Fix phpstan/phpstan#6799: wrongly reported empty array

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -32,6 +32,7 @@
 use PHPStan\Node\Expr\PossiblyImpureCallExpr;
 use PHPStan\Node\Expr\TypeExpr;
 use PHPStan\Reflection\Callables\CallableParametersAcceptor;
+use PHPStan\Reflection\ExtendedParameterReflection;
 use PHPStan\Reflection\Callables\SimpleImpurePoint;
 use PHPStan\Reflection\Callables\SimpleThrowPoint;
 use PHPStan\Reflection\FunctionReflection;
@@ -208,6 +209,51 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 		$impurePoints = array_merge($impurePoints, $argsResult->getImpurePoints());
 		$isAlwaysTerminating = $isAlwaysTerminating || $argsResult->isAlwaysTerminating();
 
+		if (
+			$functionReflection !== null
+			&& in_array($functionReflection->getName(), ['call_user_func_array', 'call_user_func'], true)
+		) {
+			$innerResult = $functionReflection->getName() === 'call_user_func_array'
+				? ArgumentsNormalizer::reorderCallUserFuncArrayArguments($expr, $scope)
+				: ArgumentsNormalizer::reorderCallUserFuncArguments($expr, $scope);
+
+			if ($innerResult !== null) {
+				[$innerParametersAcceptor, $innerFuncCall] = $innerResult;
+				$innerParameters = $innerParametersAcceptor->getParameters();
+				$innerArgs = $innerFuncCall->getArgs();
+
+				foreach ($innerArgs as $i => $innerArg) {
+					$innerParameter = null;
+					if (isset($innerParameters[$i])) {
+						$innerParameter = $innerParameters[$i];
+					} elseif (count($innerParameters) > 0 && $innerParametersAcceptor->isVariadic()) {
+						$innerParameter = $innerParameters[count($innerParameters) - 1];
+					}
+
+					if ($innerParameter === null || !$innerParameter->passedByReference()->createsNewVariable()) {
+						continue;
+					}
+
+					$argValue = $innerArg->value;
+					if ($argValue instanceof Variable && $argValue->name === 'this') {
+						continue;
+					}
+
+					$byRefType = $innerParameter instanceof ExtendedParameterReflection && $innerParameter->getOutType() !== null
+						? $innerParameter->getOutType()
+						: $innerParameter->getType();
+					$scope = $nodeScopeResolver->processVirtualAssign(
+						$scope,
+						$storage,
+						$stmt,
+						$argValue,
+						new TypeExpr($byRefType),
+						$nodeCallback,
+					)->getScope();
+				}
+			}
+		}
+
 		if ($normalizedExpr->name instanceof Expr) {
 			$nameType = $scope->getType($normalizedExpr->name);
 			if (

tests/PHPStan/Analyser/nsrt/bug-6799.php

@@ -0,0 +1,54 @@
+<?php declare(strict_types = 1);
+
+namespace Bug6799;
+
+use function PHPStan\Testing\assertType;
+
+class HelloWorld
+{
+	/**
+	 * @param string[] $where
+	 * @param string $sqlTableName
+	 * @param mixed[] $filter
+	 * @param string $value
+	 */
+	protected function listingAddWhereFilterAtableDefault(array &$where, string $sqlTableName, array $filter, string $value): void
+	{
+		if ($value != "" && !empty($filter) && !empty($filter['sql']) && is_string($filter['sql'])) {
+			$where[] = "`" . $sqlTableName . "`.`" . (string)$filter['sql'] . "` = '" . $value . "'";
+		}
+	}
+
+	/**
+	 * @param string[] $filterValues
+	 * @param string[] $where
+	 * @param string[] $tables
+	 * @param mixed[] $filters
+	 */
+	protected function listingAddWhereFilterAtable(array $filterValues, array &$where, array &$tables, array $filters): void
+	{
+		if (!empty($filterValues) && !empty($filters)) {
+			$whereFilter = array();
+			foreach ($filterValues as $type => $value) {
+				call_user_func_array(array($this, 'listingAddWhereFilterAtableDefault'), array(&$whereFilter, 'xxxx', $filters[$type], $value));
+			}
+			assertType('array<string>', $whereFilter);
+		}
+	}
+
+	/**
+	 * @param array<mixed> $items
+	 * @param-out list<int> $items
+	 */
+	protected function processWithParamOut(array &$items): void
+	{
+		$items = [1, 2, 3];
+	}
+
+	protected function testParamOut(): void
+	{
+		$items = [];
+		call_user_func_array([$this, 'processWithParamOut'], [&$items]);
+		assertType('list<int>', $items);
+	}
+}