Track types written through variable variables

ondrejmirtes · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
commit a33871df872475df112afcecbf4dc4e95215d184
diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
@@ -1253,16 +1253,24 @@ public function applyWrite(
 				if ($assignedExpr instanceof Expr\Array_) {
 					$scope = $this->processArrayByRefItems($nodeScopeResolver, $scope, $storage, $var->name, $assignedExpr, new Variable($var->name));
 				}
-			} elseif ($target->getVariableNameResult() === null) {
-				// a plain assignment does not read the target, so the dynamic name
-				// is walked here; read-modify-write targets walked it in
-				// prepareTarget() and already carry its state
-				$nameExprResult = $nodeScopeResolver->processExprNode($stmt, $var->name, $scope, $storage, $nodeCallback, $context);
-				$hasYield = $hasYield || $nameExprResult->hasYield();
-				$throwPoints = array_merge($throwPoints, $nameExprResult->getThrowPoints());
-				$impurePoints = array_merge($impurePoints, $nameExprResult->getImpurePoints());
-				$isAlwaysTerminating = $isAlwaysTerminating || $nameExprResult->isAlwaysTerminating();
-				$scope = $nameExprResult->getScope();
+			} else {
+				$nameExprResult = $target->getVariableNameResult();
+				if ($nameExprResult === null) {
+					// Read-modify-write targets already evaluated the dynamic name in prepareTarget().
+					$nameExprResult = $nodeScopeResolver->processExprNode($stmt, $var->name, $scope, $storage, $nodeCallback, $context);
+					$hasYield = $hasYield || $nameExprResult->hasYield();
+					$throwPoints = array_merge($throwPoints, $nameExprResult->getThrowPoints());
+					$impurePoints = array_merge($impurePoints, $nameExprResult->getImpurePoints());
+					$isAlwaysTerminating = $isAlwaysTerminating || $nameExprResult->isAlwaysTerminating();
+					$scope = $nameExprResult->getScope();
+				}
+				$storedAssignedExprResult = $assignedValueResult ?? $storage->findExpressionResult($assignedExpr);
+				$scope = $this->assignDynamicVariable(
+					$scope,
+					$nameExprResult,
+					$this->readAssignedValueType($nodeScopeResolver, $storedAssignedExprResult, $assignedExpr, $scopeBeforeAssignEval),
+					$this->readAssignedValueType($nodeScopeResolver, $storedAssignedExprResult, $assignedExpr, $scopeBeforeAssignEval->doNotTreatPhpDocTypesAsCertain()),
+				);
 			}
 		} elseif ($kind === PreparedAssignTarget::KIND_ARRAY_DIM_FETCH) {
 			if (!$var instanceof ArrayDimFetch) {
@@ -1816,6 +1824,44 @@ private function resolveContainerTypesAfterAssignedExprEval(
 		return [$varResult->getType(), $varResult->getNativeType()];
 	}
 
+	private function assignDynamicVariable(MutatingScope $scope, ExpressionResult $nameResult, Type $valueType, Type $nativeValueType): MutatingScope
+	{
+		$nameType = $nameResult->getType()->toString();
+		$nativeNameType = $nameResult->getNativeType()->toString();
+		$names = [];
+		foreach ($nameType->getConstantStrings() as $name) {
+			$names[$name->getValue()] = $name;
+		}
+		foreach (array_merge($scope->getDefinedVariables(), $scope->getMaybeDefinedVariables()) as $name) {
+			$nameStringType = new ConstantStringType($name);
+			if ($nameType->isSuperTypeOf($nameStringType)->no()) {
+				continue;
+			}
+			$names[$name] = $nameStringType;
+		}
+
+		$beforeScope = $scope;
+		foreach ($names as $nameStringType) {
+			$name = $nameStringType->getValue();
+			if ($name === 'this') {
+				continue;
+			}
+			$certainty = $beforeScope->hasVariableType($name);
+			$type = $valueType;
+			$nativeType = $nativeValueType;
+			if (!$certainty->no()) {
+				if (!$nameType->equals($nameStringType)) {
+					$type = TypeCombinator::union($beforeScope->getVariableType($name), $type);
+				}
+				if (!$nativeNameType->equals($nameStringType)) {
+					$nativeType = TypeCombinator::union($beforeScope->doNotTreatPhpDocTypesAsCertain()->getVariableType($name), $nativeType);
+				}
+			}
+			$scope = $scope->assignVariable($name, $type, $nativeType, $nameType->equals($nameStringType) ? TrinaryLogic::createYes() : $certainty->or(TrinaryLogic::createMaybe()));
+		}
+		return $scope;
+	}
+
 	private function unwrapAssign(Expr $expr): Expr
 	{
 		if ($expr instanceof Assign) {

