Fix undefined variable false positive for by-reference array items

Restore bug-6799c.php test to use undefined variable in [&$x] (the
previous $x = null assignment defeated the test purpose). Allow
undefined expressions in by-reference array items using the same
set/unset pattern used for function call by-reference arguments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

src/Analyser/ExprHandler/ArrayHandler.php

@@ -61,6 +61,10 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				$scope = $keyResult->getScope();
 			}
 
+			if ($arrayItem->byRef) {
+				$scope = $nodeScopeResolver->lookForSetAllowedUndefinedExpressions($scope, $arrayItem->value);
+			}
+
 			$valueResult = $nodeScopeResolver->processExprNode($stmt, $arrayItem->value, $scope, $storage, $nodeCallback, $context->enterDeep());
 			$hasYield = $hasYield || $valueResult->hasYield();
 			$throwPoints = array_merge($throwPoints, $valueResult->getThrowPoints());
@@ -71,6 +75,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				continue;
 			}
 
+			$scope = $nodeScopeResolver->lookForUnsetAllowedUndefinedExpressions($scope, $arrayItem->value);
 			$scope = $scope->assignExpression($arrayItem->value, new MixedType(), new MixedType());
 		}
 		$nodeScopeResolver->callNodeCallback($nodeCallback, new LiteralArrayNode($expr, $itemNodes), $scope, $storage);

tests/PHPStan/Analyser/nsrt/bug-6799c.php

@@ -6,10 +6,8 @@
 
 // https://3v4l.org/g5UjS
 
-$x = null;
-assertType('null', $x);
 $a = [&$x];
-assertType('mixed', $x); // Could stay null
+assertType('mixed', $x);
 
 function doFoo(array &$arr) {
 	$arr[0] = 'string';