ID: 32755 Updated by: [EMAIL PROTECTED] Reported By: james at safesearching dot com -Status: Open +Status: Closed Bug Type: DOM XML related Operating System: RedHat 7.3 PHP Version: 5CVS-2005-04-18 (dev) New Comment:
This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2005-04-19 00:12:08] james at safesearching dot com Reproduce code didn't quite make it all the way in... full code is: <?php header('Content-type: text/plain;'); $xml = "<root><first/><second/></root>\n"; $dom = new DomDocument; $dom->loadXML($xml); $root = $dom->documentElement; $frag = $dom->createDocumentFragment(); $root->replaceChild($frag, $root->firstChild); print_r($dom->saveXML()); ?> ------------------------------------------------------------------------ [2005-04-19 00:09:33] james at safesearching dot com Description: ------------ Segfault occurs when calling DOMNode::replaceChild($newNode, $oldNode) if $newNode is a DocumentFragment with no children. The segfault occurs on line 62 of ext/dom/node.c: dom_reconcile_ns (doc=0x81aff20, nodep=0x0) at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62 62 if (nodep->type == XML_ELEMENT_NODE) { Code runs test against nodep->type when nodep is NULL. Was tested on both 5.0.4 (w/ node.c,v 1.29.2.4) and 5.0.5-dev (STABLE-200504182039). Reproduce code: --------------- <?php header('Content-type: text/plain;'); $xml = "<root><first/><second/></root>\n"; $dom = new DomDocument; $dom->loadXML($xml); $root = $dom->documentElement; $frag = $dom->createDocumentFragment(); $root->replaceChild($frag, $root->firstChild); print_r($dom->saveXML()); ?> Expected result: ---------------- Not exactlly sure... perhaps issue a warning indicating that the DocumentFragment object had no children and remove oldNode? Maybe generate a fatal error? Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 27878)] dom_reconcile_ns (doc=0x81d0540, nodep=0x0) at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62 62 if (nodep->type == NULL) { ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=32755&edit=1
