Bug #80602 [NEW]: Segfault when using DOMChildNode::before()

From: jules dot bernable at gmail dot com Operating system: debian PHP version: 8.0.0 Package: DOM XML related Bug Type: Bug Bug description:Segfault when using DOMChildNode::before() Description: ------------ When calling DOMChildNode::before() on an element, if one of the parameters is a text node that is the previous sibling of that element, the program segfaults. Test script: --------------- <?php declare(strict_types=1); $doc = new \DOMDocument(); $doc->loadXML('<a>foo<last/></a>'); $target = $doc->documentElement->lastChild; $target->before('bar', $doc->documentElement->firstChild, 'baz'); echo $doc->saveXML($doc->documentElement); Expected result: ---------------- <a>barfoobaz<last/></a> Actual result: -------------- free(): double free detected in tcache 2 Aborted -- Edit bug report at https://bugs.php.net/bug.php?id=80602&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80602&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80602&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80602&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80602&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80602&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80602&r=support Expected behavior: https://bugs.php.net/fix.php?id=80602&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80602&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80602&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80602&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80602&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80602&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80602&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80602&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80602&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80602&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80602&r=mysqlcfg