From b2d778c36e8a3edbf5c11cd7ab475095fbb281cb Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Fri, 22 Dec 2023 21:12:59 +0100
Subject: [PATCH] Fix crash when toggleAttribute() is used without a document

---
 NEWS                                            |  1 +
 ext/dom/element.c                               |  2 +-
 ...lement_toggleAttribute_without_document.phpt | 17 +++++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 ext/dom/tests/DOMElement_toggleAttribute_without_document.phpt

diff --git a/NEWS b/NEWS
index 775265ea752..1161e854d2b 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug GH-12870 (Creating an xmlns attribute results in a DOMException).
     (nielsdos)
+  . Fix crash when toggleAttribute() is used without a document. (nielsdos)
 
 - FFI:
   . Fixed bug GH-9698 (stream_wrapper_register crashes with FFI\CData).
diff --git a/ext/dom/element.c b/ext/dom/element.c
index 133ae0d76f6..f87fbcccfef 100644
--- a/ext/dom/element.c
+++ b/ext/dom/element.c
@@ -1554,7 +1554,7 @@ PHP_METHOD(DOMElement, toggleAttribute)
 	}
 
 	/* Step 2 */
-	if (thisp->doc->type == XML_HTML_DOCUMENT_NODE && (thisp->ns == NULL || xmlStrEqual(thisp->ns->href, (const xmlChar *) "http://www.w3.org/1999/xhtml"))) {
+	if (thisp->doc != NULL && thisp->doc->type == XML_HTML_DOCUMENT_NODE && (thisp->ns == NULL || xmlStrEqual(thisp->ns->href, (const xmlChar *) "http://www.w3.org/1999/xhtml"))) {
 		qname_tmp = zend_str_tolower_dup_ex(qname, qname_length);
 		if (qname_tmp != NULL) {
 			qname = qname_tmp;
diff --git a/ext/dom/tests/DOMElement_toggleAttribute_without_document.phpt b/ext/dom/tests/DOMElement_toggleAttribute_without_document.phpt
new file mode 100644
index 00000000000..ecd930b487c
--- /dev/null
+++ b/ext/dom/tests/DOMElement_toggleAttribute_without_document.phpt
@@ -0,0 +1,17 @@
+--TEST--
+DOMElement::toggleAttribute() without a document
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$element = new DOMElement("container");
+$element->toggleAttribute('foo', true);
+
+$dom = new DOMDocument;
+$element = $dom->importNode($element, true);
+echo $dom->saveXML($element), "\n";
+
+?>
+--EXPECT--
+<container foo=""/>