DOMXPath breaks when not initialized properly

[DanielEScherzer]

Description

The following code:

<?php

class Demo extends DOMXPath {
    public function __construct() {}
    public function __debugInfo(): array {
        return ['x' => 'y'];
    }
}

var_dump( new Demo() );

Resulted in this output:

Segmentation fault

But I expected this output instead:

object(Demo)#1 (1) {
  ["x"]=>
  string(1) "y"
}

Valgrind

==23084== Invalid read of size 4
==23084==    at 0x45A7BB: php_dom_create_object (php_dom.c:1680)
==23084==    by 0x46976E: dom_xpath_document_read (xpath.c:181)
==23084==    by 0x454DBD: dom_get_debug_info_helper (php_dom.c:518)
==23084==    by 0x454E7E: dom_get_debug_info (php_dom.c:541)
==23084==    by 0x97868C: zend_std_get_properties_for (zend_object_handlers.c:2384)
==23084==    by 0x978826: zend_get_properties_for (zend_object_handlers.c:2433)
==23084==    by 0x73D66D: php_var_dump (var.c:178)
==23084==    by 0x73DC57: zif_var_dump (var.c:245)
==23084==    by 0x88D15C: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1287)
==23084==    by 0x909ACE: execute_ex (zend_vm_execute.h:58774)
==23084==    by 0x90E410: zend_execute (zend_vm_execute.h:64206)
==23084==    by 0x9A4E2B: zend_execute_script (zend.c:1928)
==23084==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

PHP Version

PHP 8.4 dev (f2fbb75)

Operating System

No response

[DanielEScherzer]

Does not affect any released version per https://3v4l.org/3UmEU

[cmb69]

DomXPath might need some is_initialized checks, or some other solution (ideally, the class would be final, I think).

[cmb69]

Does not affect any released version per https://3v4l.org/3UmEU

Oh, indeed. 1cb86b6 removed the (!obj) check, and that is properly documented:

php-src/UPGRADING.INTERNALS

Line 277 in f2fbb75

- php_dom_create_object() now no longer accepts a NULL obj argument.

cc @nielsdos

[nielsdos]

This is unrelated to debugInfo, you can leave that out and it'll break too.
This is already wrong on 8.2 as it returns NULL for the document, which isn't allowed because the property isn't nullable.
This should throw an INVALID_STATE_ERR type of DOMException when not initialized properly.