Fix param-out list type lost during nested array dim assignment

- Pass correctly computed valueToWrite type to VariableAssignNode instead of
  the assignedPropertyExpr expression tree which loses list types on nested
  array dimension assignments
- The assignedPropertyExpr uses setOffsetValueType for non-outermost dims,
  losing AccessoryArrayListType, while produceArrayDimFetchAssignValueToWrite
  correctly uses setExistingOffsetValueType via cross-paired dim fetch checks
- New regression test in tests/PHPStan/Rules/Variables/data/bug-14124.php

Closes phpstan/phpstan#14124

Author: staabm

src/Analyser/NodeScopeResolver.php

@@ -6297,7 +6297,7 @@ private function processAssignVar(
 
 			if ($varType->isArray()->yes() || !(new ObjectType(ArrayAccess::class))->isSuperTypeOf($varType)->yes()) {
 				if ($var instanceof Variable && is_string($var->name)) {
-					$this->callNodeCallback($nodeCallback, new VariableAssignNode($var, $assignedPropertyExpr), $scopeBeforeAssignEval, $storage);
+					$this->callNodeCallback($nodeCallback, new VariableAssignNode($var, new TypeExpr($valueToWrite)), $scopeBeforeAssignEval, $storage);
 					$scope = $scope->assignVariable($var->name, $valueToWrite, $nativeValueToWrite, TrinaryLogic::createYes());
 				} else {
 					if ($var instanceof PropertyFetch || $var instanceof StaticPropertyFetch) {
@@ -6314,7 +6314,7 @@ private function processAssignVar(
 				}
 			} else {
 				if ($var instanceof Variable) {
-					$this->callNodeCallback($nodeCallback, new VariableAssignNode($var, $assignedPropertyExpr), $scopeBeforeAssignEval, $storage);
+					$this->callNodeCallback($nodeCallback, new VariableAssignNode($var, new TypeExpr($valueToWrite)), $scopeBeforeAssignEval, $storage);
 				} elseif ($var instanceof PropertyFetch || $var instanceof StaticPropertyFetch) {
 					$this->callNodeCallback($nodeCallback, new PropertyAssignNode($var, $assignedPropertyExpr, $isAssignOp), $scopeBeforeAssignEval, $storage);
 					if ($var instanceof PropertyFetch && $var->name instanceof Node\Identifier && !$isAssignOp) {

tests/PHPStan/Rules/Variables/ParameterOutAssignedTypeRuleTest.php

@@ -81,4 +81,9 @@ public function testBug12754(): void
 		$this->analyse([__DIR__ . '/data/bug-12754.php'], []);
 	}
 
+	public function testBug14124(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-14124.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Variables/data/bug-14124.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Bug14124;
+
+/**
+ * @param array<string, list<string>> $convert
+ * @param-out array<string, list<string>> $convert
+ */
+function example3a(array &$convert): void
+{
+	foreach ($convert as &$inner) {
+		foreach ($inner as &$val) {
+			$val = strtoupper($val);
+		}
+	}
+}
+
+/**
+ * @param array<string, list<string>> $convert
+ * @param-out array<string, list<string>> $convert
+ */
+function example3b(array &$convert): void
+{
+	foreach ($convert as $outerKey => $inner) {
+		foreach ($inner as $key => $val) {
+			$convert[$outerKey][$key] = strtoupper($val);
+		}
+	}
+}