Fix #12687: @param-out conditional check does not assign default value

[phpstan-bot]

Summary

When a @param-out type uses a conditional expression that references its own parameter (e.g., @param-out ($arg is null ? A&I : A) $arg), and an undefined variable is passed to the by-reference parameter, PHPStan was not correctly evaluating the conditional. The undefined variable's type (ErrorType) was used directly to resolve the conditional instead of falling back to the parameter's default value type.

Changes

• Modified src/Reflection/GenericParametersAcceptorResolver.php: When building passedArgs for conditional type resolution, if the argument type is ErrorType (indicating an undefined variable) and the parameter has a default value, use the default value type instead
• Added regression test tests/PHPStan/Analyser/nsrt/bug-12687.php

Root cause

In GenericParametersAcceptorResolver::resolve(), the passedArgs map is built from actual argument types. When an undefined variable is passed to a by-reference parameter (like foo($c) where $c was never assigned), $scope->getType($c) returns ErrorType. This ErrorType was then used as the subject of the conditional type evaluation ($arg is null ? A&I : A), causing the condition to evaluate incorrectly.

The fix checks if the argument type is ErrorType (undefined variable) and the parameter has a default value, and uses the default value type instead. This mirrors the existing logic for parameters with no argument provided at all (the elseif ($param->getDefaultValue() !== null) branch).

Test

Added tests/PHPStan/Analyser/nsrt/bug-12687.php which verifies that:

• Passing a non-null A object resolves the conditional to A
• Passing an explicitly null variable resolves to A&I
• Passing an undefined variable (never assigned) resolves to A&I (the fix)

Fixes phpstan/phpstan#12687

[VincentLanglet]

Checking ErrorType seems too permissive.

I wonder if we should introduce custom class extending ErrorType (or some custom data to this class like a reason) and update

phpstan-src/src/Analyser/MutatingScope.php

Line 1439 in bf569e1

return new ErrorType();

Cause something like

		$d = $a->getFoo();
		assertType('*ERROR*', $d);
		Testing::testMethod($d);
		assertType('Bug12687\A&Bug12687\I', $d);

seems wrong to me

[VincentLanglet]

I'll add coverage with #5109

[VincentLanglet]

#5109