Summary

When an if/else block assigned multiple variables alongside a boolean flag correlated with a null check, PHPStan failed to narrow the nullable variable through the boolean flag. For example:

if ($data === null) {
    $foo = 'bar';
    $update = false;
} else {
    $foo = 'baz';
    $update = true;
}
if ($update) {
    // $data should be narrowed to `object` here, but was incorrectly `object|null`
    get_class($data); // false positive error
}

Without the $foo assignments, the narrowing worked correctly. The issue was that extra variable assignments in both branches created multi-condition guards that couldn't be resolved.

Changes

• Modified MutatingScope::createConditionalExpressions() in src/Analyser/MutatingScope.php to create pairwise conditional expression holders instead of one holder per variable with all other type guards as conditions
• This applies to both the type narrowing section (lines ~4129-4146) and the undefined variable section (lines ~4148-4155)

Root cause

When merging two branches of an if/else, createConditionalExpressions() identified variables that differed between branches as "type guards" and created ConditionalExpressionHolder instances. Each holder required ALL other type guards to match before the guarded variable's type could be resolved.

With 2 type guards (e.g., $data and $update), each holder had exactly 1 condition — which could be matched directly when the user checked if ($update).

With 3+ type guards (e.g., $data, $foo, $update), each holder had 2+ conditions, creating a circular dependency: resolving $data required $foo AND $update to be known, but resolving $foo required $data AND $update. The iterative resolution loop in filterBySpecifiedTypes() couldn't break this cycle.

The fix creates individual pairwise holders instead. In a binary branch merge, knowing any single type guard's value uniquely identifies which branch was taken, so each guard is independently sufficient. This allows the resolution loop to resolve variables step by step.

Test

Added tests/PHPStan/Analyser/nsrt/bug-5051.php with four test methods covering:

1. Extra string variable assignments in both branches (the original bug)
2. Extra boolean variable assignments in both branches
3. Different variable names in each branch (already worked)
4. No extra assignments (already worked)

Fixes phpstan/phpstan#5051
Fixes phpstan/phpstan#9647