Fix by-ref variable type not propagated between closure arguments

- When multiple closures sharing a by-ref variable are passed as arguments
  to the same function call, subsequent closures now see by-ref modifications
  from earlier closures
- Applied deferred by-ref closure results to the scope used for closure body
  analysis without leaking to non-closure argument evaluation
- New regression test in tests/PHPStan/Analyser/nsrt/bug-14096.php

Closes phpstan/phpstan#14096

Author: staabm

src/Analyser/NodeScopeResolver.php

@@ -3330,7 +3330,11 @@ public function processArgs(
 				}
 
 				$this->callNodeCallbackWithExpression($nodeCallback, $arg->value, $scopeToPass, $storage, $context);
-				$closureResult = $this->processClosureNode($stmt, $arg->value, $scopeToPass, $storage, $nodeCallback, $context, $parameterType ?? null);
+				$closureScopeToPass = $scopeToPass;
+				foreach ($deferredByRefClosureResults as $deferredClosureResult) {
+					$closureScopeToPass = $deferredClosureResult->applyByRefUseScope($closureScopeToPass);
+				}
+				$closureResult = $this->processClosureNode($stmt, $arg->value, $closureScopeToPass, $storage, $nodeCallback, $context, $parameterType ?? null);
 				if ($this->callCallbackImmediately($parameter, $parameterType, $calleeReflection)) {
 					$throwPoints = array_merge($throwPoints, array_map(static fn (InternalThrowPoint $throwPoint) => $throwPoint->isExplicit() ? InternalThrowPoint::createExplicit($scope, $throwPoint->getType(), $arg->value, $throwPoint->canContainAnyThrowable()) : InternalThrowPoint::createImplicit($scope, $arg->value), $closureResult->getThrowPoints()));
 					$impurePoints = array_merge($impurePoints, $closureResult->getImpurePoints());
@@ -3348,7 +3352,7 @@ public function processArgs(
 					$uses[] = $use->var->name;
 				}
 
-				$scope = $closureResult->getScope();
+				$scope = $scopeToPass;
 				$deferredByRefClosureResults[] = $closureResult;
 				$invalidateExpressions = $closureResult->getInvalidateExpressions();
 				if ($restoreThisScope !== null) {

tests/PHPStan/Analyser/nsrt/bug-14096.php

@@ -0,0 +1,56 @@
+<?php declare(strict_types = 1);
+
+namespace Bug14096;
+
+use function PHPStan\Testing\assertType;
+
+class AbstractView {}
+class App {}
+interface ServerRequestInterface {}
+
+class Test
+{
+	/**
+	 * @template T of App
+	 *
+	 * @param \Closure(ServerRequestInterface): T $createAppFx
+	 * @param \Closure(T): ServerRequestInterface $simulateRequestFx
+	 *
+	 * @return T
+	 */
+	protected function simulateAppCallback(\Closure $createAppFx, \Closure $simulateRequestFx): App
+	{
+		$appBase = $createAppFx(new class() implements ServerRequestInterface {});
+		$request = $simulateRequestFx($appBase);
+
+		$app = $createAppFx($request);
+
+		return $app;
+	}
+
+	/**
+	 * @template T of AbstractView
+	 *
+	 * @param \Closure(ServerRequestInterface): T $createViewFx
+	 * @param \Closure(T): ServerRequestInterface $simulateRequestFx
+	 *
+	 * @return T
+	 */
+	protected function simulateViewCallback(\Closure $createViewFx, \Closure $simulateRequestFx): AbstractView
+	{
+		$view = null;
+		$this->simulateAppCallback(static function (ServerRequestInterface $request) use ($createViewFx, &$view) {
+			$view = $createViewFx($request);
+
+			return new App();
+		}, static function () use ($simulateRequestFx, &$view) {
+			assertType('T of Bug14096\AbstractView (method Bug14096\Test::simulateViewCallback(), argument)|null', $view);
+
+			return $simulateRequestFx($view);
+		});
+
+		assertType('T of Bug14096\AbstractView (method Bug14096\Test::simulateViewCallback(), argument)|null', $view);
+
+		return $view;
+	}
+}