Fix bug #32755 Segfault in replaceChild() when DocumentFragment has no children

update test

diff --git a/ext/dom/node.c b/ext/dom/node.c
index 8a581baa19db2aa210132b9c08a315f12cdc4d28..cba2f80b54d6767f03b1eda776ade44077ffe053 100644 (file)
--- a/ext/dom/node.c
+++ b/ext/dom/node.c
@@ -1134,7 +1134,9 @@ PHP_FUNCTION(dom_node_replace_child)
                        xmlUnlinkNode(oldchild);
 
                        newchild = _php_dom_insert_fragment(nodep, prevsib, nextsib, newchild, intern, newchildobj TSRMLS_CC);
-                       dom_reconcile_ns(nodep->doc, newchild);
+                       if (newchild) {
+                               dom_reconcile_ns(nodep->doc, newchild);
+                       }
                } else if (oldchild != newchild) {
                        if (newchild->doc == NULL && nodep->doc != NULL) {
                                xmlSetTreeDoc(newchild, nodep->doc);

diff --git a/ext/dom/tests/bug32615.phpt b/ext/dom/tests/bug32615.phpt
index 84891f3bb45687cea4e61283b1d0f5a1a4d99ef1..e48973429a77d980b6f748b67da90be17c12733f 100644 (file)
--- a/ext/dom/tests/bug32615.phpt
+++ b/ext/dom/tests/bug32615.phpt
@@ -62,6 +62,12 @@ $frag->appendChild(new DOMElement('second'));
 $frag->appendChild(new DOMElement('third'));
 $root->insertBefore($frag, $node);
 
+echo $dom->saveXML()."\n";
+
+$frag = $dom->createDocumentFragment();
+$root = $dom->documentElement;
+$root->replaceChild($frag, $root->firstChild);
+
 echo $dom->saveXML();
 
 ?>
@@ -73,3 +79,6 @@ echo $dom->saveXML();
 <?xml version="1.0"?>
 <root><first/><second/><third/><fourth/></root>
 
+<?xml version="1.0"?>
+<root><second/><third/><fourth/></root>
+