Allow edge-case of by-reference assignment with unitiliazed property

Fixes #3003

src/Psalm/Internal/Analyzer/Statements/Expression/CallAnalyzer.php

@@ -788,6 +788,9 @@ class CallAnalyzer
                     true
                 ))
         ) {
+            $was_inside_assignment = $context->inside_assignment;
+            $context->inside_assignment = true;
+
             // if the variable is in scope, get or we're in a special array function,
             // figure out its type before proceeding
             if (ExpressionAnalyzer::analyze(
@@ -797,6 +800,8 @@ class CallAnalyzer
             ) === false) {
                 return false;
             }
+
+            $context->inside_assignment = $was_inside_assignment;
         }
 
         // special handling for array sort

src/Psalm/Internal/Analyzer/Statements/Expression/Fetch/PropertyFetchAnalyzer.php

@@ -148,7 +148,12 @@ class PropertyFetchAnalyzer
                     && $source->getMethodName() === '__construct'
                     && !$context->inside_unset
                 ) {
-                    if ($context->inside_isset) {
+                    if ($context->inside_isset
+                        || ($context->inside_assignment
+                            && isset($context->vars_in_scope[$var_id])
+                            && $context->vars_in_scope[$var_id]->isNullable()
+                        )
+                    ) {
                         $stmt_type->initialized = true;
                     } else {
                         if (IssueBuffer::accepts(

tests/PropertyTypeTest.php

@@ -1910,6 +1910,24 @@ class PropertyTypeTest extends TestCase
                         }
                     }'
             ],
+            'allowByReferenceAssignmentToUninitializedNullableProperty' => [
+                '<?php
+                    class C {
+                        private ?\Closure $onCancel;
+
+                        public function __construct() {
+                            $this->foo($this->onCancel);
+                        }
+
+                        /**
+                         * @param mixed $onCancel
+                         * @param-out \Closure $onCancel
+                         */
+                        public function foo(&$onCancel) : void {
+                            $onCancel = function (): void {};
+                        }
+                    }'
+            ],
         ];
     }