[2007-06-05 07:47 UTC] christian dot kaps at imaxx21 dot com

Sorry for my poor englisch.

I think this script is the trigger for this problem. But it is not the only one. I can`t say what the other is!?

<?php
class Config_SimpleXML extends SimpleXMLIterator
{
	public function xpath($query, $index = null)
	{
		$result = parent::xpath($query);
		
		if (!$result) {
			return array();
		} elseif (is_numeric($index)) {
			return $result[(int) $index];
		}
		
		return $result;
	}
	
	public function parent()
	{
		$parent = $this->xpath('parent::*', 0);
		
		return $parent;
	}
	
	public function removeChild(Config_SimpleXML $child)
	{
		$cnt = 0;
		$childXml = $child->asXml();
		$this->rewind();
		while ($this->valid()) {
			if ($childXml === $this->current()->asXml()) {
				if (isset($this->{$this->key()}->{$cnt})) {
					unset($this->{$this->key()}->{$cnt});
				} else {
					unset($this->{$this->key()});
				}
				
				break;
			}
			$cnt++;
			$this->next();
		}
		$this->rewind();
	}
}

$xml = '<config><parent><child>text</child></parent></config>';
$xml = simplexml_load_string($xml, 'Config_SimpleXML');

$element = $xml->xpath('.//child', 0);
$element->parent()->removeChild($element);

?>

I use this to remove a node from an xml document. When i use the dom object to remove the node, the error doesn`t occur.

What I can say is that the error occurs not ever when i call the removeChild method. I have a script which has 2 calls of this method. The first call is ok the second throws this error. Whereat not the call himself is the segfault trigger, but in our environment where i can reproduce the error it is a exit statement that throws the segfault error.

A downgrade to version 5.2.2. fix this issue. I can remember that in version 5.1.6 the error occurs too.

 [2007-06-05 08:27 UTC] tony2001@php.net

>A downgrade to version 5.2.2. fix this issue.
I can reproduce it with 5.2.2, 5.2.1 and 5.2.0, so you seem to be wrong here.
Assigned to the extension maintainer (has nothing to do with the engine).

 [2007-06-07 12:14 UTC] christian dot kaps at imaxx21 dot com

>>A downgrade to version 5.2.2. fix this issue.
<I can reproduce it with 5.2.2, 5.2.1 and 5.2.0, so you seem to be wrong here.

You are right. The error occurs with version 5.2.2 too.
Can you tell me about the status of this bug?

 [2007-06-08 01:15 UTC] stas@php.net

FWIW, works for me on Linux Fedora 6, 5.2 CVS. Libxml is 2.6.28

 [2007-09-07 09:46 UTC] jani@php.net

Does this still happen with PHP 5.2.4?

 [2007-09-07 11:57 UTC] christian dot kaps at imaxx21 dot com

I can`t test it. Currently we use the dom extension to fix this issue in our sytem and i could only reproduce it there. With the single code snippet I couldn`t reproduce the error.

Perhaps tony2001 can test it? He could reproduce it with the snippet.

 [2007-09-07 13:03 UTC] jani@php.net

Antony, can you check this? (I can't reproduce it..)

 [2007-09-07 13:48 UTC] tony2001@php.net

Yes, I still can reproduce it:
==23397== Invalid read of size 8
==23397==    at 0x43F714: php_libxml_node_decrement_resource (libxml.c:1036)
==23397==    by 0x4FC4DD: sxe_object_free_storage (simplexml.c:1934)
==23397==    by 0x642746: zend_objects_store_del_ref_by_handle (zend_objects_API.c:206)
==23397==    by 0x64259E: zend_objects_store_del_ref (zend_objects_API.c:168)

etc..

 [2008-01-30 15:31 UTC] rrichards@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.