[2004-07-27 17:07 UTC] davey@php.net

Description:
------------
When you assign a the DomDocument::documentElement to a variable before returning it from a function called by the XSL extension, PHP segfaults.

See code for better explanation.

- Davey

Reproduce code:
---------------
<?php
$xsl = <<<XSL
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:php="http://php.net/xsl" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:crtx="http://synapticmedia.net/xmlns/crtx/template">
	<xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes" omit-xml-declaration="yes" />
	<xsl:strip-space elements="*"/>
	<xsl:template match="/">
        <xsl:copy-of select="php:function('returnDomElement')" />
    </xsl:template>
</xsl:stylesheet>
XSL;
$xml = <<<XML
<root></root>
XML;
function returnDomElement() {
    $xml = '<root><child>cdata</child></root>';
    $dom = domDocument::loadXML($xml);
    /* change to 'return $dom->documentElement' and it works */
    $return = $dom->documentElement;
    return $return
}
$xsl = domDocument::loadXML($xsl);
$xml = domDocument::loadXML($xml);
$xp = new xsltProcessor;
$xp->registerPhpFunctions();
$xp->importStylesheet($xsl);
echo $xp->transformToXML($xml);
?>

Expected result:
----------------
<root>
  <child>cdata</child>
</root>


Actual result:
--------------
</> in the output and a segfault (details will be added by chregu)

 [2004-07-28 14:44 UTC] chregu@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.