Variables created from array indexing have incorrect types

Version and Platform (required):

• Binary Ninja Version: 3.1.3553-dev
• OS: macOS
• OS Version: 12.0.1
• CPU Architecture: M1

Bug Description:
When HLIL resolves an array index offset, the resulting HLIL Expression has a deduced type, but this does not apply the type to a variable assigned to that expression. This is probably due to array resolution being done in HLIL and not applying expression types to variables which are created in MLIL.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

1. Open this binary: struct_array3.zip
2. Create these types:

struct Bar __packed
{
    int32_t a;
    int32_t field_4;
    struct Baz* bazs[0x10];
    int32_t b;
};
struct Baz __packed
{
    int32_t a;
    int32_t b;
    uint8_t* c;
};
struct Foo __packed
{
    int64_t unknown;
    struct Bar* pBars[0xa];
    struct Bar** ppBars[0xa];
    struct Bar*** pppBars[0xa];
    int64_t unknown1;
};

3. In _main, apply the type Foo* to the variable x0 (address 100003df8)
4. Observe the type of variable x8_16 (address 100003e88) is int32_t*
5. Enable the option Show All Expression Types
6. Observe the type of the expression assigned to x8_16 is struct Bar*

Expected Behavior:
I expected the assignment to change the variable's type automatically (at least, assuming the new type has confidence > the variable's existing confidence)

Screenshots:

Additional Information:
This is probably due to MLIL assigning the variable's type based on the analysis without the array resolution, as HLIL applies later and doesn't update the type.

Start with the provided struct_array3.zip reproduction in _main, applying Foo* to x0 and comparing x8_16 with Show All Expression Types enabled. Trace how MLIL assigns the variable type and how HLIL resolves the array index expression. Done means the variable receives the higher-confidence struct Bar* type from the resolved expression.