Fixes an existing TODO by @ndossche.
Notation nodes returned from $doctype->notations were not linked to their owning document or parent DocumentType. This caused several incorrect behaviour; including:
ownerDocument was missing
parentNode was NULL
isConnected returned false
baseURI fell back to "about:blank"
textContent returned an empty string instead of NULL
The last point is a violation of the DOM specification. Since Notation is not an Element, CharacterData, Attr, or DocumentFragment, its textContent must return NULL.
Spec reference: https://dom.spec.whatwg.org/#dom-node-textcontent
close GH-21868
Emit ZEND_ACC_PUBLIC_SET / PROTECTED_SET / PRIVATE_SET from the
corresponding Modifiers::*_SET flags in generated arginfo, gated
to PHP 8.4+ where asymmetric visibility was introduced. Previously
private(set) and friends in stubs parsed without error but produced
no set-visibility flag.
@readonly on DOM property stubs was documentation only and did not
translate to any runtime flag, so reflection reported the properties
as writable while the write_property handler threw on assignment.
Declaring them public private(set) lets the engine reject external
writes via the normal visibility check and lets ReflectionProperty::
isWritable() answer honestly.
After converting virtual properties from @readonly to private(set),
dom_write_property still threw a readonly-modification error. Since
the handler replaces zend_std_write_property, the engine's own
asymmetric-visibility check is bypassed on the write path, so the
DOM handler now raises it explicitly via
zend_asymmetric_visibility_property_modification_error() when the
caller lacks set access. The readonly error is kept as a fallback.
The `zend_string *s` parameter became unused after commit f754ffa8b2
(GH-20746) removed the `zend_oob_string_to_long_error()` calls.
This fixes an unused-parameter compiler warning and updates a stale
comment in zend_operators.c that incorrectly stated this function
can emit warnings.
Closes GH-21112
Prior to this patch there was a common read handler, and it relied on
the dom class set in the intern document. However, Dom\Implementation
allows creating DTDs unassociated with a document, so we can't rely on
an intern document and the check fails. This causes the ZVAL_NULL() path
to be taken.
To solve this, just split the handler.
Closes GH-21082.
It is possible to build libxml without HTML support, which would mean
that PHP does not support the saveHtml() features and HTML parsing in
general. It also adds some maintenance complexity. I'm not aware of any
distro that does this and it shows: this has been broken since stubs
have been introduced. So we can just drop it as clearly no one cares
about this or we would've known about it already. It also simplifies
downstream code because they can now rely on the HTML functionality to
always be available.
In the macOS 26 SDK, xmlFree is defined as a macro for free. This causes
issues where a same-named variable is used. Renaming the variable to
should_free resolves the issue.
See:
$ grep -B4 -A2 -n "#define xmlFree(" "Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.sdk/usr/include/libxml/globals.h"
261-#if defined(LIBXML_HAS_DEPRECATED_MEMORY_ALLOCATION_FUNCTIONS)
262-#define xmlMalloc(size) malloc(size)
263-#define xmlMallocAtomic(size) malloc(size)
264-#define xmlRealloc(ptr, size) realloc((ptr), (size))
265:#define xmlFree(ptr) free(ptr)
266-#define xmlMemStrdup(str) strdup(str)
267-#endif
Fixes:
```
In file included from /Library/Developer/CommandLineTools/SDKs/MacOSX26.sdk/usr/include/libxml/xmlIO.h:117,
from /Library/Developer/CommandLineTools/SDKs/MacOSX26.sdk/usr/include/libxml/parser.h:813,
from /private/tmp/php-20250914-13349-uqsk5o/php-8.4.12/ext/dom/php_dom.h:29,
from /private/tmp/php-20250914-13349-uqsk5o/php-8.4.12/ext/dom/attr.c:26:
/private/tmp/php-20250914-13349-uqsk5o/php-8.4.12/ext/dom/attr.c: In function 'dom_compare_value':
/private/tmp/php-20250914-13349-uqsk5o/php-8.4.12/ext/dom/attr.c:208:17: error: called object 'free' is not a function or function pointer
208 | xmlFree(attr_value);
| ^~~~~~~
/private/tmp/php-20250914-13349-uqsk5o/php-8.4.12/ext/dom/attr.c:204:14: note: declared here
204 | bool free;
| ^~~~
make: *** [ext/dom/attr.lo] Error 1
```
Closes GH-19832.
Signed-off-by: Ruoyu Zhong <zhongruoyu@outlook.com>
This never worked and creates a broken object,
and on master can cause a crash with foreach.
It makes no sense to fix a behaviour that never worked, block it
instead.
Closes GH-19089.
ParentNode::$children returns a HTMLCollection of all directly
descendant child elements of a container.
I had to move around some properties such that the ParentNode property
offsets are always at a fixed offset, to simplify the code.
This also adds the necessary code to deal with GC cycles in
HTMLCollections.
Furthermore, we also disable cloning a HTMLCollection as that never
worked and furthermore it also conflicts with the [[SameObject]] WebIDL
requirement of $children.
Only covers constants declared via stub files, others will be handled
separately in a later commit.
Does not include the intl extension, since that had some errors relating to the
cpp code; that extension will be updated separately.
The code was really messy with lots of checks and inconsistencies.
This splits everything up into different functions and now everything is
relayed to a handler vtable.
The $classList property is special in the sense that it's a cached
object instance per (HTML)Element instance. The reason for this design
is because it has the [[SameObject]] IDL attribute.
Cloning in PHP also clones the properties, so it also clones the cached
instance. To solve this, we undo this by resetting the backing storage.
Closes GH-18749.
* PHP-8.4:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
* PHP-8.3:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
For dynamic fetches the cache_slot will be NULL, so we have to check for
that when resetting the cache. For zip and xmlreader this couldn't
easily be tested because of a lack of writable properties.
Closes GH-18307.
The cache slot for FETCH_OBJ_W in function `test` is primed with the
class for C. The next call uses a simplexml instance and reuses the same
cache slot. simplexml's get_property_ptr handler does not use the cache
slot, so the old values remain in the cache slot. When
`zend_handle_fetch_obj_flags` is called this is not guarded by a check
for the class entry. So we end up using the prop_info from the property
C::$a instead of the simplexml property.
This patch adds a reset to the cache slots in the property address fetch
code and also in the extensions with a non-standard reference handler.
This keeps the run time cache consistent and avoids the issue without
complicating the fast paths.
Closes GH-17739.
Tim Düsterhus