From 345b96c4a3f20f4237028005b8189c2ab480e467 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Tue, 30 Aug 2016 13:05:53 +0200
Subject: Fix bug #72957

(cherry picked from commit bfd4277008d3bda95ff5b418c60d41d50488d33b)
---
 ext/simplexml/simplexml.c         | 18 ++++++------------
 ext/simplexml/tests/bug72957.phpt | 16 ++++++++++++++++
 2 files changed, 22 insertions(+), 12 deletions(-)
 create mode 100644 ext/simplexml/tests/bug72957.phpt

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 7c1e68787c..8e9f7b2785 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -356,7 +356,10 @@ long_dim:
 					_node_as_zval(sxe, node, rv, newtype, name, sxe->iter.nsprefix, sxe->iter.isprefix);
 				}
 #else
-				_node_as_zval(sxe, node, rv, SXE_ITER_ELEMENT, name, sxe->iter.nsprefix, sxe->iter.isprefix);
+				/* In BP_VAR_IS mode only return a proper node if it actually exists. */
+				if (type != BP_VAR_IS || sxe_find_element_by_name(sxe, node->children, (xmlChar *) name)) {
+					_node_as_zval(sxe, node, rv, SXE_ITER_ELEMENT, name, sxe->iter.nsprefix, sxe->iter.isprefix);
+				}
 #endif
 			}
 		}
@@ -801,17 +804,8 @@ static int sxe_prop_dim_exists(zval *object, zval *member, int check_empty, zend
 					node = php_sxe_get_first_node(sxe, node);
 				}
 				node = sxe_get_element_by_offset(sxe, Z_LVAL_P(member), node, NULL);
-			}
-			else {
-				node = node->children;
-				while (node) {
-					xmlNodePtr nnext;
-					nnext = node->next;
-					if (node->type == XML_ELEMENT_NODE && !xmlStrcmp(node->name, (xmlChar *)Z_STRVAL_P(member)) && match_ns(sxe, node, sxe->iter.nsprefix, sxe->iter.isprefix)) {
-						break;
-					}
-					node = nnext;
-				}
+			} else {
+				node = sxe_find_element_by_name(sxe, node->children, (xmlChar *)Z_STRVAL_P(member));
 			}
 			if (node) {
 				exists = 1;
diff --git a/ext/simplexml/tests/bug72957.phpt b/ext/simplexml/tests/bug72957.phpt
new file mode 100644
index 0000000000..29ca69fa76
--- /dev/null
+++ b/ext/simplexml/tests/bug72957.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #72957: Null coalescing operator doesn't behave as expected with SimpleXMLElement
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml extension is not loaded"; ?>
+--FILE--
+<?php
+
+$xml = new SimpleXMLElement('<root><elem>Text</elem></root>');
+
+echo 'elem2 is: ' . ($xml->elem2 ?? 'backup string') . "\n";
+echo 'elem2 is: ' . (isset($xml->elem2) ? $xml->elem2 : 'backup string') . "\n";
+
+?>
+--EXPECT--
+elem2 is: backup string
+elem2 is: backup string
-- 
cgit v1.2.1