Repository navigation
Conversation
A php:function() callback runs while libxml2 builds an XPath node-set, so modifying the tree or dropping the last reference to a detached subtree freed nodes the evaluation still referenced. While DOMXPath or Dom\XPath evaluates with PHP functions registered, the tree of the evaluated document, the tree of every node a callback returned and the detached subtrees of the context node and of callback arguments are read-only: modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR or, through SimpleXML, an Error, and the evaluation keeps those subtrees alive until it ends. New nodes and document properties stay modifiable.
This was referenced Nov 10, 2026
github-actions
Bot
added
Extension: dom
Extension: libxml
Extension: simplexml
ABI break
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A php:function() callback of DOMXPath or Dom\XPath runs while libxml2 builds the node-set, so a callback that removes nodes, assigns textContent, removes attributes or drops the last reference to a detached subtree frees nodes the evaluation still uses. While such an evaluation runs, the trees it can reach are read-only, and modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR (an Error through SimpleXML). New nodes and document properties stay modifiable, so building and returning a fragment from a callback still works. This adds fields to php_libxml_ref_obj, php_libxml_node_ptr and php_dom_xpath_callbacks, so it targets master. XSLT gets the same protection in a follow-up PR. Not covered: an id() node-set spanning two detached subtrees where a callback drops the last reference to the other one, and user error handlers during an evaluation with no PHP functions registered. Reported by Hem1700.