#32755 [Opn]: Segfault in replaceChild() when DocumentFragment has no children
ID: 32755
User updated by: james at safesearching dot com
Reported By: james at safesearching dot com
Status: Open
Bug Type: DOM XML related
Operating System: RedHat 7.3
PHP Version: 5CVS-2005-04-18 (dev)
New Comment:
Reproduce code didn't quite make it all the way in... full code is:
<?php
header('Content-type: text/plain;');
$xml = "<root><first/><second/></root>\n";
$dom = new DomDocument;
$dom->loadXML($xml);
$root = $dom->documentElement;
$frag = $dom->createDocumentFragment();
$root->replaceChild($frag, $root->firstChild);
print_r($dom->saveXML());
?>
Previous Comments:
------------------------------------------------------------------------
[2005-04-19 00:09:33] james at safesearching dot com
Description:
------------
Segfault occurs when calling DOMNode::replaceChild($newNode, $oldNode)
if $newNode is a DocumentFragment with no children.
The segfault occurs on line 62 of ext/dom/node.c:
dom_reconcile_ns (doc=0x81aff20, nodep=0x0)
at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62
62 if (nodep->type == XML_ELEMENT_NODE) {
Code runs test against nodep->type when nodep is NULL.
Was tested on both 5.0.4 (w/ node.c,v 1.29.2.4) and 5.0.5-dev
(STABLE-200504182039).
Reproduce code:
---------------
<?php
header('Content-type: text/plain;');
$xml = "<root><first/><second/></root>\n";
$dom = new DomDocument;
$dom->loadXML($xml);
$root = $dom->documentElement;
$frag = $dom->createDocumentFragment();
$root->replaceChild($frag, $root->firstChild);
print_r($dom->saveXML());
?>
Expected result:
----------------
Not exactlly sure... perhaps issue a warning indicating that the
DocumentFragment object had no children and remove oldNode? Maybe
generate a fatal error?
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 27878)]
dom_reconcile_ns (doc=0x81d0540, nodep=0x0)
at /home/james/php5-STABLE-200504182039/ext/dom/node.c:62
62 if (nodep->type == NULL) {
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=32755&edit=1
Thread (3 messages)