fix bug #49634x

NEWS

@@ -11,6 +11,10 @@ PHP                                                                        NEWS
     1600). (Derick, T. Carter)
   . Fixed bug #61599 (Wrong Day of Week). (Derick, T. Carter)
 
+- XSL
+  . Fixed bug #49634 (Segfault throwing an exception in a XSL registered
+    function). (Mike)
+
 ?? ??? 2013, PHP 5.4.23
 
 - Core:

ext/xsl/tests/bug49634.phpt

@@ -0,0 +1,105 @@
+--TEST--
+bug #49634 (Segfault throwing an exception in a XSL registered function)
+--SKIPIF--
+<?php
+extension_loaded("xsl") or die("skip need ext/xsl");
+?>
+--FILE--
+<?php
+
+$sXml = <<<XML
+<?xml version="1.0" encoding="UTF-8" ?>
+<root>
+	test
+</root>
+XML;
+
+$cDIR = __DIR__;
+$sXsl = <<<XSL
+<xsl:stylesheet version="1.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                xmlns:ext="http://php.net/xsl"
+                xsl:extension-element-prefixes="ext"
+                exclude-result-prefixes="ext">
+	<xsl:output encoding="UTF-8" indent="yes" method="xml" />
+	<xsl:template match="/">
+		<xsl:value-of select="ext:function('testFunction', document('$cDIR/bug49634.xml')/root)"/>
+	</xsl:template>
+</xsl:stylesheet>
+XSL;
+
+function testFunction($a)
+{
+		throw new Exception('Test exception.');
+}
+
+$domXml = new DOMDocument;
+$domXml->loadXML($sXml);
+$domXsl = new DOMDocument;
+$domXsl->loadXML($sXsl);
+
+for ($i = 0; $i < 10; $i++)
+{
+	$xsltProcessor = new XSLTProcessor();
+	$xsltProcessor->registerPHPFunctions(array('testFunction'));
+	$xsltProcessor->importStyleSheet($domXsl);
+	try {
+		@$xsltProcessor->transformToDoc($domXml);
+	} catch (Exception $e) {
+		echo $e,"\n";
+	}
+}
+?>
+===DONE===
+--EXPECTF--
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+exception 'Exception' with message 'Test exception.' in %s:%d
+Stack trace:
+#0 [internal function]: testFunction(Array)
+#1 %s(%d): XSLTProcessor->transformToDoc(Object(DOMDocument))
+#2 {main}
+===DONE===

ext/xsl/tests/bug49634.xml

@@ -0,0 +1 @@
+<root/>

ext/xsl/xsltprocessor.c

@@ -279,7 +279,10 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 								node->type = XML_NAMESPACE_DECL;
 								node->parent = nsparent;
 								node->ns = curns;
+							} else {
+								node = xmlDocCopyNodeList(domintern->document->ptr, node);
 							}
+
 							child = php_dom_create_object(node, &ret, child, domintern TSRMLS_CC);
 							add_next_index_zval(args[i], child);
 						}