[php-src] PR #23888: Fix GH-23887: HTMLCollection::namedItem() mishandles the first child
| From: | lazerg | Date: | Thu, 24 Sep 2026 13:33:08 +0000 |
| Subject: | [php-src] PR #23888: Fix GH-23887: HTMLCollection::namedItem() mishandles the first child | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38773@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23888
Author: lazerg
dom_html_collection_named_item() seeds the iterator with
basep->children, but the handlers don't agree on what that seed means. The noop
handler (used by getElementsByClassName('')) never moves it, so the first
child is checked forever: that's the assertion in the report, an infinite loop in release
builds, or a wrong match if the first child has the key as its id. The class name handler treats the
seed as already visited and skips the first child. The children handler never advances
past the first child when it is an element that doesn't match, so it hangs.
The iterator now starts with a NULL candidate, which the class name and noop handlers already
handle, and the children and tag name handlers start from
basep->children when they see NULL.
Fixes #23887