Fix crash when toggleAttribute() is used without a document

Author: nielsdos

NEWS

@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug GH-12870 (Creating an xmlns attribute results in a DOMException).
     (nielsdos)
+  . Fix crash when toggleAttribute() is used without a document. (nielsdos)
 
 - FFI:
   . Fixed bug GH-9698 (stream_wrapper_register crashes with FFI\CData).

ext/dom/element.c

@@ -1554,7 +1554,7 @@ PHP_METHOD(DOMElement, toggleAttribute)
 	}
 
 	/* Step 2 */
-	if (thisp->doc->type == XML_HTML_DOCUMENT_NODE && (thisp->ns == NULL || xmlStrEqual(thisp->ns->href, (const xmlChar *) "http://www.w3.org/1999/xhtml"))) {
+	if (thisp->doc != NULL && thisp->doc->type == XML_HTML_DOCUMENT_NODE && (thisp->ns == NULL || xmlStrEqual(thisp->ns->href, (const xmlChar *) "http://www.w3.org/1999/xhtml"))) {
 		qname_tmp = zend_str_tolower_dup_ex(qname, qname_length);
 		if (qname_tmp != NULL) {
 			qname = qname_tmp;

ext/dom/tests/DOMElement_toggleAttribute_without_document.phpt

@@ -0,0 +1,17 @@
+--TEST--
+DOMElement::toggleAttribute() without a document
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$element = new DOMElement("container");
+$element->toggleAttribute('foo', true);
+
+$dom = new DOMDocument;
+$element = $dom->importNode($element, true);
+echo $dom->saveXML($element), "\n";
+
+?>
+--EXPECT--
+<container foo=""/>