From da93efcb692b58ef3b80934bf812c49dfa64ba10 Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Mon, 13 Jul 2026 20:19:02 +0800
Subject: [PATCH] =?UTF-8?q?fix(compiler):=20=E5=A4=84=E7=90=86=E6=9C=AA?=
 =?UTF-8?q?=E5=AE=9A=E4=B9=89=E5=8F=98=E9=87=8F=E8=A2=AB=E5=BC=95=E7=94=A8?=
 =?UTF-8?q?=E8=B5=8B=E5=80=BC=E5=90=8E=E8=B7=A8=E7=B1=BB=E6=96=B9=E6=B3=95?=
 =?UTF-8?q?=E5=8F=82=E6=95=B0=E5=8C=B9=E9=85=8D=E7=B1=BB=E5=9E=8B=E4=B8=8D?=
 =?UTF-8?q?=E6=AD=A3=E7=A1=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/TypeSystem/CompositeTypeCheckerTrait.php  |  6 ++-
 .../static-call-byref-undefined-var.phpt      | 38 +++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 tests/compiler/static/static-call-byref-undefined-var.phpt

diff --git a/src/TypeSystem/CompositeTypeCheckerTrait.php b/src/TypeSystem/CompositeTypeCheckerTrait.php
index 8ce63cdd..77762b4d 100644
--- a/src/TypeSystem/CompositeTypeCheckerTrait.php
+++ b/src/TypeSystem/CompositeTypeCheckerTrait.php
@@ -35,7 +35,11 @@ trait CompositeTypeCheckerTrait
         // TYPE_VAR means that the expression is dynamic or its result cannot
         // be represented by the current scalar type system. It must retain the
         // runtime type check.
-        if ($this->detectTypeOfExpr($value) === Type::VAR && !$this->isNullExpr($value)) {
+        // A reference (TYPE_REF) is a Variant reference whose concrete type is
+        // only known at runtime (e.g. an undefined variable auto-created by a
+        // by-reference argument), so it is treated the same way.
+        $valueType = $this->detectTypeOfExpr($value);
+        if (($valueType === Type::VAR || $valueType === Type::REF) && !$this->isNullExpr($value)) {
             return self::COMPOSITE_TYPE_UNKNOWN;
         }
 
diff --git a/tests/compiler/static/static-call-byref-undefined-var.phpt b/tests/compiler/static/static-call-byref-undefined-var.phpt
new file mode 100644
index 00000000..e51f81d5
--- /dev/null
+++ b/tests/compiler/static/static-call-byref-undefined-var.phpt
@@ -0,0 +1,38 @@
+--TEST--
+Static method call passing an undefined variable by reference (late static binding)
+--FILE--
+<?php
+
+class Test
+{
+    public static function getName(?string &$name)
+    {
+        $name = 'test';
+    }
+
+    public static function run()
+    {
+        // $fileName is undefined; passing it by reference must auto-create it
+        // instead of raising an "Undefined variable" fatal error.
+        static::getName($fileName);
+        var_dump($fileName);
+        Test2::dump($fileName);
+    }
+}
+
+class Test2
+{
+    public static function dump(?string $value)
+    {
+        var_dump($value);
+    }
+}
+
+function main()
+{
+    Test::run();
+}
+?>
+--EXPECT--
+string(4) "test"
+string(4) "test"