Type guard narrowing doesn't occur in else branch of conditionals with multiple conditions

[danquirk]

var x: string|number;
// no error, x is number in else branch
var r4 = typeof x === "string" ? x.substr : x.toFixed; 

// error, x is string|number in else branch
var r5 = typeof x === "string" && typeof x === "string" ? x.substr : x.toFixed; 

Same behavior occurs in if/else. I believe the error is this logic in narrowTypeByAnd:

// The assumed result is false. This means either the first operand was false, or the first operand was true
// and the second operand was false. We narrow with those assumptions and union the two resulting types.
return getUnionType([
    narrowType(type, expr.left, /*assumeTrue*/ false),
    narrowType(narrowType(type, expr.left, /*assumeTrue*/ true), expr.right, /*assumeTrue*/ false)
]);

[vladima]

More precisely:

• first case narrowType(type, expr.left, /*assumeTrue*/ false), correctly yields number
• when evaluating second branch we first narrow type assuming that check for lhs should succeed- this yields string. After that we'll try to narrow this type assuming that check for rhs fails - in process of doing this we'll invoke subtractPrimitiveTypes to subtract string from string. Intuitively this should return empty object type or union type with 0 constituents, however now subtractPrimitiveTypes works only for union types and for other kinds of types it will just return type itself - string.

Result type that will ultimately be returned will be number | string