Fix phpstan/phpstan#6799: wrongly reported empty array

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -35,6 +35,7 @@
 use PHPStan\Reflection\Callables\SimpleImpurePoint;
 use PHPStan\Reflection\Callables\SimpleThrowPoint;
 use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Reflection\MethodReflection;
 use PHPStan\Reflection\ParametersAcceptor;
 use PHPStan\Reflection\ParametersAcceptorSelector;
 use PHPStan\Reflection\ReflectionProvider;
@@ -208,6 +209,52 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 		$impurePoints = array_merge($impurePoints, $argsResult->getImpurePoints());
 		$isAlwaysTerminating = $isAlwaysTerminating || $argsResult->isAlwaysTerminating();
 
+		if (
+			$functionReflection !== null
+			&& in_array($functionReflection->getName(), ['call_user_func_array', 'call_user_func'], true)
+		) {
+			$innerResult = $functionReflection->getName() === 'call_user_func_array'
+				? ArgumentsNormalizer::reorderCallUserFuncArrayArguments($expr, $scope)
+				: ArgumentsNormalizer::reorderCallUserFuncArguments($expr, $scope);
+
+			if ($innerResult !== null) {
+				[$innerParametersAcceptor, $innerFuncCall] = $innerResult;
+				$innerParameters = $innerParametersAcceptor->getParameters();
+				$innerArgs = $innerFuncCall->getArgs();
+
+				$innerCalleeReflection = $this->resolveCallUserFuncCalleeReflection($innerFuncCall, $scope);
+
+				foreach ($innerArgs as $i => $innerArg) {
+					$argValue = $innerArg->value;
+					if ($argValue instanceof Variable && $argValue->name === 'this') {
+						continue;
+					}
+
+					$innerParameter = null;
+					if (isset($innerParameters[$i])) {
+						$innerParameter = $innerParameters[$i];
+					} elseif (count($innerParameters) > 0 && $innerParametersAcceptor->isVariadic()) {
+						$innerParameter = $innerParameters[count($innerParameters) - 1];
+					}
+
+					if ($innerParameter === null || !$innerParameter->passedByReference()->createsNewVariable()) {
+						continue;
+					}
+
+					$byRefType = $nodeScopeResolver->resolveByRefParameterType($innerFuncCall, $innerCalleeReflection, $innerParameter, $scope);
+					$scope = $nodeScopeResolver->processVirtualAssign(
+						$scope,
+						$storage,
+						$stmt,
+						$argValue,
+						new TypeExpr($byRefType),
+						$nodeCallback,
+					)->getScope();
+					$scope = $nodeScopeResolver->lookForUnsetAllowedUndefinedExpressions($scope, $argValue);
+				}
+			}
+		}
+
 		if ($normalizedExpr->name instanceof Expr) {
 			$nameType = $scope->getType($normalizedExpr->name);
 			if (
@@ -820,6 +867,41 @@ public function resolveType(MutatingScope $scope, Expr $expr): Type
 		return VoidToNullTypeTransformer::transform($parametersAcceptor->getReturnType(), $expr);
 	}
 
+	private function resolveCallUserFuncCalleeReflection(FuncCall $innerFuncCall, MutatingScope $scope): FunctionReflection|MethodReflection|null
+	{
+		if ($innerFuncCall->name instanceof Name) {
+			if ($this->reflectionProvider->hasFunction($innerFuncCall->name, $scope)) {
+				return $this->reflectionProvider->getFunction($innerFuncCall->name, $scope);
+			}
+			return null;
+		}
+
+		$callbackType = $scope->getType($innerFuncCall->name);
+
+		$constantStrings = $callbackType->getConstantStrings();
+		if (count($constantStrings) === 1 && $constantStrings[0]->getValue() !== '') {
+			$funcName = new Name($constantStrings[0]->getValue());
+			if ($this->reflectionProvider->hasFunction($funcName, $scope)) {
+				return $this->reflectionProvider->getFunction($funcName, $scope);
+			}
+
+			return null;
+		}
+
+		$constantArrays = $callbackType->getConstantArrays();
+		if (count($constantArrays) === 1) {
+			$typeAndMethods = $constantArrays[0]->findTypeAndMethodNames();
+			if (count($typeAndMethods) === 1 && !$typeAndMethods[0]->isUnknown() && $typeAndMethods[0]->getCertainty()->yes()) {
+				$methodType = $typeAndMethods[0]->getType();
+				if ($methodType->hasMethod($typeAndMethods[0]->getMethod())->yes()) {
+					return $methodType->getMethod($typeAndMethods[0]->getMethod(), $scope);
+				}
+			}
+		}
+
+		return null;
+	}
+
 	private function getDynamicFunctionReturnType(MutatingScope $scope, FuncCall $normalizedNode, FunctionReflection $functionReflection): ?Type
 	{
 		foreach ($this->dynamicReturnTypeExtensionRegistryProvider->getRegistry()->getDynamicFunctionReturnTypeExtensions($functionReflection) as $dynamicFunctionReturnTypeExtension) {

src/Analyser/NodeScopeResolver.php

@@ -3475,27 +3475,7 @@ public function processArgs(
 
 					$argValue = $arg->value;
 					if (!$argValue instanceof Variable || $argValue->name !== 'this') {
-						$paramOutType = $this->getParameterOutExtensionsType($callLike, $calleeReflection, $currentParameter, $scope);
-						if ($paramOutType !== null) {
-							$byRefType = $paramOutType;
-						} elseif (
-							$currentParameter instanceof ExtendedParameterReflection
-							&& $currentParameter->getOutType() !== null
-						) {
-							$byRefType = $currentParameter->getOutType();
-						} elseif (
-							$calleeReflection instanceof MethodReflection
-							&& !$calleeReflection->getDeclaringClass()->isBuiltin()
-						) {
-							$byRefType = $currentParameter->getType();
-						} elseif (
-							$calleeReflection instanceof FunctionReflection
-							&& !$calleeReflection->isBuiltin()
-						) {
-							$byRefType = $currentParameter->getType();
-						} else {
-							$byRefType = new MixedType();
-						}
+						$byRefType = $this->resolveByRefParameterType($callLike, $calleeReflection, $currentParameter, $scope);
 
