Fix isset() falsey branch not narrowing array type for dim fetches

- In the falsey branch of isset($a['key']), narrow the array variable by removing union members where the key is definitely present with a non-null value
- Preserve variable certainty when the array variable might not be defined (using IssetExpr to restore maybe certainty)
- Update tagged-unions test expectation to reflect improved narrowing precision
- New regression test in tests/PHPStan/Analyser/nsrt/bug-9908.php

Closes phpstan/phpstan#9908

Author: phpstan-bot

phpstan-baseline.neon

@@ -87,7 +87,7 @@ parameters:
 		-
 			rawMessage: 'Doing instanceof PHPStan\Type\Constant\ConstantStringType is error-prone and deprecated. Use Type::getConstantStrings() instead.'
 			identifier: phpstanApi.instanceofType
-			count: 4
+			count: 5
 			path: src/Analyser/TypeSpecifier.php
 
 		-

src/Analyser/TypeSpecifier.php

@@ -920,6 +920,52 @@ public function specifyTypesInCondition(
 					return $exprType;
 				}
 
+				if (
+					$issetExpr instanceof ArrayDimFetch
+					&& $issetExpr->dim !== null
+				) {
+					$varType = $scope->getType($issetExpr->var);
+					if (!$varType instanceof MixedType) {
+						$dimType = $scope->getType($issetExpr->dim);
+
+						if ($dimType instanceof ConstantIntegerType || $dimType instanceof ConstantStringType) {
+							$types = $varType instanceof UnionType ? $varType->getTypes() : [$varType];
+							$typesToRemove = [];
+							foreach ($types as $innerType) {
+								$hasOffset = $innerType->hasOffsetValueType($dimType);
+								if (!$hasOffset->yes() || !$innerType->getOffsetValueType($dimType)->isNull()->no()) {
+									continue;
+								}
+
+								$typesToRemove[] = $innerType;
+							}
+
+							if ($typesToRemove !== []) {
+								$typeToRemove = TypeCombinator::union(...$typesToRemove);
+								$result = $this->create(
+									$issetExpr->var,
+									$typeToRemove,
+									TypeSpecifierContext::createFalse(),
+									$scope,
+								)->setRootExpr($expr);
+
+								if ($scope->hasExpressionType($issetExpr->var)->maybe()) {
+									$result = $result->unionWith(
+										$this->create(
+											new IssetExpr($issetExpr->var),
+											new NullType(),
+											TypeSpecifierContext::createTruthy(),
+											$scope,
+										)->setRootExpr($expr),
+									);
+								}
+
+								return $result;
+							}
+						}
+					}
+				}
+
 				return new SpecifiedTypes();
 			}
 

tests/PHPStan/Analyser/nsrt/bug-9908.php

@@ -0,0 +1,44 @@
+<?php declare(strict_types = 1);
+
+namespace Bug9908;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	public function test(): void
+	{
+		$a = [];
+		if (rand() % 2) {
+			$a = ['bar' => 'string'];
+		}
+
+		if (isset($a['bar'])) {
+			$a['bar'] = 1;
+		}
+
+		assertType("array{}|array{bar: 1}", $a);
+	}
+
+	/**
+	 * @param array{bar?: int} $foo
+	 */
+	public function sayHello(array $foo): void
+	{
+		echo 'Hello' . print_r($foo, true);
+	}
+
+	public function test2(): void
+	{
+		$a = [];
+		if (rand() % 2) {
+			$a = ['bar' => 'string'];
+		}
+
+		if (isset($a['bar'])) {
+			$a['bar'] = 1;
+		}
+
+		$this->sayHello($a);
+	}
+}

tests/PHPStan/Analyser/nsrt/tagged-unions.php

@@ -55,7 +55,7 @@ public function doFoo4(array $foo)
 		if (isset($foo['C'])) {
 			assertType("array{A: string, C: 1}", $foo);
 		} else {
-			assertType("array{A: int, B: 1}|array{A: string, C: 1}", $foo); // could be array{A: int, B: 1}
+			assertType("array{A: int, B: 1}", $foo);
 		}
 
 		assertType('array{A: int, B: 1}|array{A: string, C: 1}', $foo);