ID:               24219
 User updated by:  wjs at 42virtual dot com
 Reported By:      wjs at 42virtual dot com
-Status:           Feedback
+Status:           Open
 Bug Type:         DOM XML related
 Operating System: SUSE 8.2
 PHP Version:      4.3.2
 New Comment:

Backtrace....

(gdb) bt
#0  0x0807504f in node_list_wrapper_dtor (node=0xffff0000,
destroyref=0)
    at /usr/local/src/php-4.3.2/ext/domxml/php_domxml.c:638
#1  0x08075058 in node_list_wrapper_dtor (node=0x826e318,
destroyref=0)
    at /usr/local/src/php-4.3.2/ext/domxml/php_domxml.c:638
#2  0x08075058 in node_list_wrapper_dtor (node=0x826db08,
destroyref=0)
    at /usr/local/src/php-4.3.2/ext/domxml/php_domxml.c:638
#3  0x08069af2 in php_free_xml_doc (rsrc=0x0)
    at /usr/local/src/php-4.3.2/ext/domxml/php_domxml.c:638
#4  0x0813264e in list_entry_destructor (ptr=0x826c6ac)
    at /usr/local/src/php-4.3.2/Zend/zend_list.c:172
#5  0x08131189 in zend_hash_apply_deleter (ht=0x8180a40, p=0x827bcb4)
    at /usr/local/src/php-4.3.2/Zend/zend_hash.c:598
#6  0x0813124a in zend_hash_graceful_reverse_destroy (ht=0x8180a40)
    at /usr/local/src/php-4.3.2/Zend/zend_hash.c:664
#7  0x081327dc in zend_destroy_rsrc_list (ht=0x8180a40)
    at /usr/local/src/php-4.3.2/Zend/zend_list.c:233
#8  0x08123f9f in shutdown_executor ()
    at /usr/local/src/php-4.3.2/Zend/zend_execute_API.c:213
#9  0x0812c340 in zend_deactivate ()
    at /usr/local/src/php-4.3.2/Zend/zend.c:649
#10 0x08101c10 in php_request_shutdown (dummy=0x0)
    at /usr/local/src/php-4.3.2/main/main.c:985
#11 0x0813ef81 in main (argc=2, argv=0xbffff334)
    at /usr/local/src/php-4.3.2/sapi/cli/php_cli.c:862
#12 0x4011b8ae in __libc_start_main () from /lib/libc.so.6


Previous Comments:
------------------------------------------------------------------------

[2003-06-17 03:11:20] [EMAIL PROTECTED]

We need some script to reproduce it. If we can not reproduce it we can
not fix it...

------------------------------------------------------------------------

[2003-06-17 03:10:17] wjs at 42virtual dot com

We cannot provide you with a "script" however we can provide you with a
backtrace (in 10 min)

------------------------------------------------------------------------

[2003-06-17 03:07:20] [EMAIL PROTECTED]

Please provide a script to reproduce this problem.

------------------------------------------------------------------------

[2003-06-17 03:03:22] wjs at 42virtual dot com

The variable node is of tpye xmlNodePtr whereas node->properties is of
xmlAttr.

Can this be a big /litte endian problem?

------------------------------------------------------------------------

[2003-06-17 03:00:46] wjs at 42virtual dot com

Description:
------------
We are getting not steadily reproducable segmentation fault in this
function. From one recursive Call to the other it appears the a
NULL-Pointer (in node) is somehow casted to 0xffff0000. We suspect that
this might be a casting problem between xmlNodePtr and xmlAttr


/*      destroyref is a bool indicating if all registered objects for nodes

        within the tree should be destroyed */
static inline void node_list_wrapper_dtor(xmlNodePtr node, int
destroyref TSRMLS_DC)
{
        while (node != NULL) {
                node_list_wrapper_dtor(node->children, destroyref TSRMLS_CC);
                switch (node->type) {
                        /* Skip property freeing for the following types */
                        case XML_ATTRIBUTE_DECL:
                        case XML_DTD_NODE:
                        case XML_ENTITY_DECL:
                        case XML_ATTRIBUTE_NODE:
                                break;
                        default:
                                /*      Attribute Nodes contain accessible children
                                        Call this function with the propert list
                                attr_list_wrapper_dtor(node->properties);  */
                                node_list_wrapper_dtor((xmlNodePtr) node->properties, 
destroyref
TSRMLS_CC);
                }

                if (destroyref == 1) {
                        node_wrapper_free(node TSRMLS_CC);
                } else {
                        node_wrapper_dtor(node);
                }

                node = node->next;
        }
}




------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=24219&edit=1

Reply via email to