Propagate types bidirectionally through by-ref array items

- Add reverse intertwined entries in AssignHandler so that assigning
  to $b[$key] propagates through to the referenced variable $a when
  $b = [&$a]
- Preserve intertwined entries during invalidation when the invalidated
  variable is the entry's trigger or target variable
- Widen referenced variables to mixed when a variable containing
  references is passed to an impure function
- Update test assertions to reflect correct propagation behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/AssignHandler.php

@@ -208,6 +208,17 @@ static function (MutatingScope $scope) use ($stmt, $expr, $nodeCallback, $contex
 					$type,
 					$nativeType,
 				);
+
+				// When $targetVar is assigned (e.g. $b[0] = 42), update $refVarName
+				$scope = $scope->assignExpression(
+					new IntertwinedVariableByReferenceWithExpr(
+						$targetVarName,
+						new Variable($refVarName),
+						new ArrayDimFetch(new Variable($targetVarName), $key),
+					),
+					$type,
+					$nativeType,
+				);
 			}
 		}
 

src/Analyser/MutatingScope.php

@@ -2835,7 +2835,21 @@ public function invalidateExpression(Expr $expressionToInvalidate, bool $require
 			$exprExpr = $exprTypeHolder->getExpr();
 			if (
 				$exprExpr instanceof IntertwinedVariableByReferenceWithExpr
-				&& $exprExpr->isVariableToVariableReference()
+				&& (
+					$exprExpr->isVariableToVariableReference()
+					|| (
+						$expressionToInvalidate instanceof Variable
+						&& is_string($expressionToInvalidate->name)
+						&& (
+							$exprExpr->getVariableName() === $expressionToInvalidate->name
+							|| (
+								$exprExpr->getExpr() instanceof Variable
+								&& is_string($exprExpr->getExpr()->name)
+								&& $exprExpr->getExpr()->name === $expressionToInvalidate->name
+							)
+						)
+					)
+				)
 			) {
 				continue;
 			}

src/Analyser/NodeScopeResolver.php

@@ -74,6 +74,7 @@
 use PHPStan\Node\DoWhileLoopConditionNode;
 use PHPStan\Node\ExecutionEndNode;
 use PHPStan\Node\Expr\ExistingArrayDimFetch;
+use PHPStan\Node\Expr\IntertwinedVariableByReferenceWithExpr;
 use PHPStan\Node\Expr\ForeachValueByRefExpr;
 use PHPStan\Node\Expr\GetIterableKeyTypeExpr;
 use PHPStan\Node\Expr\GetIterableValueTypeExpr;
@@ -3556,6 +3557,36 @@ public function processArgs(
 						)->getScope();
 					}
 				}
+
+				if (
+					!$assignByReference
+					&& $calleeReflection !== null
+					&& !$calleeReflection->hasSideEffects()->no()
+					&& $arg->value instanceof Variable
+					&& is_string($arg->value->name)
+				) {
+					$argVarName = $arg->value->name;
+					foreach ($scope->expressionTypes as $exprTypeHolder) {
+						$exprExpr = $exprTypeHolder->getExpr();
+						if (!$exprExpr instanceof IntertwinedVariableByReferenceWithExpr) {
+							continue;
+						}
+						if ($exprExpr->getVariableName() !== $argVarName) {
+							continue;
+						}
+						if (!($exprExpr->getExpr() instanceof Variable) || !is_string($exprExpr->getExpr()->name)) {
+							continue;
+						}
+						$scope = $this->processVirtualAssign(
+							$scope,
+							$storage,
+							$stmt,
+							$exprExpr->getExpr(),
+							new TypeExpr(new MixedType()),
+							$nodeCallback,
+						)->getScope();
+					}
+				}
 			}
 		}
 

tests/PHPStan/Analyser/nsrt/bug-6799.php

@@ -54,7 +54,7 @@ function testByRefInArray(): void
 	assertType('array{}', $a);
 
 	foo($b);
-	assertType('array{}', $a);
+	assertType('mixed', $a);
 }
 
 function testByRefInArrayWithKey(): void
@@ -66,7 +66,7 @@ function testByRefInArrayWithKey(): void
 	assertType("'hello'", $a);
 
 	$b['key'] = 42;
-	assertType("'hello'", $a);
+	assertType('42', $a);
 }
 
 function testMultipleByRefInArray(): void
@@ -82,6 +82,6 @@ function testMultipleByRefInArray(): void
 	$b[1] = 'foo';
 	$b[2] = 'bar';
 
-	assertType('1', $a);
-	assertType("'test'", $c);
+	assertType('2', $a);
+	assertType("'bar'", $c);
 }