archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-17991: Assertion failure dom_attr_value_write

Browse source 
Closes GH-17995.
This commit is contained in:
Niels Dossche 2025-03-07 17:37:40 +01:00
parent 6004063206
commit 6083dc09a3
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 35 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -12,6 +12,9 @@ PHP NEWS
. Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect
results for closures created from magic __call()). (timwolla)
- DOM:
. Fixed bug GH-17991 (Assertion failure dom_attr_value_write). (nielsdos)
- Opcache:
. Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal
JIT). (nielsdos)

7
ext/dom/php_dom.c
View file

@ -372,13 +372,14 @@ static zend_always_inline const dom_prop_handler *dom_get_prop_handler(const dom
if (obj->prop_handler != NULL) {
if (cache_slot && *cache_slot == obj->prop_handler) {
hnd = *(cache_slot + 1);
hnd = cache_slot[1];
}
if (!hnd) {
hnd = zend_hash_find_ptr(obj->prop_handler, name);
if (cache_slot) {
*cache_slot = obj->prop_handler;
*(cache_slot + 1) = (void *) hnd;
cache_slot[0] = obj->prop_handler;
cache_slot[1] = (void *) hnd;
cache_slot[2] = NULL;
}
}
}

28
ext/dom/tests/gh17991.phpt Normal file
View file

@ -0,0 +1,28 @@
--TEST--
GH-17991 (Assertion failure dom_attr_value_write)
--EXTENSIONS--
dom
--FILE--
<?php
$attr = new DOMAttr("r", "iL");
class Box {
public ?Test $value;
}
class Test {
}
function test($box) {
var_dump($box->value = new Test);
}
$box = new Box();
test($box);
test($attr);
?>
--EXPECTF--
object(Test)#%d (0) {
}
Fatal error: Uncaught TypeError: Cannot assign Test to property DOMAttr::$value of type string in %s:%d
Stack trace:
#0 %s(%d): test(Object(DOMAttr))
#1 {main}
thrown in %s on line %d