Fix array dim fetch type not reflecting narrowed variable key

- When an expression type holder exists for $arr[$var] (e.g. from array_key_exists),
  and $var is later narrowed (e.g. in a switch/case), recompute the offset value type
  using the narrowed variable type and use it if it's more specific
- New regression test in tests/PHPStan/Analyser/nsrt/bug-11705.php
- The root cause was that array_key_exists creates an expression type holder for
  $arr[$tag] based on the broad value type, which overrides fresh computation even
  after $tag is narrowed to a specific constant in a switch case

Closes phpstan/phpstan#11705

Author: github-actions[bot]

src/Analyser/MutatingScope.php

@@ -979,7 +979,20 @@ private function resolveType(string $exprString, Expr $node): Type
 			&& !$node instanceof Expr\ArrowFunction
 			&& $this->hasExpressionType($node)->yes()
 		) {
-			return $this->expressionTypes[$exprString]->getType();
+			$expressionType = $this->expressionTypes[$exprString]->getType();
+			if (
+				$node instanceof Expr\ArrayDimFetch
+				&& $node->dim instanceof Variable
+				&& $this->getType($node->var)->isArray()->yes()
+			) {
+				$dimType = $this->getType($node->dim);
+				$arrayType = $this->getType($node->var);
+				$computedType = $arrayType->getOffsetValueType($dimType);
+				if ($expressionType->isSuperTypeOf($computedType)->yes()) {
+					return $computedType;
+				}
+			}
+			return $expressionType;
 		}
 
 		if ($node instanceof AlwaysRememberedExpr) {

tests/PHPStan/Analyser/nsrt/bug-11705.php

@@ -0,0 +1,35 @@
+<?php declare(strict_types = 1);
+
+namespace Bug11705;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param array<string,string|array<int,string>> $theInput
+ * @phpstan-param array{'name':string,'owners':array<int,string>} $theInput
+ * @param array<int,string> $theTags
+ */
+function Example(array $theInput, array $theTags): void
+{
+	foreach ($theTags as $tag) {
+		if (!array_key_exists($tag, $theInput)) {
+			continue;
+		}
+		switch ($tag) {
+			case 'name':
+				assertType("'name'", $tag);
+				assertType('string', $theInput[$tag]);
+				echo $theInput['name'];
+				if ($tag === 'name') {
+					echo "Of course it is...";
+				}
+				// After the always-true if, $tag should still be 'name'
+				assertType("'name'", $tag);
+				assertType('string', $theInput[$tag]);
+				echo $theInput[$tag];
+				break;
+			default:
+				// fall out
+		}
+	}
+}