Fix phpstan/phpstan#14096: By-reference variables in closures lose type after deferred application

- When multiple closures capture the same by-ref variable, deferred application
  caused later closures to overwrite earlier modifications with their stale types
- Pass current scope as prevScope when applying deferred by-ref results so types
  are unioned instead of replaced
- Guard processClosureScope against undefined variables in prevScope
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14096.php

Author: VincentLanglet

src/Analyser/MutatingScope.php

@@ -3808,7 +3808,7 @@ public function processClosureScope(
 
 			$variableType = $closureScope->getVariableType($variableName);
 
-			if ($prevScope !== null) {
+			if ($prevScope !== null && $prevScope->hasVariableType($variableName)->yes()) {
 				$prevVariableType = $prevScope->getVariableType($variableName);
 				if (!$variableType->equals($prevVariableType)) {
 					$variableType = TypeCombinator::union($variableType, $prevVariableType);

src/Analyser/NodeScopeResolver.php

@@ -3455,7 +3455,7 @@ public function processArgs(
 		}
 
 		foreach ($deferredByRefClosureResults as $deferredClosureResult) {
-			$scope = $deferredClosureResult->applyByRefUseScope($scope);
+			$scope = $deferredClosureResult->applyByRefUseScope($scope, $scope);
 		}
 
 		if ($parameters !== null) {

src/Analyser/ProcessClosureResult.php

@@ -31,13 +31,13 @@ public function getScope(): MutatingScope
 		return $this->scope;
 	}
 
-	public function applyByRefUseScope(MutatingScope $scope): MutatingScope
+	public function applyByRefUseScope(MutatingScope $scope, ?MutatingScope $prevScope = null): MutatingScope
 	{
 		if ($this->byRefClosureResultScope === null) {
 			return $scope;
 		}
 
-		return $scope->processClosureScope($this->byRefClosureResultScope, null, $this->byRefUses);
+		return $scope->processClosureScope($this->byRefClosureResultScope, $prevScope, $this->byRefUses);
 	}
 
 	/**

tests/PHPStan/Analyser/nsrt/bug-14096.php

@@ -0,0 +1,53 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14096;
+
+use function PHPStan\Testing\assertType;
+
+class AbstractView {}
+class App {}
+interface ServerRequestInterface {}
+
+class Test
+{
+	/**
+	 * @template T of App
+	 *
+	 * @param \Closure(ServerRequestInterface): T $createAppFx
+	 * @param \Closure(T): ServerRequestInterface $simulateRequestFx
+	 *
+	 * @return T
+	 */
+	protected function simulateAppCallback(\Closure $createAppFx, \Closure $simulateRequestFx): App
+	{
+		$appBase = $createAppFx(new class() implements ServerRequestInterface {});
+		$request = $simulateRequestFx($appBase);
+
+		$app = $createAppFx($request);
+
+		return $app;
+	}
+
+	/**
+	 * @template T of AbstractView
+	 *
+	 * @param \Closure(ServerRequestInterface): T $createViewFx
+	 * @param \Closure(T): ServerRequestInterface $simulateRequestFx
+	 *
+	 * @return T
+	 */
+	protected function simulateViewCallback(\Closure $createViewFx, \Closure $simulateRequestFx): AbstractView
+	{
+		$view = null;
+		$this->simulateAppCallback(static function (ServerRequestInterface $request) use ($createViewFx, &$view) {
+			$view = $createViewFx($request);
+
+			return new App();
+		}, static function () use ($simulateRequestFx, &$view) {
+			return $simulateRequestFx($view);
+		});
+
+		assertType('T of Bug14096\AbstractView (method Bug14096\Test::simulateViewCallback(), argument)|null', $view);
+		return $view;
+	}
+}