Fix phpstan/phpstan#6799: wrongly reported empty array

[phpstan-bot]

Summary

When a variable is passed by reference inside an array literal that is used as a function argument (e.g. call_user_func_array($callback, [&$var, ...])), PHPStan did not recognize that the variable could be modified by the function call. This caused false positives like "Comparison operation > between 0 and 0 is always false" when checking the count of an array that was passed by reference through an array argument.

Changes

• Added invalidateByRefVariablesInArrayArg() method to src/Analyser/NodeScopeResolver.php that recursively scans array literal arguments for by-reference items and invalidates those variables
• Called this method at the end of processArgs() for all function call arguments
• Added regression test in tests/PHPStan/Analyser/nsrt/bug-6799.php

Root cause

When array(&$var, ...) is created inline as a function argument, processArrayByRefItems() (which sets up intertwined reference tracking) is never called because it only runs during array assignments to variables. The function call's argument processing also doesn't detect by-reference items inside array arguments — it only handles direct by-reference parameters. As a result, $var's type was never updated after the function call, keeping its original narrow type (e.g. array{}).

The fix invalidates any variable that appears as a &$var item in an array literal passed as a function argument, setting it to mixed since we cannot determine what the callee does with the reference.

Test

Added tests/PHPStan/Analyser/nsrt/bug-6799.php which verifies that after call_user_func_array([$this, 'addFilter'], array(&$whereFilter, ...)), the type of $whereFilter is mixed (not array{}). Also tests a simpler case with a plain function call.

Fixes phpstan/phpstan#6799

[VincentLanglet]

This will still produce errors on higher level since the variable is now mixed instead of array.

The main issue is the fact that

call_user_func_array(array($this, 'addFilter'), array(&$whereFilter, 'xxxx', $filters[$type], $value));

should be understood the same way than

$this->listingAddWhereFilterAtableDefault($whereFilter, 'xxxx', $filters[$type], $value);

[phpstan-bot]

That was the earlier test run — also already superseded by the clean full test run (11644 tests, all passing). Everything is good and already pushed.