Skip boolean conditional holders whose target was dropped as a no-op antecedent narrowing

[phpstan-bot]

Summary

When a guard such as if ($a === $b && $a !== "" && $b !== "") { return; } was
followed by an (even empty) sibling if ($a !== "") {} block, PHPStan later
narrowed $a to '' and reported a bogus "Strict comparison using !== between
'' and '' will always evaluate to false". The narrowing was unsound: $a and
$b can each be any distinct non-empty string in the else branch.

The fix makes the boolean conditional-expression holder mechanism refuse to build
a holder whose consequent targets an expression that only entered the antecedent
through a relation it cannot represent.

Changes

• src/Analyser/ExprHandler/Helper/ConditionalExpressionHolderHelper.php:
  • processBooleanConditionalTypes() now records every condition-side expression
    whose narrowing is a no-op and therefore gets dropped from the antecedent
    ($droppedNoOpConditions).
  • When projecting consequents, it skips any holder target that was dropped as a
    no-op condition, since the antecedent no longer constrains that target.
• tests/PHPStan/Analyser/nsrt/bug-14891.php: regression test covering the
  reported === case plus the analogous cases fixed by the same change.

Root cause

The holder mechanism turns !(Left && Right) into implications like
"if Left is true then Right is false". The antecedent is built from type
narrowings of the operands. A relation like $a === $b between two variables of
the same broad type (string) narrows nothing, so it is a no-op and gets dropped
(this drop was already done by #5951). Dropping it leaves an antecedent that is
strictly weaker than "Left is true" — here just "$a is non-empty-string" —
while the consequent still claims something about $b ($b === ''). Because the
only thing that tied $b into the antecedent was the dropped $a === $b
relation, the resulting holder "if $a is non-empty-string then $b is ''"
fires whenever $a is non-empty, regardless of $b.

The pattern is: a consequent must not be projected onto an expression whose sole
link to the antecedent was a relational condition the type-guard mechanism can't
represent. Detecting that the target itself was dropped as a no-op condition is
exactly this signal.

Test

• tests/PHPStan/Analyser/nsrt/bug-14891.php reproduces the reported case with
  assertType() ($a stays string, and non-empty-string after if ($a !== "")).
  It fails before the fix ($a was '', then *NEVER*) and passes after.
• It also covers three analogous cases found on the same axis, each independently
  verified to fail before the fix and pass after:
  • a loose == relational antecedent,
  • a relation between two property fetches ($this->a === $this->b),
  • a relation between two integers with integer-range arms
    ($a === $b && $a > 0 && $b > 0, where $a was wrongly narrowed to int<min, 0>).
• The BooleanOr path shares the same helper, so it is covered by the same change.
• The degenerate-antecedent regressions from Skip degenerate no-op antecedents when building boolean conditional expression holders #5951 (bug-14878,
  boolean-and-conditional-holders-mixed-context, bug-6202, bug-14874,
  bug-10644, negated-boolean-and-conditional-holders) still pass.

Fixes phpstan/phpstan#14891

[VincentLanglet]

shorter comment

[phpstan-bot]

Done. I addressed VincentLanglet's review comment requesting a shorter comment.

Change: Condensed the six-line explanatory comment on the droppedNoOpConditions skip down to three lines that keep the essential reasoning:

// The target's only link to the antecedent was a no-op relation (e.g.
// `$a === $b`) that got dropped, so the antecedent no longer constrains
// it. Projecting a consequent onto it would fire unsoundly. Skip it.

Verification:

• make phpstan (on the changed file) → No errors
• NodeScopeResolverTest (which runs all nsrt/ data files, including bug-14891.php) → OK (1668 tests, 1668 assertions)
• AnalyserIntegrationTest bug suite → OK (148 tests)

Committed as 948ed69dc and pushed to create-pull-request/patch-x01hq09.