Fix phpstan/phpstan#14411: Incorrect type narrowing with dependent types

- In createConditionalExpressions(), type guards were created for variables
  whose branch types overlapped, allowing narrowing of one variable to
  incorrectly narrow a dependent variable from a different branch
- Added a disjointness check: a variable is only used as a type guard when
  its "our" branch type and "their" branch type don't overlap
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14411.php

Author: VincentLanglet

src/Analyser/MutatingScope.php

@@ -3580,6 +3580,13 @@ private function createConditionalExpressions(
 				continue;
 			}
 
+			if (
+				array_key_exists($exprString, $theirExpressionTypes)
+				&& !$holder->getType()->isSuperTypeOf($theirExpressionTypes[$exprString]->getType())->no()
+			) {
+				continue;
+			}
+
 			$typeGuards[$exprString] = $holder;
 		}
 

tests/PHPStan/Analyser/nsrt/bug-14411.php

@@ -0,0 +1,34 @@
+<?php // lint >= 8.0
+
+declare(strict_types = 1);
+
+namespace Bug14411;
+
+use function PHPStan\Testing\assertType;
+
+/** @phpstan-impure */
+function get_mixed(): mixed {
+	return random_int(0, 1) ? 'foo' : null;
+}
+
+/** @phpstan-impure */
+function get_optional_int(): ?int {
+	return random_int(0, 1) ? 42 : null;
+}
+
+function (): void {
+	$a = get_mixed();
+
+	if ($a !== null) {
+		$b = $a;
+	}
+	else {
+		$b = get_optional_int();
+	}
+	if ($b !== null) {
+		assertType('mixed', $a);
+		if ($a === null) {
+			echo 'this is absolutely possible';
+		}
+	}
+};