Share existing doc ref to avoid premature xmlDoc free.

devnexen · devnexen · commit cf959aeb4299 · 2026-03-24T18:33:57.000Z
NULL creates a disconnected php_libxml_ref_obj which frees the
xmlDoc on zval_ptr_dtor while the node still references it.
diff --git a/ext/xsl/xsltprocessor.c b/ext/xsl/xsltprocessor.c
@@ -196,7 +196,7 @@ PHP_METHOD(XSLTProcessor, importStylesheet)
 			RETURN_THROWS();
 		}
 
-		php_dom_create_object((xmlNodePtr) nodep->doc, &owner_zv, NULL);
+		php_dom_create_object((xmlNodePtr) nodep->doc, &owner_zv, php_dom_obj_from_obj(Z_OBJ_P(docp)));
 		docp = &owner_zv;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -196,7 +196,7 @@ PHP_METHOD(XSLTProcessor, importStylesheet)`
`196`	`196`	`RETURN_THROWS();`
`197`	`197`	`}`
`198`	`198`
`199`		`- php_dom_create_object((xmlNodePtr) nodep->doc, &owner_zv, NULL);`
	`199`	`+ php_dom_create_object((xmlNodePtr) nodep->doc, &owner_zv, php_dom_obj_from_obj(Z_OBJ_P(docp)));`
`200`	`200`	`docp = &owner_zv;`
`201`	`201`	`}`
`202`	`202`