Fix spurious nullCoalesce.offset error after nested ?? with nullable types

- Fixed false positive where `$x[0] ?? null` was flagged as unnecessary after
  `$x[0]['bar'] ?? null` when the inner type was nullable (e.g. list<array<?string>>)
- Root cause: revertNonNullability used specifyExpressionType which recursively
  creates expression type holders for parent arrays as side effects, leaving
  spurious Yes-certainty expression types for intermediate array dim fetches
- Added sideEffectSave flag to EnsuredNonNullabilityResultExpression to distinguish
  target saves (null actually removed) from side-effect saves (type changed by
  recursive parent narrowing)
- After reverting, unset expression types for side-effect saves that didn't exist
  in the original scope
- Added unsetExpressionType method to MutatingScope
- New regression test in tests/PHPStan/Rules/Variables/data/bug-13921.php

Closes phpstan/phpstan#13921

Author: staabm

src/Analyser/EnsuredNonNullabilityResultExpression.php

@@ -14,6 +14,8 @@ public function __construct(
 		private Type $originalType,
 		private Type $originalNativeType,
 		private TrinaryLogic $certainty,
+		private bool $existedInOriginalScope = true,
+		private bool $sideEffectSave = false,
 	)
 	{
 	}
@@ -38,4 +40,14 @@ public function getCertainty(): TrinaryLogic
 		return $this->certainty;
 	}
 
+	public function existedInOriginalScope(): bool
+	{
+		return $this->existedInOriginalScope;
+	}
+
+	public function isSideEffectSave(): bool
+	{
+		return $this->sideEffectSave;
+	}
+
 }

src/Analyser/MutatingScope.php

@@ -3547,6 +3547,34 @@ public function specifyExpressionType(Expr $expr, Type $type, Type $nativeType,
 		return $scope;
 	}
 
+	public function unsetExpressionType(Expr $expr): self
+	{
+		$exprString = $this->getNodeKey($expr);
+		$expressionTypes = $this->expressionTypes;
+		$nativeTypes = $this->nativeExpressionTypes;
+		unset($expressionTypes[$exprString]);
+		unset($nativeTypes[$exprString]);
+
+		return $this->scopeFactory->create(
+			$this->context,
+			$this->isDeclareStrictTypes(),
+			$this->getFunction(),
+			$this->getNamespace(),
+			$expressionTypes,
+			$nativeTypes,
+			$this->conditionalExpressions,
+			$this->inClosureBindScopeClasses,
+			$this->anonymousFunctionReflection,
+			$this->inFirstLevelStatement,
+			$this->currentlyAssignedExpressions,
+			$this->currentlyAllowedUndefinedExpressions,
+			$this->inFunctionCallsStack,
+			$this->afterExtractCall,
+			$this->parentScope,
+			$this->nativeTypesPromoted,
+		);
+	}
+
 	public function assignExpression(Expr $expr, Type $type, Type $nativeType): self
 	{
 		$scope = $this;

src/Analyser/NodeScopeResolver.php

@@ -2473,7 +2473,8 @@ private function ensureShallowNonNullability(MutatingScope $scope, Scope $origin
 		// keep certainty
 		$certainty = TrinaryLogic::createYes();
 		$hasExpressionType = $originalScope->hasExpressionType($exprToSpecify);
-		if (!$hasExpressionType->no()) {
+		$existedInOriginalScope = !$hasExpressionType->no();
+		if ($existedInOriginalScope) {
 			$certainty = $hasExpressionType;
 		}
 
@@ -2484,7 +2485,7 @@ private function ensureShallowNonNullability(MutatingScope $scope, Scope $origin
 				$originalNativeType = $originalScope->getNativeType($exprToSpecify);
 
 				return new EnsuredNonNullabilityResult($scope, [
-					new EnsuredNonNullabilityResultExpression($exprToSpecify, $originalExprType, $originalNativeType, $certainty),
+					new EnsuredNonNullabilityResultExpression($exprToSpecify, $originalExprType, $originalNativeType, $certainty, $existedInOriginalScope, true),
 				]);
 			}
 			return new EnsuredNonNullabilityResult($scope, []);
@@ -2493,7 +2494,7 @@ private function ensureShallowNonNullability(MutatingScope $scope, Scope $origin
 		$nativeType = $scope->getNativeType($exprToSpecify);
 
 		$specifiedExpressions = [
-			new EnsuredNonNullabilityResultExpression($exprToSpecify, $exprType, $nativeType, $certainty),
+			new EnsuredNonNullabilityResultExpression($exprToSpecify, $exprType, $nativeType, $certainty, $existedInOriginalScope),
 		];
 
 		// When narrowing an ArrayDimFetch, specifyExpressionType also recursively
@@ -2503,14 +2504,17 @@ private function ensureShallowNonNullability(MutatingScope $scope, Scope $origin
 			$parentExpr = $exprToSpecify->var;
 			$parentCertainty = TrinaryLogic::createYes();
 			$hasParentExpressionType = $originalScope->hasExpressionType($parentExpr);
-			if (!$hasParentExpressionType->no()) {
+			$parentExistedInOriginalScope = !$hasParentExpressionType->no();
+			if ($parentExistedInOriginalScope) {
 				$parentCertainty = $hasParentExpressionType;
 			}
 			array_unshift($specifiedExpressions, new EnsuredNonNullabilityResultExpression(
 				$parentExpr,
 				$scope->getType($parentExpr),
 				$scope->getNativeType($parentExpr),
 				$parentCertainty,
+				$parentExistedInOriginalScope,
+				true,
 			));
 		}
 
@@ -2556,6 +2560,17 @@ private function revertNonNullability(MutatingScope $scope, array $specifiedExpr
 			);
 		}
 
+		// specifyExpressionType recursively narrows parent array types as a side effect,
+		// which can introduce expression type holders that didn't exist in the original scope.
+		// Clean up side-effect saves that shouldn't have expression types.
+		foreach ($specifiedExpressions as $specifiedExpressionResult) {
+			if (!$specifiedExpressionResult->isSideEffectSave() || $specifiedExpressionResult->existedInOriginalScope()) {
+				continue;
+			}
+
+			$scope = $scope->unsetExpressionType($specifiedExpressionResult->getExpression());
+		}
+
 		return $scope;
 	}
 

tests/PHPStan/Rules/Variables/NullCoalesceRuleTest.php

@@ -362,4 +362,9 @@ public function testBug14213(): void
 		]);
 	}
 
+	public function testBug13921(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-13921.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Variables/data/bug-13921.php

@@ -0,0 +1,9 @@
+<?php declare(strict_types = 1);
+
+namespace Bug13921;
+
+/** @param list<array<?string>> $x */
+function foo(array $x): void {
+	var_dump($x[0]['bar'] ?? null);
+	var_dump($x[0] ?? null);
+}