[Truta446]

Fixes GH-12168.

For an element returned by children() (SXE_ITER_CHILD), sxe_get_prop_hash() started at the first element child (via php_sxe_iterator_fetch()), but then walked the following siblings with plain node->next. So processing instructions and comments were included in var_dump() / (array) / json_encode() only when they came after the first element:

XML	(array) $root	(array) $root->children() before	after
<c><x/><?hello world?></c>	x, hello	x, hello	x, hello
<c><?hello world?><x/></c>	hello, x	x	hello, x
<c><!-- c --><x/></c>	comment, x	x	comment, x
<c>text</c>	0	(empty)	(empty)

The fix starts at the first child, like the SXE_ITER_NONE case does, so children() now matches the element itself. Text nodes are skipped for SXE_ITER_CHILD; otherwise an element containing only text would start exposing that text through children(). Iteration (foreach, count()) is unchanged, since it goes through the iterator, not the property table.

Targeting master because this changes var_dump()/json_encode() output for documents with a PI or comment before the first child element; I can retarget to PHP-8.4 if you consider it a plain bug fix.

Tests: new ext/simplexml/tests/gh12168.phpt (fails before, passes after). ext/simplexml, ext/dom and ext/libxml tests pass on master (debug NTS, and debug + ASan) and on PHP-8.4 (debug + ASan, and debug ZTS).

[devnexen]

Hi @Truta446, there is an inconsistency sxe_prop_is_empty() was left as is, so for
<c><?pi a?></c> (array) $c->children() gives ["pi"] while (bool) $c->children() is false.

Can we add the following as test case ?

foreach ([
    '<c><?pi a?></c>',
    '<c><!-- c --></c>',
    '<c>t<?pi a?></c>',
    '<!DOCTYPE c [<!ENTITY e "v">]><c>&e;<x/></c>',
] as $xml) {
    $sxe = simplexml_load_string($xml);
    echo $xml, ': ', json_encode(array_keys((array) $sxe->children())), PHP_EOL;
}
$sxe = simplexml_load_string('<c xmlns:a="urn:a"><?pi a?><y/><a:x/></c>');
var_dump(array_keys((array) $sxe->children('urn:a')));

[Truta446]

Thanks, good catch. I went the other way around rather than changing sxe_prop_is_empty(): making (bool) $el->children() true for an element that only has a PI or comment would change the common if ($el->children()) check (and count() would still be 0). So non-element children are now only included when there is at least one matching element child, which is the same condition sxe_prop_is_empty() uses; (array) is empty exactly when (bool) is false, including for children('urn:a') with no matching element.

I added your cases to gh12168.phpt, together with the (bool) checks. If you'd prefer making (bool) true instead, I can switch it.