[Cache][VarExporter] Fix proxy generation to deal with edgy behaviors of internal classes

Author: nicolas-grekas

ProxyHelper.php

@@ -215,7 +215,7 @@ class_exists(\Symfony\Component\VarExporter\Internal\LazyObjectState::class);
 
     public static function exportSignature(\ReflectionFunctionAbstract $function, bool $withParameterTypes = true, string &$args = null): string
     {
-        $hasByRef = false;
+        $byRefIndex = 0;
         $args = '';
         $param = null;
         $parameters = [];
@@ -225,16 +225,20 @@ public static function exportSignature(\ReflectionFunctionAbstract $function, bo
                 .($param->isPassedByReference() ? '&' : '')
                 .($param->isVariadic() ? '...' : '').'$'.$param->name
                 .($param->isOptional() && !$param->isVariadic() ? ' = '.self::exportDefault($param) : '');
-            $hasByRef = $hasByRef || $param->isPassedByReference();
+            if ($param->isPassedByReference()) {
+                $byRefIndex = 1 + $param->getPosition();
+            }
             $args .= ($param->isVariadic() ? '...$' : '$').$param->name.', ';
         }
 
-        if (!$param || !$hasByRef) {
+        if (!$param || !$byRefIndex) {
             $args = '...\func_get_args()';
         } elseif ($param->isVariadic()) {
             $args = substr($args, 0, -2);
         } else {
-            $args .= sprintf('...\array_slice(\func_get_args(), %d)', \count($parameters));
+            $args = explode(', ', $args, 1 + $byRefIndex);
+            $args[$byRefIndex] = sprintf('...\array_slice(\func_get_args(), %d)', $byRefIndex);
+            $args = implode(', ', $args);
         }
 
         $signature = 'function '.($function->returnsReference() ? '&' : '')