Fix phpstan/phpstan#14275: Variable passed by reference are not updated

src/Analyser/ExprHandler/AssignHandler.php

@@ -36,6 +36,7 @@
 use PHPStan\DependencyInjection\AutowiredService;
 use PHPStan\Node\Expr\ExistingArrayDimFetch;
 use PHPStan\Node\Expr\GetOffsetValueTypeExpr;
+use PHPStan\Node\Expr\IntertwinedVariableByReferenceWithExpr;
 use PHPStan\Node\Expr\OriginalPropertyTypeExpr;
 use PHPStan\Node\Expr\SetExistingOffsetValueTypeExpr;
 use PHPStan\Node\Expr\SetOffsetValueTypeExpr;
@@ -150,6 +151,34 @@ static function (MutatingScope $scope) use ($stmt, $expr, $nodeCallback, $contex
 			true,
 		);
 		$scope = $result->getScope();
+
+		if (
+			$expr instanceof AssignRef
+			&& $expr->var instanceof Variable
+			&& is_string($expr->var->name)
+			&& $expr->expr instanceof Variable
+			&& is_string($expr->expr->name)
+		) {
+			$varName = $expr->var->name;
+			$refName = $expr->expr->name;
+			$type = $scope->getType($expr->var);
+			$nativeType = $scope->getNativeType($expr->var);
+
+			// When $varName is assigned, update $refName
+			$scope = $scope->assignExpression(
+				new IntertwinedVariableByReferenceWithExpr($varName, new Variable($refName), new Variable($varName)),
+				$type,
+				$nativeType,
+			);
+
+			// When $refName is assigned, update $varName
+			$scope = $scope->assignExpression(
+				new IntertwinedVariableByReferenceWithExpr($refName, new Variable($varName), new Variable($refName)),
+				$type,
+				$nativeType,
+			);
+		}
+
 		$vars = $nodeScopeResolver->getAssignedVariables($expr->var);
 		if (count($vars) > 0) {
 			$varChangedScope = false;

src/Analyser/MutatingScope.php

@@ -2635,7 +2635,10 @@ public function isUndefinedExpressionAllowed(Expr $expr): bool
 		return array_key_exists($exprString, $this->currentlyAllowedUndefinedExpressions);
 	}
 
-	public function assignVariable(string $variableName, Type $type, Type $nativeType, TrinaryLogic $certainty): self
+	/**
+	 * @param list<string> $intertwinedPropagatedFrom
+	 */
+	public function assignVariable(string $variableName, Type $type, Type $nativeType, TrinaryLogic $certainty, array $intertwinedPropagatedFrom = []): self
 	{
 		$node = new Variable($variableName);
 		$scope = $this->assignExpression($node, $type, $nativeType);
@@ -2664,11 +2667,16 @@ public function assignVariable(string $variableName, Type $type, Type $nativeTyp
 				&& is_string($expressionType->getExpr()->getExpr()->name)
 				&& !$has->no()
 			) {
+				$targetVarName = $expressionType->getExpr()->getExpr()->name;
+				if (in_array($targetVarName, $intertwinedPropagatedFrom, true)) {
+					continue;
+				}
 				$scope = $scope->assignVariable(
-					$expressionType->getExpr()->getExpr()->name,
+					$targetVarName,
 					$scope->getType($expressionType->getExpr()->getAssignedExpr()),
 					$scope->getNativeType($expressionType->getExpr()->getAssignedExpr()),
 					$has,
+					array_merge($intertwinedPropagatedFrom, [$variableName]),
 				);
 			} else {
 				$scope = $scope->assignExpression(
@@ -2870,6 +2878,15 @@ public function invalidateExpression(Expr $expressionToInvalidate, bool $require
 
 		foreach ($expressionTypes as $exprString => $exprTypeHolder) {
 			$exprExpr = $exprTypeHolder->getExpr();
+			if (
+				$exprExpr instanceof IntertwinedVariableByReferenceWithExpr
+				&& $exprExpr->getExpr() instanceof Variable
+				&& is_string($exprExpr->getExpr()->name)
+				&& $exprExpr->getAssignedExpr() instanceof Variable
+				&& is_string($exprExpr->getAssignedExpr()->name)
+			) {
+				continue;
+			}
 			if (!$this->shouldInvalidateExpression($exprStringToInvalidate, $expressionToInvalidate, $exprExpr, $exprString, $requireMoreCharacters, $invalidatingClass)) {
 				continue;
 			}

tests/PHPStan/Analyser/nsrt/bug-14275.php

@@ -0,0 +1,36 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14275;
+
+use function PHPStan\Testing\assertType;
+
+// Basic reference: modifying $b should update $a
+$a = [];
+$b = &$a;
+
+$b[0] = 1;
+assertType('array{1}', $a);
+assertType('array{1}', $b);
+
+// Reference with scalar reassignment
+$c = 1;
+$d = &$c;
+$d = 2;
+assertType('2', $c);
+assertType('2', $d);
+
+// Reference with different type reassignment
+$e = 'hello';
+$f = &$e;
+$f = 42;
+assertType('42', $e);
+assertType('42', $f);
+
+// Subsequent assignments should continue propagating
+$e = 22;
+assertType('22', $e);
+assertType('22', $f);
+
+$f = 33;
+assertType('33', $e);
+assertType('33', $f);

tests/PHPStan/Analyser/nsrt/bug-8056.php

@@ -0,0 +1,16 @@
+<?php declare(strict_types = 1);
+
+namespace Bug8056;
+
+use function PHPStan\Testing\assertType;
+
+$array = [];
+$tmp = &$array;
+$tmp[] = 'foo';
+
+assertType("array{'foo'}", $array);
+assertType("array{'foo'}", $tmp);
+
+foreach ($array as $i) {
+	assertType("'foo'", $i);
+}

tests/PHPStan/Rules/Arrays/DeadForeachRuleTest.php

@@ -55,4 +55,9 @@ public function testBug2457(): void
 		$this->analyse([__DIR__ . '/data/bug-2457.php'], []);
 	}
 
+	public function testBug8056(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-8056.php'], []);
+	}
+
 }

tests/PHPStan/Rules/Arrays/data/bug-8056.php

@@ -0,0 +1,11 @@
+<?php declare(strict_types = 1);
+
+namespace Bug8056Rule;
+
+$array = [];
+$tmp = &$array;
+$tmp[] = 'foo';
+
+foreach ($array as $i) {
+
+}