repeated boolean checks

- Fixed conditional expression resolution in filterBySpecifiedTypes to intersect types
  instead of overwriting when multiple conditional expressions fire for the same target
- When two conditionals with the same guard produced different types (one more specific
  than the other), the less specific type could overwrite specifiedExpressions, causing
  cascading wrong matches that led to variables being incorrectly narrowed to *NEVER*
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14211.php

Closes phpstan/phpstan#14211

Author: staabm

src/Analyser/MutatingScope.php

@@ -3833,7 +3833,15 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 					}
 
 					$conditions[$conditionalExprString][] = $conditionalExpression;
-					$specifiedExpressions[$conditionalExprString] = $conditionalExpression->getTypeHolder();
+					$newTypeHolder = $conditionalExpression->getTypeHolder();
+					if (array_key_exists($conditionalExprString, $specifiedExpressions) && $specifiedExpressions[$conditionalExprString]->getCertainty()->yes() && $newTypeHolder->getCertainty()->yes()) {
+						$specifiedExpressions[$conditionalExprString] = ExpressionTypeHolder::createYes(
+							$newTypeHolder->getExpr(),
+							TypeCombinator::intersect($specifiedExpressions[$conditionalExprString]->getType(), $newTypeHolder->getType()),
+						);
+					} else {
+						$specifiedExpressions[$conditionalExprString] = $newTypeHolder;
+					}
 				}
 			}
 		}

tests/PHPStan/Analyser/nsrt/bug-14211.php

@@ -0,0 +1,25 @@
+<?php declare(strict_types=1);
+
+namespace Bug14211;
+
+use function PHPStan\Testing\assertType;
+
+/** @param array<mixed> $data */
+function doSomething(array $data): bool {
+
+	if (!isset($data['x']))
+		return false;
+
+	$m = isset($data['y']);
+
+	if ($m) {
+		assertType('true', $m);
+	}
+	assertType('bool', $m);
+
+	if ($m) {
+		assertType('true', $m);
+	}
+
+	return true;
+}