Fix GH-21548: Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS().

The xmlns attribute unlinking code in dom_relink_ns_decls_element was
clobbering attr->prev instead of updating the predecessor's next pointer,
leaving non-first xmlns attributes reachable in the properties list.
C14N then output them both as nsDef entries and as attributes.

close GH-21566

Author: devnexen

NEWS

@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-19983 (GC assertion failure with fibers, generators and
     destructors). (iliaal)
 
+- DOM:
+  . Fixed bug GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns
+    declarations after setAttributeNS()). (David Carlier)
+
 - SPL:
   . Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent
     free). (Girgias)

ext/dom/node.c

@@ -2132,7 +2132,7 @@ static void dom_relink_ns_decls_element(HashTable *links, xmlNodePtr node)
 
 				ns->_private = attr;
 				if (attr->prev) {
-					attr->prev = attr->next;
+					attr->prev->next = attr->next;
 				} else {
 					node->properties = attr->next;
 				}

ext/dom/tests/modern/xml/gh21548.phpt

@@ -0,0 +1,17 @@
+--TEST--
+GH-21548 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS())
+--CREDITS--
+Toon Verwerft (veewee)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+
+$doc = Dom\XMLDocument::createFromString('<root xmlns="urn:a" attr="val"/>');
+$doc->documentElement->setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:ns1", "urn:a");
+
+echo $doc->C14N() . PHP_EOL;
+
+?>
+--EXPECT--
+<root xmlns="urn:a" xmlns:ns1="urn:a" attr="val"></root>