1--TEST-- 2GH-16777 (Calling the constructor again on a DOM object after it is in a document causes UAF) 3--EXTENSIONS-- 4dom 5--FILE-- 6<?php 7$el = new DOMElement('name'); 8$el->append($child = new DOMElement('child')); 9$doc = new DOMDocument(); 10$doc->appendChild($el); 11$el->__construct('newname'); 12$doc->appendChild($el); 13echo $doc->saveXML(); 14$dom2 = new DOMDocument(); 15try { 16 $dom2->appendChild($el); 17} catch (DOMException $e) { 18 echo $e->getMessage(), "\n"; 19} 20var_dump($child->ownerDocument === $doc); 21?> 22--EXPECT-- 23<?xml version="1.0"?> 24<name><child/></name> 25<newname/> 26Wrong Document Error 27bool(true) 28
