Fix #77686: Immediately remove ID from document when removing child

trowski · trowski · commit 17744195b6e0 · 2021-05-03T17:43:08.000-05:00
Prior a removed node was still returned from DOMDocument::getElementById() until the DOMElement object was destroyed. Now null is returned from getElementById() even if a reference remains to the removed DOMElement object.
diff --git a/ext/dom/node.c b/ext/dom/node.c
@@ -1186,6 +1186,7 @@ PHP_FUNCTION(dom_node_remove_child)
 	xmlNodePtr children, child, nodep;
 	dom_object *intern, *childobj;
 	int ret, stricterror;
+	xmlAttrPtr attrp;
 
 	id = ZEND_THIS;
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "O", &node, dom_node_class_entry) == FAILURE) {
@@ -1217,6 +1218,17 @@ PHP_FUNCTION(dom_node_remove_child)
 	while (children) {
 		if (children == child) {
 			xmlUnlinkNode(child);
+
+			attrp = child->properties;
+			while (attrp) {
+				if (attrp->type == XML_ATTRIBUTE_ID) {
+					xmlRemoveID(attrp->doc, attrp);
+					attrp->atype = 0;
+					break;
+				}
+				attrp = attrp->next;
+			}
+
 			DOM_RET_OBJ(child, &ret, intern);
 			return;
 		}
diff --git a/ext/dom/tests/bug77686.phpt b/ext/dom/tests/bug77686.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77686 Removed elements are still returned by getElementById
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$doc = new DOMDocument;
+$doc->loadHTML('<html><body id="x"><div id="y"></div></body></html>');
+$body = $doc->getElementById('x');
+$div = $doc->getElementById('y');
+$body->removeChild($div);
+var_dump($doc->getElementById('y'));
+
+?>
+--EXPECT--
+NULL
