From 0b9b7317099eb81f52f1d6bf4a2d105f44c27c4c Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 24 Aug 2026 10:50:03 -0400
Subject: [PATCH] [SimpleXML] Fix namespace filter on element returned by
 addChild()

The SimpleXMLElement wrapper returned by addChild() stored the QName
prefix as the iteration namespace filter in href mode, so property
accesses on the returned element compared the prefix against namespace
hrefs and never matched the children that asXML() shows. Derive the
filter from the namespace actually attached to the new node and use
prefix mode; sibling audit found no other call site passing a prefix in
href mode.
---
 NEWS                                          |  4 +++
 ext/simplexml/simplexml.c                     |  3 ++-
 .../addChild_ns_filter_returned_element.phpt  | 26 +++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 ext/simplexml/tests/addChild_ns_filter_returned_element.phpt

diff --git a/NEWS b/NEWS
index a2c65685b4ce..4f0c66cae313 100644
--- a/NEWS
+++ b/NEWS
@@ -41,6 +41,10 @@ PHP                                                                        NEWS
   . Fixed a leak when a persistent connection failed a liveness check
     with no other live PDO handle. (iliaal)
 
+- SimpleXML:
+  . Fixed child elements of the element returned by SimpleXMLElement::addChild()
+    not being accessible by property name when namespaces are involved. (iliaal)
+
 - Standard:
   . Fixed a memory leak in array_merge_recursive() when the recursive merge of
     an object converted to an array fails. (David Carlier)
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 1a346200199b..f8f6c9ec9d07 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1728,7 +1728,8 @@ PHP_METHOD(SimpleXMLElement, addChild)
 		}
 	}
 
-	node_as_zval_str(sxe, newnode, return_value, SXE_ITER_NONE, localname, prefix, 0);
+	node_as_zval_str(sxe, newnode, return_value, SXE_ITER_NONE, localname,
+		newnode->ns ? newnode->ns->prefix : NULL, 1);
 
 	xmlFree(localname);
 	if (prefix != NULL) {
diff --git a/ext/simplexml/tests/addChild_ns_filter_returned_element.phpt b/ext/simplexml/tests/addChild_ns_filter_returned_element.phpt
new file mode 100644
index 000000000000..246a58fb0667
--- /dev/null
+++ b/ext/simplexml/tests/addChild_ns_filter_returned_element.phpt
@@ -0,0 +1,26 @@
+--TEST--
+SimpleXML::addChild() wrong namespace filter on returned element
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+$x = new SimpleXMLElement('<r xmlns:a="http://example.com"/>');
+$c = $x->addChild('a:kid', null, 'http://example.com');
+$c->addChild('inner', 'v');
+echo trim($x->asXML()), "\n";
+echo (string) $c->inner, "\n";
+var_dump(isset($c->inner));
+$y = new SimpleXMLElement('<r xmlns:a="http://example.com"/>');
+$d = $y->addChild('kid', null, 'http://example.com');
+$d->addChild('inner', 'w');
+echo trim($y->asXML()), "\n";
+echo (string) $d->inner, "\n";
+?>
+--EXPECT--
+<?xml version="1.0"?>
+<r xmlns:a="http://example.com"><a:kid><a:inner>v</a:inner></a:kid></r>
+v
+bool(true)
+<?xml version="1.0"?>
+<r xmlns:a="http://example.com"><a:kid><a:inner>w</a:inner></a:kid></r>
+w