#36776 [Opn->Csd]: node_list_wrapper_dtor segfault

ID: 36776 Updated by: rrichards@php.net Reported By: rasmus@php.net -Status: Open +Status: Closed Bug Type: DOM XML related Operating System: Linux PHP Version: 4CVS-2006-03-17 (CVS) New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2006-03-17 19:44:42] rasmus@php.net Description: ------------ It looks like the node_list_wrapper_dtor function gets confused and ends up segfaulting. Reproduce code: --------------- <?php $xml=<<<EOB <?xml version="1.0" standalone="no"?> <!DOCTYPE items [ <!ATTLIST items attr CDATA #REQUIRED> <!ELEMENT item EMPTY> <!ELEMENT items (item)+> ]> <items attr="test"><item/> <item/></items> EOB; domxml_open_mem($xml); ?> Expected result: ---------------- no segfault Actual result: -------------- segfault With this backtrace: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1218013504 (LWP 6708)] 0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645 645 { (gdb) bt #0 0x0809ec35 in node_list_wrapper_dtor (node=0x0, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:645 #1 0x0809ec51 in node_list_wrapper_dtor (node=0x82ba970, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:647 #2 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #3 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #4 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #5 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #6 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #7 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #8 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #9 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 #10 0x0809ec8d in node_list_wrapper_dtor (node=0x82bc1e8, destroyref=1) at /home/rasmus/php44/ext/domxml/php_domxml.c:659 ... thousands more lines like the above. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=36776&edit=1