Fix "Cannot use [] for reading" false positive for by-reference args

- Enter expression assign context for ArrayDimFetch with null dim when passed as a by-reference argument in NodeScopeResolver::processArgs()
- Exit expression assign after processing to prevent scope leakage
- Add regression test in tests/PHPStan/Rules/Arrays/data/bug-5290.php
- Uncomment previously disabled test case for by-ref closure in existing test data

Closes phpstan/phpstan#5290

Author: phpstan-bot

src/Analyser/NodeScopeResolver.php

@@ -3401,11 +3401,18 @@ public function processArgs(
 				$this->storeBeforeScope($storage, $arg->value, $scopeToPass);
 			} else {
 				$exprType = $scope->getType($arg->value);
+				$enterExpressionAssignForByRef = $assignByReference && $arg->value instanceof ArrayDimFetch && $arg->value->dim === null;
+				if ($enterExpressionAssignForByRef) {
+					$scopeToPass = $scopeToPass->enterExpressionAssign($arg->value);
+				}
 				$exprResult = $this->processExprNode($stmt, $arg->value, $scopeToPass, $storage, $nodeCallback, $context->enterDeep());
 				$throwPoints = array_merge($throwPoints, $exprResult->getThrowPoints());
 				$impurePoints = array_merge($impurePoints, $exprResult->getImpurePoints());
 				$isAlwaysTerminating = $isAlwaysTerminating || $exprResult->isAlwaysTerminating();
 				$scope = $exprResult->getScope();
+				if ($enterExpressionAssignForByRef) {
+					$scope = $scope->exitExpressionAssign($arg->value);
+				}
 				$hasYield = $hasYield || $exprResult->hasYield();
 
 				if ($exprType->isCallable()->yes()) {

tests/PHPStan/Rules/Arrays/OffsetAccessWithoutDimForReadingRuleTest.php

@@ -16,6 +16,11 @@ protected function getRule(): Rule
 		return new OffsetAccessWithoutDimForReadingRule();
 	}
 
+	public function testBug5290(): void
+	{
+		$this->analyse([__DIR__ . '/data/bug-5290.php'], []);
+	}
+
 	public function testOffsetAccessWithoutDimForReading(): void
 	{
 		$this->analyse(

tests/PHPStan/Rules/Arrays/data/bug-5290.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Bug5290;
+
+function set(?bool &$value): void {
+	$value = true;
+}
+
+$array = [];
+set($array[]);
+
+var_dump($array);
+
+// Also test with closures and anonymous functions
+(function (&$ref) {})($array[]);
+
+class Foo {
+	public function bar(?bool &$value): void {
+		$value = true;
+	}
+}
+
+$foo = new Foo();
+$foo->bar($array[]);

tests/PHPStan/Rules/Arrays/data/offset-access-without-dim-for-reading.php

@@ -15,7 +15,7 @@
 
 $firstElement = &$array[];
 (function ($ref) {})($array[]);
-//(function (&$ref) {})($array[]); // Should work but doesn't
+(function (&$ref) {})($array[]);
 
 // Technically works but makes no sense
 $array[] += 20;