Do not split a swapped negated-conjunction holder side into per-expression holders

When a `BooleanAnd` guard side is itself a plain conjunction (e.g.
`$a === null && $b === null`), the false-context holder narrowings are
re-derived by swapping the truthy sure/sureNot lists, landing in the
sureNot list. The negation those holders must encode is a disjunction
(`$a !== null || $b !== null`), which cannot be represented as
independent per-expression narrowings. Splitting it let each holder fire
on its own and over-narrow, dropping a reachable value.

Suppress holder creation only for that swapped sureNot multi-target case.
Genuine negated conjunctions (`!($x instanceof X && ...)`) assert every
conjunct true through the sure list and the `BooleanOr` true context
remain sound to split, so they are untouched.

Closes phpstan/phpstan#14780

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

src/Analyser/TypeSpecifier.php

@@ -758,10 +758,10 @@ public function specifyTypesInCondition(
 					$result = $result->setAlwaysOverwriteTypes();
 				}
 				return $result->setNewConditionalExpressionHolders($this->mergeConditionalHolders([
-					$this->processBooleanConditionalTypes($scope, $leftTypesForHolders, $rightTypesForHolders, false, $rightScope),
-					$this->processBooleanConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, false, $scope),
-					$this->processBooleanConditionalTypes($scope, $leftTypesForHolders, $rightTypesForHolders, true, $rightScope),
-					$this->processBooleanConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, true, $scope),
+					$this->processBooleanConditionalTypes($scope, $leftTypesForHolders, $rightTypesForHolders, false, true, $rightScope),
+					$this->processBooleanConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, false, true, $scope),
+					$this->processBooleanConditionalTypes($scope, $leftTypesForHolders, $rightTypesForHolders, true, true, $rightScope),
+					$this->processBooleanConditionalTypes($scope, $rightTypesForHolders, $leftTypesForHolders, true, true, $scope),
 				]))->setRootExpr($expr);
 			}
 
@@ -811,10 +811,10 @@ public function specifyTypesInCondition(
 					$result = $result->setAlwaysOverwriteTypes();
 				}
 				return $result->setNewConditionalExpressionHolders($this->mergeConditionalHolders([
-					$this->processBooleanConditionalTypes($scope, $leftTypes, $rightTypes, false, $rightScope),
-					$this->processBooleanConditionalTypes($scope, $rightTypes, $leftTypes, false, $scope),
-					$this->processBooleanConditionalTypes($scope, $leftTypes, $rightTypes, true, $rightScope),
-					$this->processBooleanConditionalTypes($scope, $rightTypes, $leftTypes, true, $scope),
+					$this->processBooleanConditionalTypes($scope, $leftTypes, $rightTypes, false, false, $rightScope),
+					$this->processBooleanConditionalTypes($scope, $rightTypes, $leftTypes, false, false, $scope),
+					$this->processBooleanConditionalTypes($scope, $leftTypes, $rightTypes, true, false, $rightScope),
+					$this->processBooleanConditionalTypes($scope, $rightTypes, $leftTypes, true, false, $scope),
 				]))->setRootExpr($expr);
 			}
 
@@ -2106,7 +2106,7 @@ private function mergeConditionalHolders(array $holderLists): array
 	/**
 	 * @return array<string, ConditionalExpressionHolder[]>
 	 */
-	private function processBooleanConditionalTypes(Scope $scope, SpecifiedTypes $conditionSpecifiedTypes, SpecifiedTypes $holderSpecifiedTypes, bool $holdersFromSureTypes, Scope $rightScope): array
+	private function processBooleanConditionalTypes(Scope $scope, SpecifiedTypes $conditionSpecifiedTypes, SpecifiedTypes $holderSpecifiedTypes, bool $holdersFromSureTypes, bool $holderSideIsNegated, Scope $rightScope): array
 	{
 		// The condition side asserts that its sub-expression evaluates truthy.
 		// When that sub-expression is itself a compound boolean (e.g. `$a && $b`),
@@ -2146,6 +2146,32 @@ private function processBooleanConditionalTypes(Scope $scope, SpecifiedTypes $co
 		if (count($conditionExpressionTypes) > 0) {
 			$holders = [];
 			$holderTypes = $holdersFromSureTypes ? $holderSpecifiedTypes->getSureTypes() : $holderSpecifiedTypes->getSureNotTypes();
+
+			// In the `BooleanAnd` false context a true condition implies the other
+			// side is false. When that other side is a plain conjunction
+			// (`$a === null && $b === null`), its false narrowing is empty, so the
+			// holder narrowings are re-derived by swapping the truthy sure/sureNot
+			// lists — landing in the sureNot list here. The implied negation is then a
+			// disjunction (`$a !== null || $b !== null`) that cannot be expressed as
+			// independent per-expression narrowings: splitting it into one holder per
+			// expression would let each fire on its own and over-narrow, so no holder
+			// is produced. A genuine negated conjunction (`!($a instanceof X && ...)`)
+			// instead asserts every conjunct true through the sure list, which is sound
+			// to split; likewise the `BooleanOr` true context. Only the swapped
+			// sureNot multi-target case is suppressed.
+			if ($holderSideIsNegated && !$holdersFromSureTypes) {
+				$trackableHolderCount = 0;
+				foreach ($holderTypes as [$holderExpr]) {
+					if (!$this->isTrackableExpression($holderExpr)) {
+						continue;
+					}
+					$trackableHolderCount++;
+				}
+				if ($trackableHolderCount > 1) {
+					return [];
+				}
+			}
+
 			foreach ($holderTypes as $exprString => [$expr, $type]) {
 				if (!$this->isTrackableExpression($expr)) {
 					continue;

tests/PHPStan/Analyser/nsrt/bug-14780.php

@@ -48,3 +48,22 @@ function fourConditions(bool $a, bool $b, ?int $expiration, ?int $auto): void
 		assertType('int|null', $auto);
 	}
 }
+
+function compoundHolderSide(?int $a, ?object $b, bool $mock): void
+{
+	// The guarded side `$a === null && $b === null` is itself a conjunction.
+	// Its negation `$a !== null || $b !== null` is a disjunction and must not be
+	// split into independent `$mock => $a !== null` / `$mock => $b !== null`
+	// holders that would each over-narrow.
+	if ($a === null && $b === null && !$mock) {
+		throw new \LogicException();
+	}
+
+	if ($mock) {
+		return;
+	}
+
+	// only (a !== null || b !== null) is known here
+	assertType('int|null', $a);
+	assertType('object|null', $b);
+}