Page MenuHomePhabricator

Analyze why phan does not report a possible undeclared variable on short-circuit code with pass-by-ref variable
Open, Needs TriagePublic

Description

I would expect that the issue with undeclared variable from T281455 gets covered by a static code analyzer like phan.

Code is:

		if ( !preg_match_all( '|\<([\w]+)[^/]*?>|', $message, $startTags ) &&
			!preg_match_all( '|\</([\w]+)|', $message, $endTags )
		) {
			return [];
		}

		// Keep just the element names from the matched patterns.
		$startTags = $startTags[1];
		$endTags = $endTags[1];

$endTags get's declared and set by preg_match_all and there is no need to init/set the result variable on preg-function due to pass-by-ref on this as output variable.
But in this case the second preg_match_all could be skipped by short-circuit evaluation and it ends up with undeclared variable.

In my opinion phan should emit a issue (like a possibly undeclared variable warning) in this case, but nothing is showing up.
Is this a upstream issue or a config issue by the central config? Only PhanUndeclaredMethod is suppressed on this repo.

I have not checked if this could be covered by current phan-master already.

Event Timeline

Not fixed on phan master, see demo.

I think this might be by design: more generally, phan doesn't warn about undeclared variables for array dim access, see here.