Initialise Expression's by-reference variables before use

analyzer-baseline.toml

@@ -2544,12 +2544,6 @@ code = "missing-constant-type"
 message = "Class constant `PLACEHOLDER` is missing a type hint."
 count = 1
 
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "mixed-argument"
-message = "Invalid argument type for argument #4 of `str_replace`: expected `int|null`, but found `mixed`."
-count = 1
-
 [[issues]]
 file = "src/Sql/Expression.php"
 code = "possibly-null-argument"
@@ -2562,18 +2556,6 @@ code = "possibly-undefined-int-array-index"
 message = "Possibly undefined array index accessed on `list<array<array-key, string>>`."
 count = 1
 
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "reference-to-undefined-variable"
-message = "Reference created from a previously undefined variable `$count`."
-count = 1
-
-[[issues]]
-file = "src/Sql/Expression.php"
-code = "reference-to-undefined-variable"
-message = "Reference created from a previously undefined variable `$matches`."
-count = 1
-
 [[issues]]
 file = "src/Sql/ExpressionInterface.php"
 code = "missing-api-or-internal"

src/Sql/Expression.php

@@ -82,11 +82,13 @@ public function getExpressionData(): array
         }
 
         // assign locally, escaping % signs
+        $count         = 0;
         $specification = str_replace(self::PLACEHOLDER, replace: '%s', subject: $specification, count: $count);
 
         // test number of replacements without considering same variable begin used many times first, which is
         // faster, if the test fails then resort to regex which are slow and used rarely
         if ($count !== $parametersCount) {
+            $matches = [];
             preg_match_all('/:\w*/', $specification, $matches);
             if (count(array_unique($matches[0])) !== $parametersCount) {
                 throw Exception\RuntimeException::forReplacementMismatch();