Array offset loses null when narrowed through a stored boolean of $a['k'] === null || is_int($a['k']) (regression in 2.3.0) #15479

Bug report

Since 2.3.0, when a condition of the form $a['k'] === null || is_int($a['k']) is stored in a boolean variable and that variable is then tested, PHPStan narrows the array offset to int and drops null. A following $a['k'] === null is then reported as always false (identical.alwaysFalse), and !== null as always true.

2.2.16 infers int|null in all four functions below. 2.3.0, 2.3.1 and 2.3.x-dev@62ed200 infer int in f() and g().

The same condition written inline in the if (h()), or on a plain variable instead of an array offset (i()), still gives int|null on 2.3.

Example code that reproduces the problem is at https://phpstan.org/r/13d46152-adf6-413b-95ea-6267185d1367

Code snippet that reproduces the problem

https://phpstan.org/r/13d46152-adf6-413b-95ea-6267185d1367

Expected output

The playground link shows the 2.3 result (level 9). The table compares versions, each run locally with vendor/bin/phpstan analyse -l 9 r.php, no config file, no extensions.

function | 2.2.16 | 2.3.0 / 2.3.1 / 2.3.x-dev@62ed200
-- | -- | --
f() | int|null | int
g() | int|null | int
h() | int|null | int|null
i() | int|null | int|null

Expected output

int|null in f() and g(), as in 2.2.16 and as in h() and i(): the stored condition is true when the offset is null.

Did PHPStan help you today? Did it make you happy in any way?

No response