From: Operating system: Linux PHP version: 5.3SVN-2011-04-25 (SVN) Package: Reproducible crash Bug Type: Bug Bug description:Removing the doctype node segfaults
Description: ------------ ext/dom segfaults during shutdown when removing the doctype node :] The resulting document appears fine. Test script: --------------- --TEST-- Segfault when removing the Doctype node --SKIPIF-- <?php require_once('skipif.inc'); ?> --FILE-- <?php $xml = <<< XML <?xml version='1.0' encoding='utf-8' ?> <!DOCTYPE set PUBLIC "-//OASIS//DTD DocBook XML V5.0//EN" "http://www.docbook.org/xml/5.0/dtd/docbook.dtd" [ <!ENTITY foo '<foo>footext</foo>'> <!ENTITY bar '<bar>bartext</bar>'> ]> <set>&foo;&bar;</set> XML; $doc = new DOMDocument(); $doc->loadXML($xml, LIBXML_NOENT); $n = $doc->doctype; $doc->removeChild($n); var_dump($n); ?> ===DONE=== <?php exit(0); ?> --EXPECTF-- object(DOMDocumentType)#%d (0) { } ===DONE=== Actual result: -------------- 0x0000000000481cbf in php_libxml_decrement_node_ptr (object=0x14a1750) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:956 956 ret_refcount = --obj_node->refcount; (gdb) bt #0 0x0000000000481cbf in php_libxml_decrement_node_ptr (object=0x14a1750) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:956 #1 0x000000000047fae5 in php_libxml_clear_object (object=0x14a1750) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:150 #2 0x000000000047fb30 in php_libxml_unregister_node (nodep=0x14a1b90) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:163 #3 0x000000000047fda0 in php_libxml_node_free_list (node=0x14a1b90) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:248 #4 0x000000000047fd57 in php_libxml_node_free_list (node=0x149e190) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:239 #5 0x0000000000481f7c in php_libxml_node_free_resource (node=0x149df90) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:1024 #6 0x0000000000482060 in php_libxml_node_decrement_resource (object=0x147fb90) at /home/bjori/Work/OSS/svn-php/php/php- src/branches/PHP_5_3/ext/libxml/libxml.c:1059 #7 0x0000000000599b02 in dom_objects_free_storage (object=0x147fb90) at /home/bjori/Work/OSS/php/php5.3/ext/dom/php_dom.c:1017 #8 0x00000000009c5c92 in zend_objects_store_del_ref_by_handle_ex (handle=2, handlers=0x1233100) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_objects_API.c:220 #9 0x00000000009c598b in zend_objects_store_del_ref (zobject=0x147d5a0) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_objects_API.c:172 #10 0x00000000009931ef in _zval_dtor_func (zvalue=0x147d5a0, __zend_filename=0xf09128 "/home/bjori/Work/OSS/php/php5.3/Zend/zend_execute_API.c", __zend_lineno=445) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_variables.c:52 #11 0x0000000000981fe9 in _zval_dtor (zvalue=0x147d5a0, __zend_filename=0xf09128 "/home/bjori/Work/OSS/php/php5.3/Zend/zend_execute_API.c", __zend_lineno=445) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_variables.h:35 #12 0x000000000098341a in _zval_ptr_dtor (zval_ptr=0x147fde0, __zend_filename=0xf0a230 "/home/bjori/Work/OSS/php/php5.3/Zend/zend_variables.c", __zend_lineno=189) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_execute_API.c:445 #13 0x0000000000993668 in _zval_ptr_dtor_wrapper (zval_ptr=0x147fde0) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_variables.c:189 #14 0x00000000009a6ad7 in zend_hash_apply_deleter (ht=0x12395c8, p=0x147fdc8) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_hash.c:612 #15 0x00000000009a717e in zend_hash_reverse_apply (ht=0x12395c8, apply_func=0x9829e0 <zval_call_destructor>) at /home/bjori/Work/OSS/php/php5.3/Zend/zend_hash.c:761 #16 0x0000000000982a94 in shutdown_destructors () at /home/bjori/Work/OSS/php/php5.3/Zend/zend_execute_API.c:226 #17 0x000000000099521b in zend_call_destructors () at /home/bjori/Work/OSS/php/php5.3/Zend/zend.c:874 #18 0x000000000091414a in php_request_shutdown (dummy=0x0) at /home/bjori/Work/OSS/php/php5.3/main/main.c:1591 #19 0x0000000000a84304 in main (argc=2, argv=0x7fffffffe198) at /home/bjori/Work/OSS/php/php5.3/sapi/cli/php_cli.c:1374 (gdb) -- Edit bug report at http://bugs.php.net/bug.php?id=54601&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=54601&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=54601&r=trysnapshot53 Try a snapshot (trunk): http://bugs.php.net/fix.php?id=54601&r=trysnapshottrunk Fixed in SVN: http://bugs.php.net/fix.php?id=54601&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=54601&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=54601&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=54601&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=54601&r=needscript Try newer version: http://bugs.php.net/fix.php?id=54601&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=54601&r=support Expected behavior: http://bugs.php.net/fix.php?id=54601&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=54601&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=54601&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=54601&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=54601&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=54601&r=dst IIS Stability: http://bugs.php.net/fix.php?id=54601&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=54601&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=54601&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=54601&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=54601&r=mysqlcfg