Segmentation fault (access null pointer) in ext/dom/token_list.c

[YuanchengJiang]

Description

The following code:

<?php
$classes = get_declared_classes();
foreach ($classes as $className) {
$rc = new ReflectionClass($className);
try {
$obj = $rc->newInstanceWithoutConstructor();
} catch (Throwable $e) {
}
$properties = $rc->getProperties();
foreach ($properties as $property) {
try {
if ($property->isStatic()) {
} else if ($obj !== null) {
$value = $property->getValue($obj);
}
} catch (Throwable $e) {
}
}
}

Resulted in this output:

/php-src/ext/dom/token_list.c:204:7: runtime error: member access within null pointer of type 'php_libxml_node_ptr' (aka 'struct _php_libxml_node_ptr')

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

The Dom\Element class is normally not constructible, it achieves this by having a private final constructor that throws. The fact that Reflection allows to construct it anyway is imho a design fault of Reflection, not a bug in DOM. I refuse to fix this in DOM as it would just work around the stupid design of allowing Reflection to construct internal classes with a constructor without actually calling it. There's likely more issues with DOM when you do stuff like this.
Same root cause as #16217, so I'm closing this as a duplicate.