summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristoph M. Becker <cmb@php.net>2016-07-15 01:16:18 +0200
committerChristoph M. Becker <cmb@php.net>2016-07-15 01:22:26 +0200
commitef0279b640b19f6294a1429f9e04019b1f72d69c (patch)
tree28486d69cacdb342db8f1ae95f963e4a49c15e84
parent32eaf7cdc1ac1803fb9286e2d4a82e93e947c5b6 (diff)
parentb01b093ca9a46462414323c6abedb4373a58796d (diff)
downloadphp-git-ef0279b640b19f6294a1429f9e04019b1f72d69c.tar.gz
Merge branch 'PHP-7.0'
-rw-r--r--NEWS3
-rw-r--r--ext/dom/tests/bug66502.phpt20
-rw-r--r--ext/libxml/libxml.c2
3 files changed, 24 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 859f56f72e..9479022c05 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,9 @@ PHP NEWS
. Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails
parsing). (derick)
+- DOM:
+ . Fixed bug #66502 (DOM document dangling reference). (Sean Heelan, cmb)
+
- Filter:
. Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8
range). (bugs dot php dot net at majkl578 dot cz)
diff --git a/ext/dom/tests/bug66502.phpt b/ext/dom/tests/bug66502.phpt
new file mode 100644
index 0000000000..5b35b41e93
--- /dev/null
+++ b/ext/dom/tests/bug66502.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #66502 (DOM document dangling reference)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip requires ext/dom');
+?>
+--FILE--
+<?php
+$dom = new DOMDocument('1.0', 'UTF-8');
+$element = $dom->appendChild(new DOMElement('root'));
+$comment = new DOMComment("Comment 0");
+$comment = $element->appendChild($comment);
+
+$comment->__construct("Comment 1");
+$comment->__construct("Comment 2");
+$comment->__construct("Comment 3");
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+DONE \ No newline at end of file
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 1969a97959..1084979bbb 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -1278,8 +1278,8 @@ PHP_LIBXML_API int php_libxml_decrement_doc_ref(php_libxml_node_object *object)
efree(object->document->doc_props);
}
efree(object->document);
- object->document = NULL;
}
+ object->document = NULL;
}
return ret_refcount;