Narrow parent constant array type when type-checking an array offset

src/Analyser/TypeSpecifier.php

@@ -2470,7 +2470,7 @@
 		) {
 			if (
 				($context->true() && $type->isSuperTypeOf($scope->getType($expr->right))->no())
-				|| ($context->false() && $type->isSuperTypeOf($scope->getType($expr->right))->yes())
+				|| ($context->false() && ($type->isSuperTypeOf($scope->getType($expr->right))->yes() || $type->isNull()->no()))
 			) {
 				$expr = $expr->left;
 			}
@@ -2586,6 +2586,42 @@
 			}
 		}
 
+		if (
+			$expr instanceof ArrayDimFetch
+			&& $expr->dim !== null
+			&& !$context->null()
+		) {
+			$dimType = $scope->getType($expr->dim);
+			if ($dimType instanceof ConstantIntegerType || $dimType->getConstantStrings() !== []) {
+				$varType = $scope->getType($expr->var);
+				$constantArrays = $varType->getConstantArrays();
+				if ($constantArrays !== []) {
+					$typesToRemove = [];
+					foreach ($constantArrays as $constantArray) {
+						if (!$constantArray->hasOffsetValueType($dimType)->yes()) {
+							continue;
+						}
+						$offsetValueType = $constantArray->getOffsetValueType($dimType);
+						if ($context->false()) {
+							if ($type->isSuperTypeOf($offsetValueType)->yes()) {
+								$typesToRemove[] = $constantArray;
+							}
+						} elseif ($context->true()) {
+							if ($type->isSuperTypeOf($offsetValueType)->no()) {
+								$typesToRemove[] = $constantArray;
+							}
+						}
+					}
+
+					if ($typesToRemove !== [] && count($typesToRemove) < count($constantArrays)) {
+						$typeToRemove = TypeCombinator::union(...$typesToRemove);
+						$varExprString = $this->exprPrinter->printExpr($expr->var);
+						$sureNotTypes[$varExprString] = [$expr->var, $typeToRemove];
+					}
+				}
+			}
+		}
+
 		$types = new SpecifiedTypes($sureTypes, $sureNotTypes);
 		if (isset($containsNull) && !$containsNull) {
 			return $this->createNullsafeTypes($originalExpr, $scope, $context, $type)->unionWith($types);

tests/PHPStan/Rules/Arrays/OffsetAccessAssignmentRuleTest.php

@@ -222,4 +222,16 @@ public function testAppendToArrayWithPhpIntMaxKey(): void
 		]);
 	}
 
+	public function testBug9004(): void
+	{
+		$this->checkUnionTypes = true;
+		$this->analyse([__DIR__ . '/../../Analyser/nsrt/bug-9004.php'], []);
+	}
+
+	public function testBug14566(): void
+	{
+		$this->checkUnionTypes = true;
+		$this->analyse([__DIR__ . '/data/bug-14566.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-14566.php

@@ -0,0 +1,46 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14566;
+
+/**
+ * @param array{}|array{hi: 'hello'}|array{hi: array{0: 42, 1?: 42}} $test
+ */
+function foo(array $test): void {
+	if (isset($test['hi']) && is_string($test['hi'])) {
+		return;
+	}
+	$test['hi'][] = 42;
+}
+
+/**
+ * @param array{}|array{hi: 'hello'}|array{hi: array{0: 42, 1?: 42}} $test
+ */
+function foo2(array $test): void {
+	if (\is_string($test['hi'] ?? null)) {
+		return;
+	}
+	$test['hi'][] = 42;
+}
+
+/**
+ * @param array{}|array{hi: 'hello'}|array{hi: array{0: 42, 1?: 42}} $test
+ */
+function foo3(array $test): void {
+	if (!isset($test['hi'])) {
+		return;
+	}
+	if (\is_string($test['hi'])) {
+		return;
+	}
+	$test['hi'][] = 42;
+}
+
+/**
+ * @param array{}|array{hi: 'hello'}|array{hi: array{0: 42, 1?: 42}} $test
+ */
+function foo4(array $test): void {
+	if (!\is_array($test['hi'] ?? null)) {
+		return;
+	}
+	$test['hi'][] = 42;
+}