[xml] exception/segfault on xmlFreeDoc()

[<oliverst online de>]

When I run test_LoadDocument() I get a exception/segfault in the
xmlFreeDoc() after the successful LoadDocument.

With MSVC++ and libxml2-2.6.5 it crashes in dict.c line 709, because
dict has already been free'd. 

The libxml2 has been linked statically and was compiled with teh
following configuration and defines:

cscript configure.js xml_debug=no debug=no static=yes iconv=no
schemas=no regexps=no docb=no threads=native ftp=no http=no reader=no
walker=no legacy=no xpath=yes xptr=no catalog=no xinclude=no c14n=no
cruntime=/MT

LIBXML_STATIC / LIBXML_STATIC_FOR_DLL / _REENTRANT / HAVE_WIN32_THREADS

And trying an older version (I don't have the version number handy) in
MinGW also crashes. The crash does happen in valid.c line 2856
(xmlGetDtdAttrDesc() -> if (dtd->attributes == NULL) return(NULL);)
because dtd has already been free'd.

I looked all over it and couldn't see the problem at all. It all looked
fine to me. I unlinked the nodes properly.

Here is the code:

bool CreateXMLDocument(xmlDocPtr* ppDoc)
{
    try
    {
        if (ppDoc == NULL) return false;

                *ppDoc = NULL;

                *ppDoc = xmlNewDoc(BAD_CAST "1.0");

                if( *ppDoc != NULL )
                        return true;
    }
    catch (...) { }
        return false;
}

int CreateLoadXMLDoc(xmlDocPtr* ppDoc, const char* Filename)
{
    try
    {
            if (ppDoc == NULL) return -1;
            *ppDoc = NULL;
            
            // Create XML document
            xmlDocPtr pXMLDoc = NULL;
            if (!CreateXMLDocument(&pXMLDoc))
                    return -1;
            
            // Load XML file, if a file name is given
            if (Filename)
            {
                        pXMLDoc = xmlParseFile(Filename);

                        if( pXMLDoc == NULL )
                                return -1;
            }
            
            *ppDoc = pXMLDoc;
            
            return 0;
    }
    catch (...)
    {
        return -1;
    }
}

bool LoadDocument(const char* Filename, xmlDocPtr pDoc)
{
        xmlDocPtr doc = NULL;
        xmlNodePtr root = NULL, new_root = NULL;

        root = pDoc->children;  

        if( root ) {
                xmlUnlinkNode(root);
                xmlFree(root);
        }

        if( CreateLoadXMLDoc(&doc, Filename) != 0 )
                return false;

        new_root = doc->children;

        if( new_root == NULL ) 
                return false;
        
        xmlUnlinkNode(new_root);

        if( doc )
                xmlFreeDoc(doc);

        xmlDocSetRootElement(pDoc, new_root);

        if( pDoc == NULL )
                return false;

        return true;
}

bool test_LoadDocument()
{
        xmlDocPtr doc = NULL;

        if( !CreateXMLDocument(&doc) ) {
                return false;
        }

        if( LoadDocument("_pluginList.xml", doc) ) {
                xmlFreeDoc(doc);
                return true;
        }

        xmlFreeDoc(doc);

        return false;
}