Fix broken type narrowing with larger union types

Author: ondrejmirtes

src/Analyser/MutatingScope.php

@@ -3076,9 +3076,9 @@ private function setExpressionCertainty(Expr $expr, TrinaryLogic $certainty): se
 	}
 
 	/**
-	 * Returns true when the type is a large union with non-trivial
-	 * (IntersectionType) members — a sign of HasOffsetValueType
-	 * combinatorial growth from array|object offset access patterns.
+	 * Returns true when the type is a large union with intersection
+	 * members that carry HasOffsetValueType — a sign of combinatorial
+	 * growth from successive array|object offset access patterns.
 	 * Operating on such types is expensive and should be skipped.
 	 */
 	private function isComplexUnionType(Type $type): bool
@@ -3091,8 +3091,13 @@ private function isComplexUnionType(Type $type): bool
 			return false;
 		}
 		foreach ($types as $member) {
-			if ($member instanceof IntersectionType) {
-				return true;
+			if (!$member instanceof IntersectionType) {
+				continue;
+			}
+			foreach ($member->getTypes() as $innerType) {
+				if ($innerType instanceof HasOffsetValueType) {
+					return true;
+				}
 			}
 		}
 		return false;

tests/PHPStan/Analyser/nsrt/bug-14484.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Bug14484;
+
+use function PHPStan\Testing\assertType;
+
+class A {}
+class B {}
+class C {}
+class D {}
+
+class Bug
+{
+	/**
+	 * @return int|bool|string|A|B|C|D|list<A>|null
+	 */
+	public function getValue(): mixed
+	{
+		return null;
+	}
+
+	public function test(): void
+	{
+		$value = $this->getValue();
+		if (!is_string($value)) {
+			return;
+		}
+		assertType('string', $value);
+	}
+
+}
+
+class Bug2
+{
+	/**
+	 * @return int|bool|string|A|B|C|D|list<A>|null
+	 */
+	public function getValue(): mixed
+	{
+		return null;
+	}
+
+	public function testInstanceof(): void
+	{
+		$value = $this->getValue();
+		if (!($value instanceof A)) {
+			return;
+		}
+		// Expected: narrowed to A
+		// Actual in 2.1.49: entire union reported (narrowing lost)
+		assertType(A::class, $value);
+	}
+
+	public function testIfElseifInstanceof(): void
+	{
+		$value = $this->getValue();
+		if ($value === null) {
+			return;
+		}
+		if ($value instanceof A) {
+			assertType(A::class, $value);
+		} elseif ($value instanceof B) {
+			assertType(B::class, $value);
+		} elseif (is_array($value)) {
+			assertType('list<Bug14484\\A>', $value);
+		} elseif (is_string($value)) {
+			assertType('string', $value);
+		}
+	}
+}