Refactor call_user_func by-ref type resolution to reuse NodeScopeResolver logic

Extract resolveByRefParameterType() public method from NodeScopeResolver to
centralize by-reference parameter type resolution (extension types, @param-out,
builtin vs user-defined distinction). Use it in both processArgs and
FuncCallHandler's call_user_func_array/call_user_func handling.

Also resolves the inner callee reflection (function or method) from the callback
type, and calls lookForUnsetAllowedUndefinedExpressions after virtual assignment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -32,10 +32,10 @@
 use PHPStan\Node\Expr\PossiblyImpureCallExpr;
 use PHPStan\Node\Expr\TypeExpr;
 use PHPStan\Reflection\Callables\CallableParametersAcceptor;
-use PHPStan\Reflection\ExtendedParameterReflection;
 use PHPStan\Reflection\Callables\SimpleImpurePoint;
 use PHPStan\Reflection\Callables\SimpleThrowPoint;
 use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Reflection\MethodReflection;
 use PHPStan\Reflection\ParametersAcceptor;
 use PHPStan\Reflection\ParametersAcceptorSelector;
 use PHPStan\Reflection\ReflectionProvider;
@@ -222,6 +222,8 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				$innerParameters = $innerParametersAcceptor->getParameters();
 				$innerArgs = $innerFuncCall->getArgs();
 
+				$innerCalleeReflection = $this->resolveCallUserFuncCalleeReflection($innerFuncCall, $scope);
+
 				foreach ($innerArgs as $i => $innerArg) {
 					$innerParameter = null;
 					if (isset($innerParameters[$i])) {
@@ -239,9 +241,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 						continue;
 					}
 
-					$byRefType = $innerParameter instanceof ExtendedParameterReflection && $innerParameter->getOutType() !== null
-						? $innerParameter->getOutType()
-						: $innerParameter->getType();
+					$byRefType = $nodeScopeResolver->resolveByRefParameterType($innerFuncCall, $innerCalleeReflection, $innerParameter, $scope);
 					$scope = $nodeScopeResolver->processVirtualAssign(
 						$scope,
 						$storage,
@@ -250,6 +250,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 						new TypeExpr($byRefType),
 						$nodeCallback,
 					)->getScope();
+					$scope = $nodeScopeResolver->lookForUnsetAllowedUndefinedExpressions($scope, $argValue);
 				}
 			}
 		}
@@ -866,6 +867,46 @@ public function resolveType(MutatingScope $scope, Expr $expr): Type
 		return VoidToNullTypeTransformer::transform($parametersAcceptor->getReturnType(), $expr);
 	}
 
+	/**
+	 * @return FunctionReflection|MethodReflection|null
+	 */
+	private function resolveCallUserFuncCalleeReflection(FuncCall $innerFuncCall, MutatingScope $scope)
+	{
+		if ($innerFuncCall->name instanceof Name && $this->reflectionProvider->hasFunction($innerFuncCall->name, $scope)) {
+			return $this->reflectionProvider->getFunction($innerFuncCall->name, $scope);
+		}
+
+		if (!$innerFuncCall->name instanceof Expr) {
+			return null;
+		}
+
+		$callbackType = $scope->getType($innerFuncCall->name);
+
+		foreach ($callbackType->getConstantStrings() as $constantString) {
+			if ($constantString->getValue() === '') {
+				continue;
+			}
+			$funcName = new Name($constantString->getValue());
+			if ($this->reflectionProvider->hasFunction($funcName, $scope)) {
+				return $this->reflectionProvider->getFunction($funcName, $scope);
+			}
+		}
+
+		foreach ($callbackType->getConstantArrays() as $constantArray) {
+			foreach ($constantArray->findTypeAndMethodNames() as $typeAndMethod) {
+				if ($typeAndMethod->isUnknown() || !$typeAndMethod->getCertainty()->yes()) {
+					continue;
+				}
+				$methodType = $typeAndMethod->getType();
+				if ($methodType->hasMethod($typeAndMethod->getMethod())->yes()) {
+					return $methodType->getMethod($typeAndMethod->getMethod(), $scope);
+				}
+			}
+		}
+
+		return null;
+	}
+
 	private function getDynamicFunctionReturnType(MutatingScope $scope, FuncCall $normalizedNode, FunctionReflection $functionReflection): ?Type
 	{
 		foreach ($this->dynamicReturnTypeExtensionRegistryProvider->getRegistry()->getDynamicFunctionReturnTypeExtensions($functionReflection) as $dynamicFunctionReturnTypeExtension) {

src/Analyser/NodeScopeResolver.php

@@ -3475,27 +3475,7 @@ public function processArgs(
 
 					$argValue = $arg->value;
 					if (!$argValue instanceof Variable || $argValue->name !== 'this') {
-						$paramOutType = $this->getParameterOutExtensionsType($callLike, $calleeReflection, $currentParameter, $scope);
-						if ($paramOutType !== null) {
-							$byRefType = $paramOutType;
-						} elseif (
-							$currentParameter instanceof ExtendedParameterReflection
-							&& $currentParameter->getOutType() !== null
-						) {
-							$byRefType = $currentParameter->getOutType();
-						} elseif (
-							$calleeReflection instanceof MethodReflection
-							&& !$calleeReflection->getDeclaringClass()->isBuiltin()
-						) {
-							$byRefType = $currentParameter->getType();
-						} elseif (
-							$calleeReflection instanceof FunctionReflection
-							&& !$calleeReflection->isBuiltin()
-						) {
-							$byRefType = $currentParameter->getType();
-						} else {
-							$byRefType = new MixedType();
-						}
+						$byRefType = $this->resolveByRefParameterType($callLike, $calleeReflection, $currentParameter, $scope);
 
 						$scope = $this->processVirtualAssign(
 							$scope,
@@ -3605,6 +3585,40 @@ private function getParameterTypeFromParameterClosureTypeExtension(CallLike $cal
 		return null;
 	}
 
+	/**
+	 * @param MethodReflection|FunctionReflection|null $calleeReflection
+	 */
+	public function resolveByRefParameterType(CallLike $callLike, $calleeReflection, ParameterReflection $currentParameter, MutatingScope $scope): Type
+	{
+		$paramOutType = $this->getParameterOutExtensionsType($callLike, $calleeReflection, $currentParameter, $scope);
+		if ($paramOutType !== null) {
+			return $paramOutType;
+		}
+
+		if (
+			$currentParameter instanceof ExtendedParameterReflection
+			&& $currentParameter->getOutType() !== null
+		) {
+			return $currentParameter->getOutType();
+		}
+
+		if (
+			$calleeReflection instanceof MethodReflection
+			&& !$calleeReflection->getDeclaringClass()->isBuiltin()
+		) {
+			return $currentParameter->getType();
+		}
+
+		if (
+			$calleeReflection instanceof FunctionReflection
+			&& !$calleeReflection->isBuiltin()
+		) {
+			return $currentParameter->getType();
+		}
+
+		return new MixedType();
+	}
+
 	/**
 	 * @param MethodReflection|FunctionReflection|null $calleeReflection
 	 */