[Note: PHP version is 4.1.1 -- the drop-down box has 4.1.0 as latest version]

Script:
<?
    $processor = xslt_create();

    $args = array();
    $args[ '/xml' ] = '<?xml version="1.0"?><root />';
    $args[ '/xsl' ] = '<?xml version="1.0"?><root />';

    for( $i = 0; $i < 1000; ++$i )
    {
        if( !$result = xslt_process( $processor, 'arg:/xml', 'arg:/xsl', NULL, $args ) )
        {
            echo 'failed';
        }
    }

    xslt_free( $processor );

    echo 'done';
?>


Config line:
'./configure' '--with-config-file-path=/etc' '--with-pgsql' '--with-apxs=/usr/apache/bin/apxs' '--with-xml' '--enable-xslt' '--with-xslt-sablot' '--with-mysql=no' '--with-gd' '--enable-debug'


Description:
When I visit this script, and hit refresh (several times) Apache terminates with a segmentation fault. The bug appears to be random because there are times when the script finishes without a crash.


Backtrace:
#0  __libc_free (mem=0x2) at malloc.c:3036
#1  0x0809ab8e in hashTableDestroy () at eval.c:41
#2  0x08099b4d in dtdDestroy () at eval.c:41
#3  0x0809425d in XML_ParserFree () at eval.c:41
#4  0x40370e4a in TreeConstructer::parseDataLineUsingExpat (this=0xbfffdd90, S=@0x811cff8, t=0x8130520,
    d=0x81304c0) at parser.cpp:126
#5  0x40383034 in Tree::parse (this=0x8130520, S=@0x811cff8, d=0x81304c0) at tree.cpp:600
#6  0x40375951 in Processor::addLineParse (this=0x811d0a8, S=@0x811cff8, newTree=@0x811d0a8,
    absolute=@0xbfffde40, isXSL=0) at guard.h:157
#7  0x4037602e in Processor::readTreeFromURI (this=0x811d0a8, S=@0x811cff8, newTree=@0x811d0a8,
    location=@0xbfffdf10, base=@0xbfffdef0, isXSL=0) at proc.cpp:602
#8  0x40373d91 in Processor::open (this=0x811d0a8, S=@0x811cff8, sheetURI=0x811dadc "arg:/xsl",
    inputURI=0x811dc14 "arg:/xml") at proc.cpp:277
#9  0x40379633 in SablotRunProcessor (processor_=0x811d0a8, sheetURI=0x811dadc "arg:/xsl",
    inputURI=0x811dc14 "arg:/xml", resultURI=0x402d9683 "arg:/_result", params=0x0, arguments=0x811dc54)
    at sablot.cpp:407
#10 0x402af84a in zif_xslt_process (ht=5, return_value=0x811db5c, this_ptr=0x0, return_value_used=1)
    at sablot.c:514
#11 0x401dcca1 in execute (op_array=0x81123a4) at ./zend_execute.c:1590
#12 0x401ed66c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814
#13 0x401ff82a in php_execute_script (primary_file=0xbffff6e0) at main.c:1307
#14 0x401fa65a in apache_php_module_main (r=0x810a034, display_source_mode=0) at sapi_apache.c:90
#15 0x401fb4c8 in send_php (r=0x810a034, display_source_mode=0,
    filename=0x810f5e4 "/home/apache/html/geeba/crash.php") at mod_php4.c:575
#16 0x401fb535 in send_parsed_php (r=0x810a034) at mod_php4.c:590
#17 0x0806a7ff in ap_invoke_handler () at eval.c:41
#18 0x0807e5eb in process_request_internal () at eval.c:41
#19 0x0807e64c in ap_process_request () at eval.c:41
#20 0x08075a9d in child_main () at eval.c:41
#21 0x08075c48 in make_child () at eval.c:41
#22 0x08075dbc in startup_children () at eval.c:41
#23 0x0807640f in standalone_main () at eval.c:41
#24 0x08076c37 in main () at eval.c:41
#25 0x4008f177 in __libc_start_main (main=0x8076898 <main>, argc=2, ubp_av=0xbffffb14,
    init=0x804ed14 <_init>, fini=0x80abac0 <_fini>, rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbffffb0c)
    at ../sysdeps/generic/libc-start.c:129


Hope this helps. Thank you very much,
Valeriy