mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-01-11 05:24:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

MFB51: Fixed bug #36756 (DOMDocument::removeChild corrupts node)

Browse Source 
add test
This commit is contained in:
Rob Richards 2006-03-18 11:46:13 +00:00
parent 49f7b6605c
commit 7fc0756e55
2 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/dom/php_dom.c
View File

@ -306,6 +306,8 @@ zval *dom_read_property(zval *object, zval *member, int type TSRMLS_DC)
if (obj->prop_handler != NULL) {
ret = zend_u_hash_find(obj->prop_handler, Z_TYPE_P(member), Z_UNIVAL_P(member), Z_UNILEN_P(member)+1, (void **) &hnd);
} else if (instanceof_function(obj->std.ce, dom_node_class_entry TSRMLS_CC)) {
php_error(E_WARNING, "Couldn't fetch %s. Node no longer exists", obj->std.ce->name);
}
if (ret == SUCCESS) {
ret = hnd->read_func(obj, &retval TSRMLS_CC);

35
ext/dom/tests/bug36756.phpt Normal file
View File

@ -0,0 +1,35 @@
--TEST--
Bug #36756: (DOMDocument::removeChild corrupts node)
--SKIPIF--
<?php require_once('skipif.inc'); ?>
--FILE--
<?php
/* Node is preserved from removeChild */
$dom = new DOMDocument();
$dom->loadXML('<root><child/></root>');
$xpath = new DOMXpath($dom);
$node = $xpath->query('/root')->item(0);
echo $node->nodeName . "\n";
$dom->removeChild($GLOBALS['dom']->firstChild);
echo "nodeType: " . $node->nodeType . "\n";
/* Node gets destroyed during removeChild */
$dom->loadXML('<root><child/></root>');
$xpath = new DOMXpath($dom);
$node = $xpath->query('//child')->item(0);
echo $node->nodeName . "\n";
$GLOBALS['dom']->removeChild($GLOBALS['dom']->firstChild);
echo "nodeType: " . $node->nodeType . "\n";
?>
--EXPECTF--
root
nodeType: 1
child
Warning: Couldn't fetch DOMElement. Node no longer exists in %sbug36756.php on line %d
Notice: Undefined property: DOMElement::$nodeType in %sbug36756.php on line %d
nodeType: