From e8220c71326d9b280c6f56df1df99e7030418caf Mon Sep 17 00:00:00 2001
From: Simon Mundy <simon.mundy@peptolab.com>
Date: Mon, 5 Oct 2026 10:39:54 +1100
Subject: [PATCH] Initialise Expression's by-reference variables before use

getExpressionData() declares $count and $matches before passing them
by reference to str_replace() and preg_match_all().

Signed-off-by: Simon Mundy <simon.mundy@peptolab.com>
---
 analyzer-baseline.toml | 18 ------------------
 src/Sql/Expression.php |  2 ++
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/analyzer-baseline.toml b/analyzer-baseline.toml
index 52b507d3..77b77f0e 100644
--- a/analyzer-baseline.toml
+++ b/analyzer-baseline.toml
@@ -2616,12 +2616,6 @@ code = "missing-constant-type"
 message = "Class constant `PLACEHOLDER` is missing a type hint."
 count = 1
 
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "mixed-argument"
-message = "Invalid argument type for argument #4 of `str_replace`: expected `int|null`, but found `mixed`."
-count = 1
-
 [[issues]]
 file = "src/Sql/Expression.php"
 code = "possibly-null-argument"
@@ -2634,18 +2628,6 @@ code = "possibly-undefined-int-array-index"
 message = "Possibly undefined array index accessed on `list<array<array-key, string>>`."
 count = 1
 
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "reference-to-undefined-variable"
-message = "Reference created from a previously undefined variable `$count`."
-count = 1
-
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "reference-to-undefined-variable"
-message = "Reference created from a previously undefined variable `$matches`."
-count = 1
-
 [[issues]]
 file = "src/Sql/ExpressionInterface.php"
 code = "missing-api-or-internal"
diff --git a/src/Sql/Expression.php b/src/Sql/Expression.php
index a2b880e4..001dbc5a 100644
--- a/src/Sql/Expression.php
+++ b/src/Sql/Expression.php
@@ -82,11 +82,13 @@ public function getExpressionData(): array
         }
 
         // assign locally, escaping % signs
+        $count         = 0;
         $specification = str_replace(self::PLACEHOLDER, replace: '%s', subject: $specification, count: $count);
 
         // test number of replacements without considering same variable begin used many times first, which is
         // faster, if the test fails then resort to regex which are slow and used rarely
         if ($count !== $parametersCount) {
+            $matches = [];
             preg_match_all('/:\w*/', $specification, $matches);
             if (count(array_unique($matches[0])) !== $parametersCount) {
                 throw Exception\RuntimeException::forReplacementMismatch();