Fix throw points not properly matched to catch clauses

- When a method has @throws with a supertype of the caught exception (e.g. @throws RuntimeException with catch PDOException), implicit throw points from other method calls were incorrectly excluded from the catch scope
- Phase 3 (implicit throw point matching) was skipped when explicit @throws matched even as "maybe", now it only skips when there's a definitive "yes" match
- Added regression test in tests/PHPStan/Rules/Variables/data/bug-9349.php

Closes phpstan/phpstan#9349

Author: ondrejmirtes

src/Analyser/NodeScopeResolver.php

@@ -1879,6 +1879,7 @@ public function processStmtNode(
 
 				// explicit only
 				$onlyExplicitIsThrow = true;
+				$hasDirectExplicitNonThrowMatch = false;
 				if (count($matchingThrowPoints) === 0) {
 					foreach ($throwPoints as $throwPointIndex => $throwPoint) {
 						foreach ($catchTypes as $catchTypeIndex => $catchTypeItem) {
@@ -1896,14 +1897,17 @@ public function processStmtNode(
 								&& !($throwNode instanceof Node\Stmt\Expression && $throwNode->expr instanceof Expr\Throw_)
 							) {
 								$onlyExplicitIsThrow = false;
+								if ($catchTypeItem->isSuperTypeOf($throwPoint->getType())->yes()) {
+									$hasDirectExplicitNonThrowMatch = true;
+								}
 							}
 							$matchingThrowPoints[$throwPointIndex] = $throwPoint;
 						}
 					}
 				}
 
 				// implicit only
-				if (count($matchingThrowPoints) === 0 || $onlyExplicitIsThrow) {
+				if (count($matchingThrowPoints) === 0 || $onlyExplicitIsThrow || !$hasDirectExplicitNonThrowMatch) {
 					foreach ($throwPoints as $throwPointIndex => $throwPoint) {
 						if ($throwPoint->isExplicit()) {
 							continue;

tests/PHPStan/Rules/Variables/DefinedVariableRuleTest.php

@@ -1393,6 +1393,21 @@ public function testBug6830(): void
 		$this->analyse([__DIR__ . '/data/bug-6830.php'], []);
 	}
 
+	public function testBug9349(): void
+	{
+		$this->cliArgumentsVariablesRegistered = true;
+		$this->polluteScopeWithLoopInitialAssignments = false;
+		$this->checkMaybeUndefinedVariables = true;
+		$this->polluteScopeWithAlwaysIterableForeach = true;
+
+		$this->analyse([__DIR__ . '/data/bug-9349.php'], [
+			[
+				'Variable $sql might not be defined.',
+				19,
+			],
+		]);
+	}
+
 	public function testBug14117(): void
 	{
 		$this->cliArgumentsVariablesRegistered = true;

tests/PHPStan/Rules/Variables/data/bug-9349.php

@@ -0,0 +1,32 @@
+<?php declare(strict_types = 1);
+
+namespace Bug9349;
+
+class HelloWorld
+{
+	public function test(): void
+	{
+		global $pdo;
+
+		try {
+			$this->maybeThrows();
+			$sql = "SELECT * FROM foo";
+			$rs = $pdo->query($sql);
+			if ($result = $rs->fetch(\PDO::FETCH_ASSOC)) {
+				// do something
+			}
+		} catch (\PDOException $e) {
+			var_dump($sql);
+		}
+	}
+
+	/**
+	 * @throws \RuntimeException
+	 */
+	public function maybeThrows(): void
+	{
+		if (random_int(0, 1) === 1) {
+			throw new \RuntimeException();
+		}
+	}
+}