diff --git a/tests/PHPStan/Analyser/AnalyserIntegrationTest.php b/tests/PHPStan/Analyser/AnalyserIntegrationTest.php
@@ -975,9 +975,9 @@ public function testBug12767(): void
 		$errors = $this->runAnalyse(__DIR__ . '/data/bug-12767.php');
 		$this->assertCount(3, $errors);
 
-		$this->assertSame('Expected type int, actual: *ERROR*', $errors[0]->getMessage());
-		$this->assertSame('Undefined variable: $field1', $errors[1]->getMessage());
-		$this->assertSame('Undefined variable: $field2', $errors[2]->getMessage());
+		$this->assertSame('Expected type int, actual: int<1, max>', $errors[0]->getMessage());
+		$this->assertSame('Variable $field1 might not be defined.', $errors[1]->getMessage());
+		$this->assertSame('Variable $field2 might not be defined.', $errors[2]->getMessage());
 	}
 
 	public function testBug7554(): void

diff --git a/tests/PHPStan/Analyser/nsrt/variable-variable-assign.php b/tests/PHPStan/Analyser/nsrt/variable-variable-assign.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace VariableVariableAssign;
+
+use function PHPStan\Testing\assertType;
+use function PHPStan\Testing\assertNativeType;
+
+function knownName(): void
+{
+	$name = 'value';
+	$$name = 1;
+	assertType('1', $value);
+	assertNativeType('1', $value);
+}
+
+function possibleNames(bool $condition): void
+{
+	$first = [];
+	$second = [];
+	$name = $condition ? 'first' : 'second';
+	$$name = ['value'];
+	assertType("array{}|array{'value'}", $first);
+	assertType("array{}|array{'value'}", $second);
+	assertNativeType("array{}|array{'value'}", $first);
+}
+
+function unknownName(string $name): void
+{
+	$value = [];
+	$$name = ['value'];
+	assertType("array{}|array{'value'}", $value);
+	assertNativeType("array{}|array{'value'}", $value);
+}
+
+function updateKnownName(): void
+{
+	$name = 'counter';
+	$counter = 1;
+	$$name += 2;
+	assertType('3', $counter);
+	assertNativeType('3', $counter);
+}
+
+/** @param 'value' $name */
+function documentedName(string $name): void
+{
+	$value = 1;
+	$$name = 2;
+	assertType('2', $value);
+	assertNativeType('1|2', $value);
+}
diff --git a/tests/PHPStan/Rules/Functions/UnusedClosureUsesRuleTest.php b/tests/PHPStan/Rules/Functions/UnusedClosureUsesRuleTest.php
@@ -16,6 +16,11 @@ protected function getRule(): Rule
 		return new UnusedClosureUsesRule(true);
 	}
 
+	public function testCapturesAssignedThroughVariableVariables(): void
+	{
+		$this->analyse([__DIR__ . '/data/unused-closure-uses-variable-variables.php'], []);
+	}
+
 	public function testUnusedClosureUses(): void
 	{
 		$this->analyse([__DIR__ . '/data/unused-closure-uses.php'], [

diff --git a/tests/PHPStan/Rules/Functions/data/unused-closure-uses-variable-variables.php b/tests/PHPStan/Rules/Functions/data/unused-closure-uses-variable-variables.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace UnusedClosureUsesVariableVariables;
+
+function translate(string $value): \Closure
+{
+	$fromTranslations = [];
+	$toTranslations = [];
+	foreach (['from', 'to'] as $key) {
+		$translationKey = $key . 'Translations';
+		$$translationKey = [$value];
+	}
+
+	return function (string $chunk) use ($fromTranslations, $toTranslations): string {
+		foreach ($fromTranslations as $index => $word) {
+			if (preg_match("/^$word\$/iu", $chunk)) {
+				return $toTranslations[$index] ?? '';
+			}
+		}
+		return $chunk;
+	};
+}