So, this one was harder than the other, and reproducing the issue wasn't easy, either. The problem arises when we try to compute the objects that a function could possibly return, but doing that from outside that function. To do that, we basically backup the variable map when first analyzing the function (from the inside), save it in the object representing the function, and retrieve it later when we need to collect the return values. This is because phan deletes the variable map in between, and this fix was explicitly suggested as a stable workaround (https://github.com/phan/phan/issues/2963). The problem is: for some reason, phan deletes the object where we saved the scope, hence we'll later receive another copy of that function, without the original scope, and actually, with no variables at all (including $this, which triggers the issue).

Change 586386 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Fix another edge case interaction with phan

https://gerrit.wikimedia.org/r/586386

Change 586386 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Fix another edge case interaction with phan

https://gerrit.wikimedia.org/r/586386