AOT: DOMXPath query()->item()->setIdAttribute segfaults — compile-time attrs stolen from childNodes[$N] (ext/dom/xpath.c)

[PurHur]

Category

Regression · AOT · DOM XPath NodeList item / setIdAttribute (leftover #35433 / #27275)

Problem

DOMXPath::query('//b')->item(0) materializes the correct live element (nodeName=b, textContent=2) but thin-AOT rememberCompileTimeChildIndex ignores JitDomXPathQueryUserScript::lastQueryTag and treats item($N) as childNodes[$N]. That stamps compileTimeDomAttributes from sibling 0 (id=x).

getAttribute('id') then returns x; setIdAttribute('id', true) SIGSEGV.

Repro	Zend 8.2+	AOT (master)
loadXML <r><a id="x"/><b id="y"/></r>; query('//b')->item(0)->getAttribute('id')	y	x
then setIdAttribute('id', true)	y=b x=null	SIGSEGV (exit 139)

./script/aot-smoke.sh stays 8/8 (linker OK).

php-src reference

• php/php-src ext/dom/xpath.c — DOMXPath::query node-set
• php/php-src ext/dom/nodelist.c — item() is Nth match, not childNodes[$N]
• php/php-src ext/dom/element.c — setIdAttribute → xmlAddID

PHP implementation target

• ext/dom/JitDomNodeListItem.php — rememberCompileTimeChildIndex must honour JitDomXPathQueryUserScript::lastQueryTag() with the same tag-list → direct-child mapping as getElementsByTagName (Regression: AOT setIdAttribute via getElementsByTagName()->item() registers wrong id (re-#33957, ext/dom/element.c) #35433 / AOT: Element::getElementsByTagName()->item() returns wrong node / includes self for '*' — lastTagQuery never set (ext/dom/element.c) #34780)
• No new runtime/*.c

Repro

./script/aot-smoke.sh
./script/docker-exec.sh -- bash -lc 'php test/repro/aot_dom_xpath_item_setidattribute.php; php bin/compile.php -o /tmp/x.bin test/repro/aot_dom_xpath_item_setidattribute.php && /tmp/x.bin; echo rc:$?'

Done when

• AOT prints tag=b / y=b / x=null matching Zend (no segfault)
• AOT getAttribute('id') on the same item is y
• ./script/aot-smoke.sh stays 8/8

claim: dom-xml-specialist — fixing rememberCompileTimeChildIndex to map XPath lastQueryTag like getElementsByTagName this run.