diff options
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/dom/php_dom.c | 2 | ||||
| -rw-r--r-- | ext/dom/tests/bug36756.phpt | 35 |
2 files changed, 37 insertions, 0 deletions
diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c index d403d898b9..fcd7b313be 100644 --- a/ext/dom/php_dom.c +++ b/ext/dom/php_dom.c @@ -289,6 +289,8 @@ zval *dom_read_property(zval *object, zval *member, int type TSRMLS_DC) if (obj->prop_handler != NULL) { ret = zend_hash_find(obj->prop_handler, Z_STRVAL_P(member), Z_STRLEN_P(member)+1, (void **) &hnd); + } else if (instanceof_function(obj->std.ce, dom_node_class_entry TSRMLS_CC)) { + php_error(E_WARNING, "Couldn't fetch %s. Node no longer exists", obj->std.ce->name); } if (ret == SUCCESS) { ret = hnd->read_func(obj, &retval TSRMLS_CC); diff --git a/ext/dom/tests/bug36756.phpt b/ext/dom/tests/bug36756.phpt new file mode 100644 index 0000000000..e24f9f0804 --- /dev/null +++ b/ext/dom/tests/bug36756.phpt @@ -0,0 +1,35 @@ +--TEST-- +Bug #36756: (DOMDocument::removeChild corrupts node) +--SKIPIF-- +<?php require_once('skipif.inc'); ?> +--FILE-- +<?php + +/* Node is preserved from removeChild */ +$dom = new DOMDocument(); +$dom->loadXML('<root><child/></root>'); +$xpath = new DOMXpath($dom); +$node = $xpath->query('/root')->item(0); +echo $node->nodeName . "\n"; +$dom->removeChild($GLOBALS['dom']->firstChild); +echo "nodeType: " . $node->nodeType . "\n"; + +/* Node gets destroyed during removeChild */ +$dom->loadXML('<root><child/></root>'); +$xpath = new DOMXpath($dom); +$node = $xpath->query('//child')->item(0); +echo $node->nodeName . "\n"; +$GLOBALS['dom']->removeChild($GLOBALS['dom']->firstChild); + +echo "nodeType: " . $node->nodeType . "\n"; + +?> +--EXPECTF-- +root +nodeType: 1 +child + +Warning: Couldn't fetch DOMElement. Node no longer exists in %sbug36756.php on line %d + +Notice: Undefined property: DOMElement::$nodeType in %sbug36756.php on line %d +nodeType: |