This happened in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1330704/.

Simple example: https://phan.github.io/demo/?c=DwfgDgFmBQ0MYBsCGBnFACAKgUxQF3QG9p1T0B6AKkvQAEA3JAJ3XyYEsA7AcwG0BddJXIkyYDozzZ0AEin4ACkwD2YbEzwBPdAF50AgNyjSx9ADMArpzh52yzunl4AFKzwcesgFYp76AJREpmSyzExI2no%2B9gD6ACbYcMoJrjLRnAA0jkwW2FlmyNwoAFzoAFIAygDyAHIxmAASAEpVAOoxtTEAok0tTQFGIQCQ7GbormERMewoMQgzLqFM4dqBgcTDIUzYeBZMnINkQwC%2BpkNyEDMAtAB8Tkqq6loCuksrvADkTh-8h6SnpyAA&php=84&phan=6.0.5&ast=1.1.3&plugins=310592423266

<?php

class Test {
    /** @var string[] */
    private $testProperty = [];
    
    function test( string $json ) {
        $array = json_decode( $json, true, flags: JSON_THROW_ON_ERROR );
    	if ( array_is_list( $array ) ) {
    	    return;
    	}
    	$this->testProperty[] = $array['test'];
    }
}

phan error:

input:12: PhanTypeMismatchProperty Assigning ($array['test'] as a field) of type non-empty-array<int,array> to property but \Test->testProperty is string[]

For some reason, phan assumes that $array['test'] is a non-empty-array<int,array>. This is wrong as the type of $array['test'] actually cannot be determined here as it comes from JSON.

When commenting out the return statement so the code doesn't assert that array_is_list() is false, phan doesn't fail anymore, so array_is_list() is presumably related.

I tried to test what the type of $array is according to phan, and the error in another demo indicates that it's non-empty-associative-array<array>, which is incorrect.