From 5b469ca5779d3aa77696f64f1d54da02408d37de Mon Sep 17 00:00:00 2001
From: AndrolGenhald <AndrolGenhald@gmail.com>
Date: Fri, 4 Feb 2022 08:23:16 -0600
Subject: [PATCH] Fix crash when assigning reference to unknown array offset.

---
 .../Expression/AssignmentAnalyzer.php         |  6 ++++
 tests/ReferenceTest.php                       | 29 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php b/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
index b3daa26555c..e32521a395c 100644
--- a/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
+++ b/src/Psalm/Internal/Analyzer/Statements/Expression/AssignmentAnalyzer.php
@@ -929,6 +929,12 @@ public static function analyzeAssignmentRef(
             return false;
         }
 
+        if (!isset($context->vars_in_scope[$rhs_var_id])) {
+            // Sometimes the $rhs_var_id isn't set in $vars_in_scope, for example if it's an unknown array offset.
+            $context->vars_in_scope[$rhs_var_id] = $statements_analyzer->node_data->getType($stmt->expr)
+                ?? Type::getMixed();
+        }
+
         if (isset($context->references_in_scope[$lhs_var_id])) {
             // Decrement old referenced variable's reference count
             $reference_count = &$context->referenced_counts[$context->references_in_scope[$lhs_var_id]];
diff --git a/tests/ReferenceTest.php b/tests/ReferenceTest.php
index 13ae8ec17f3..af50a5ebee0 100644
--- a/tests/ReferenceTest.php
+++ b/tests/ReferenceTest.php
@@ -218,6 +218,35 @@ function &ensure_array(array &$what, array $keys): array
                     }
                 ',
             ],
+            'dontCrashOnReferenceToMixedVariableArrayOffset' => [
+                'code' => '<?php
+                    function func(&$a): void
+                    {
+                        $_ = &$a["f"];
+                    }
+                ',
+                'assertions' => [],
+                'ignored_issues' => ['MixedArrayAccess', 'MissingParamType'],
+            ],
+            'dontCrashOnReferenceToArrayUnknownOffset' => [
+                'code' => '<?php
+                    function func(array &$a): void
+                    {
+                        $_ = &$a["f"];
+                    }
+                ',
+                'assertions' => [],
+            ],
+            'dontCrashOnReferenceToArrayMixedOffset' => [
+                'code' => '<?php
+                    /** @param array{f: mixed} $a */
+                    function func(array &$a): void
+                    {
+                        $_ = &$a["f"];
+                    }
+                ',
+                'assertions' => [],
+            ],
         ];
     }