[xml] using xmlDocSetRootElement to move nodes between documents

[Martijn Faassen <faassen infrae com>]

Hi there,

I've spent quite a bit of trying to track down a segfault in my code, 
and I think I may have found the cause. The following test code:

#include "libxml/tree.h"

int main() {
  xmlDoc* doc1;
  xmlDoc* doc2;
  xmlNode* node;

  doc1 = xmlParseDoc("<doc>Foo</doc>");
  doc2 = xmlNewDoc("1.0");
  node = xmlDocGetRootElement(doc1);
  xmlDocSetRootElement(doc2, node);
  xmlFreeDoc(doc1);
  xmlFreeDoc(doc2);
}

doesn't seem to be safe; xmlFreeDoc(doc2) apparently tries to free 
something already freed in xmlFreeDoc(doc1). This is what valgrind says:

==14012== Memcheck, a memory error detector for x86-linux.
==14012== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward.
==14012== Using valgrind-2.1.1, a program supervision framework for 
x86-linux.
==14012== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward.
==14012== For more details, rerun with: -v
==14012==
==14012== Invalid read of size 4
==14012==    at 0x3C06BD64: xmlFreeNodeList (in /usr/lib/libxml2.so.2.6.11)
==14012==    by 0x3C06BD9F: xmlFreeNodeList (in /usr/lib/libxml2.so.2.6.11)
==14012==    by 0x3C06972C: xmlFreeDoc (in /usr/lib/libxml2.so.2.6.11)
==14012==    by 0x8048607: main (in /home/faassen/working/lxml/foo)
==14012==  Address 0x3C163918 is 80 bytes inside a block of size 88 free'd
==14012==    at 0x3C01F918: free (vg_replace_malloc.c:127)
==14012==    by 0x3C0696FD: xmlFreeDoc (in /usr/lib/libxml2.so.2.6.11)
==14012==    by 0x80485FC: main (in /home/faassen/working/lxml/foo)
==14012==
==14012== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==14012== malloc/free: in use at exit: 670 bytes in 20 blocks.
==14012== malloc/free: 43 allocs, 23 frees, 13112 bytes allocated.
==14012== For a detailed leak analysis,  rerun with: --leak-check=yes
==14012== For counts of detected errors, rerun with: -v

is moving nodes between documents in general not supported this way?

Regards,

Martijn