PATCH: Re: [xml] Segfault freeing doc after replaceNode() in python

[Brent Hendricks <brentmh rice edu>]

I think I have a fix for this now:

xmlReplaceNode() was setting cur->doc directly.  If instead I change 
that to call xmlSetTreeDoc() everything works fine.


Daniel Veillard wrote:
> On Wed, May 04, 2005 at 05:47:23PM -0500, Brent Hendricks wrote:
>
> > The attached script is a copy of the included python test file 
> > cutnpaste.py with two important differences:
> >
> > 1) It uses replaceNode() instead of addChild() to put the 'cut' node 
> > into the destination document
> >
> > 2) It segfaults :(
> >
> > My guess is that somehow the cut/replaced node is being freed twice.  If 
> > I comment out the freeDoc line for either the source or target it stops 
> > segfaulting (but then of course, leaks memory).
> >
> > Any ideas?

Brent
--

-------------------------------------------------------------------------

"The programmer, like the poet, works only slightly removed from pure
 thought-stuff.  He builds his castles in the air, from air, creating
 by exertion of the imagination.  Few media of creation are so
 flexible, so easy to polish and rework, so readily capable of
 realizing grand conceptual structures."
                        -- Frederick Brooks, Jr., The Mythical Man Month

--- tree.c      10 May 2005 15:28:08 -0000      1.342
+++ tree.c      11 May 2005 16:47:20 -0000
@@ -3469,7 +3469,7 @@
        return(old);
     }
     xmlUnlinkNode(cur);
-    cur->doc = old->doc;
+    xmlSetTreeDoc(cur, old->doc);
     cur->parent = old->parent;
     cur->next = old->next;
     if (cur->next != NULL)