From e43f2259ea43c79559036d309c6af69b0b8947fb Mon Sep 17 00:00:00 2001
From: Matt Brown <github@muglug.com>
Date: Mon, 14 Dec 2020 16:57:48 -0500
Subject: [PATCH] Fix #4839 - undefined possibly set in by-reference should be
 treated as such

---
 .../Expression/AssignmentAnalyzer.php         | 22 ++++++++++++++++++-
 tests/ArgTest.php                             | 17 ++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php b/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
index 445c1cb11..d82f701fe 100644
--- a/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
+++ b/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
@@ -1186,6 +1186,8 @@ class AssignmentAnalyzer
             if (!$context->hasVariable($var_id)) {
                 $context->vars_possibly_in_scope[$var_id] = true;
 
+                $location = new CodeLocation($statements_analyzer->getSource(), $stmt);
+
                 if (!$statements_analyzer->hasVariable($var_id)) {
                     if ($constrain_type
                         && $prevent_null
@@ -1197,7 +1199,7 @@ class AssignmentAnalyzer
                         if (IssueBuffer::accepts(
                             new \Psalm\Issue\NullReference(
                                 'Not expecting null argument passed by reference',
-                                new CodeLocation($statements_analyzer->getSource(), $stmt)
+                                $location
                             ),
                             $statements_analyzer->getSuppressedIssues()
                         )) {
@@ -1205,6 +1207,24 @@ class AssignmentAnalyzer
                         }
                     }
 
+                    if ($stmt instanceof PhpParser\Node\Expr\Variable) {
+                        $statements_analyzer->registerVariable(
+                            $var_id,
+                            $location,
+                            $context->branch_point
+                        );
+
+                        if ($statements_analyzer->data_flow_graph instanceof VariableUseGraph) {
+                            $byref_node = DataFlowNode::getForAssignment($var_id, $location);
+
+                            $statements_analyzer->data_flow_graph->addPath(
+                                $byref_node,
+                                new DataFlowNode('variable-use', 'variable use', null),
+                                'variable-use'
+                            );
+                        }
+                    }
+
                     $context->hasVariable($var_id);
                 } else {
                     $var_not_in_scope = true;
diff --git a/tests/ArgTest.php b/tests/ArgTest.php
index 4084dbb7a..3d565def7 100644
--- a/tests/ArgTest.php
+++ b/tests/ArgTest.php
@@ -451,6 +451,23 @@ class ArgTest extends TestCase
                 false,
                 '8.0'
             ],
+            'byrefVarSetsPossible' => [
+                '<?php
+                    /**
+                     * @param mixed $a
+                     * @psalm-param-out int $a
+                     */
+                    function takesByRef(&$a) : void {
+                        $a = 5;
+                    }
+
+                    if (rand(0, 1)) {
+                        takesByRef($b);
+                    }
+
+                    echo $b;',
+                'error_message' => 'PossiblyUndefinedGlobalVariable',
+            ],
         ];
     }
 }