Fix phpstan/phpstan#12597: variable might not be defined after in_array check

- Added subtype matching for conditional expressions in MutatingScope::processSpecifiedTypes
- After exact-match conditional resolution, a second pass checks if specified types
  are subtypes of guard types for maybe-defined variables
- Limited to Variable targets with Maybe certainty to avoid interfering with type narrowing
- New regression test in tests/PHPStan/Rules/Variables/data/bug-12597.php

Author: VincentLanglet

src/Analyser/MutatingScope.php

@@ -3229,6 +3229,32 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 			}
 		}
 
+		foreach ($scope->conditionalExpressions as $conditionalExprString => $conditionalExpressions) {
+			if (array_key_exists($conditionalExprString, $conditions)) {
+				continue;
+			}
+			if (
+				!array_key_exists($conditionalExprString, $scope->expressionTypes)
+				|| $scope->expressionTypes[$conditionalExprString]->getCertainty()->yes()
+				|| !$scope->expressionTypes[$conditionalExprString]->getExpr() instanceof Variable
+			) {
+				continue;
+			}
+			foreach ($conditionalExpressions as $conditionalExpression) {
+				foreach ($conditionalExpression->getConditionExpressionTypeHolders() as $holderExprString => $conditionalTypeHolder) {
+					if (
+						!array_key_exists($holderExprString, $specifiedExpressions)
+						|| !$specifiedExpressions[$holderExprString]->getCertainty()->equals($conditionalTypeHolder->getCertainty())
+						|| !$conditionalTypeHolder->getType()->isSuperTypeOf($specifiedExpressions[$holderExprString]->getType())->yes()
+					) {
+						continue 2;
+					}
+				}
+
+				$conditions[$conditionalExprString][] = $conditionalExpression;
+			}
+		}
+
 		foreach ($conditions as $conditionalExprString => $expressions) {
 			$certainty = TrinaryLogic::lazyExtremeIdentity($expressions, static fn (ConditionalExpressionHolder $holder) => $holder->getTypeHolder()->getCertainty());
 			if ($certainty->no()) {

tests/PHPStan/Rules/Variables/DefinedVariableRuleTest.php

@@ -905,6 +905,15 @@ public function testBug8212(): void
 		$this->analyse([__DIR__ . '/data/bug-8212.php'], []);
 	}
 
+	public function testBug12597(): void
+	{
+		$this->cliArgumentsVariablesRegistered = true;
+		$this->polluteScopeWithLoopInitialAssignments = true;
+		$this->checkMaybeUndefinedVariables = true;
+		$this->polluteScopeWithAlwaysIterableForeach = true;
+		$this->analyse([__DIR__ . '/data/bug-12597.php'], []);
+	}
+
 	public function testBug4173(): void
 	{
 		$this->cliArgumentsVariablesRegistered = true;

tests/PHPStan/Rules/Variables/data/bug-12597.php

@@ -0,0 +1,22 @@
+<?php declare(strict_types = 1);
+
+namespace Bug12597;
+
+class HelloWorld
+{
+	private const TYPE_1 = 1;
+	private const TYPE_2 = 2;
+
+	public function test(int $type): void
+	{
+		if (in_array($type, [self::TYPE_1, self::TYPE_2], true)) {
+			$message = 'Hello!';
+		}
+
+		if ($type === self::TYPE_1) {
+			$this->message($message);
+		}
+	}
+
+	public function message(string $message): void {}
+}