Assertion failure in ext/dom/parentnode/tree.c

[chibinz]

Description

The following code:

<?php

$comment = new DOMComment ( "h" );
$element = new DOMElement ( "N" , "W" , "y" );
$attr = new DOMAttr ( "c" , "n" );
$doc = new DOMDocument (  );
$doc -> adoptNode ( $element );
$element -> setAttributeNodeNS ( $attr );
$attr -> insertBefore ( $comment );
$comment -> replaceWith ( "Q" );

Resulted in this output:

php: /tmp/php-afl/ext/dom/parentnode/tree.c:243: _Bool dom_is_pre_insert_valid_without_step_1(php_libxml_ref_obj *, xmlNodePtr, xmlNodePtr, xmlNodePtr, xmlDocPtr): Assertion `!php_dom_pre_insert_is_parent_invalid(parentNode)' failed.

But I expected this output instead:

no crash

PHP Version

PHP 8.4.0-dev

Operating System

No response

[ndossche]

Problem is that the constraints of the DOM tree are broken because a comment is inserted as a child of an attribute, this should not be possible. This is because the old DOM doesn't follow spec, bleh