 						$scope = $this->processVirtualAssign(
 							$scope,
@@ -3605,6 +3585,40 @@ private function getParameterTypeFromParameterClosureTypeExtension(CallLike $cal
 		return null;
 	}
 
+	/**
+	 * @param MethodReflection|FunctionReflection|null $calleeReflection
+	 */
+	public function resolveByRefParameterType(CallLike $callLike, $calleeReflection, ParameterReflection $currentParameter, MutatingScope $scope): Type
+	{
+		$paramOutType = $this->getParameterOutExtensionsType($callLike, $calleeReflection, $currentParameter, $scope);
+		if ($paramOutType !== null) {
+			return $paramOutType;
+		}
+
+		if (
+			$currentParameter instanceof ExtendedParameterReflection
+			&& $currentParameter->getOutType() !== null
+		) {
+			return $currentParameter->getOutType();
+		}
+
+		if (
+			$calleeReflection instanceof MethodReflection
+			&& !$calleeReflection->getDeclaringClass()->isBuiltin()
+		) {
+			return $currentParameter->getType();
+		}
+
+		if (
+			$calleeReflection instanceof FunctionReflection
+			&& !$calleeReflection->isBuiltin()
+		) {
+			return $currentParameter->getType();
+		}
+
+		return new MixedType();
+	}
+
 	/**
 	 * @param MethodReflection|FunctionReflection|null $calleeReflection
 	 */

tests/PHPStan/Analyser/nsrt/bug-6799.php

@@ -0,0 +1,116 @@
+<?php declare(strict_types = 1);
+
+namespace Bug6799;
+
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param array<int> $items
+ */
+function functionProcessInts(array &$items): void
+{
+	$items = [1, 2];
+}
+
+/**
+ * @param array<string> $items
+ */
+function functionProcessStrings(array &$items): void
+{
+	$items = ['a', 'b'];
+}
+
+class HelloWorld
+{
+	/**
+	 * @param string[] $where
+	 * @param string $sqlTableName
+	 * @param mixed[] $filter
+	 * @param string $value
+	 */
+	protected function listingAddWhereFilterAtableDefault(array &$where, string $sqlTableName, array $filter, string $value): void
+	{
+		if ($value != "" && !empty($filter) && !empty($filter['sql']) && is_string($filter['sql'])) {
+			$where[] = "`" . $sqlTableName . "`.`" . (string)$filter['sql'] . "` = '" . $value . "'";
+		}
+	}
+
+	/**
+	 * @param string[] $filterValues
+	 * @param string[] $where
+	 * @param string[] $tables
+	 * @param mixed[] $filters
+	 */
+	protected function listingAddWhereFilterAtable(array $filterValues, array &$where, array &$tables, array $filters): void
+	{
+		if (!empty($filterValues) && !empty($filters)) {
+			$whereFilter = array();
+			foreach ($filterValues as $type => $value) {
+				call_user_func_array(array($this, 'listingAddWhereFilterAtableDefault'), array(&$whereFilter, 'xxxx', $filters[$type], $value));
+			}
+			assertType('array<string>', $whereFilter);
+		}
+	}
+
+	/**
+	 * @param array<mixed> $items
+	 * @param-out list<int> $items
+	 */
+	protected function processWithParamOut(array &$items): void
+	{
+		$items = [1, 2, 3];
+	}
+
+	protected function testParamOut(): void
+	{
+		$items = [];
+		call_user_func_array([$this, 'processWithParamOut'], [&$items]);
+		assertType('list<int>', $items);
+	}
+
+	/**
+	 * @param array<int> $items
+	 */
+	protected function processInts(array &$items): void
+	{
+		$items = [1, 2];
+	}
+
+	/**
+	 * @param array<string> $items
+	 */
+	protected function processStrings(array &$items): void
+	{
+		$items = ['a', 'b'];
+	}
+
+	/**
+	 * @param 'Bug6799\functionProcessInts'|'Bug6799\functionProcessStrings' $function
+	 */
+	protected function testUnionStringCallbacks(string $function): void
+	{
+		$items = [];
+		call_user_func_array($function, [&$items]);
+		assertType('mixed', $items); // Could be array<int>|array<string>
+	}
+
+	/**
+	 * @param array{$this, 'processInts'}|array{$this, 'processStrings'} $callback
+	 */
+	protected function testUnionArrayCallbacks(array $callback): void
+	{
+		$items = [];
+		call_user_func_array($callback, [&$items]);
+		assertType('mixed', $items); // Could be array<int>|array<string>
+	}
+
+	/**
+	 * @param 'Bug6799\functionProcessInts'|array{$this, 'processStrings'} $callback
+	 */
+	protected function testMixedUnionCallback($callback): void
+	{
+		$items = [];
+		call_user_func_array($callback, [&$items]);
+		assertType('mixed', $items); // Could be array<int>|array<string>
+	}
+}