applied patch from Marton Illes to fix an allocation bug in

* xmlschemas.c: applied patch from Marton Illes to fix an allocation
  bug in xmlSchemaXPathEvaluate should close #351032
Daniel
diff --git a/doc/devhelp/libxml2-tree.html b/doc/devhelp/libxml2-tree.html
index d7757e3..7cb9872 100644
--- a/doc/devhelp/libxml2-tree.html
+++ b/doc/devhelp/libxml2-tree.html
@@ -187,6 +187,7 @@
 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a>	<a href="#xmlCopyNode">xmlCopyNode</a>		(const <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>					 int extended);
 void	<a href="#xmlUnlinkNode">xmlUnlinkNode</a>			(<a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> cur);
 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> *	<a href="#xmlSplitQName3">xmlSplitQName3</a>		(const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> * name, <br/>					 int * len);
+typedef <a href="libxml2-tree.html#xmlNsPtr">xmlNsPtr</a> <a href="#xmlDOMWrapAcquireNsFunction">xmlDOMWrapAcquireNsFunction</a>	(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>						 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>						 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> * nsName, <br/>						 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> * nsPrefix);
 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a>	<a href="#xmlDocSetRootElement">xmlDocSetRootElement</a>	(<a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> doc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> root);
 long	<a href="#xmlGetLineNo">xmlGetLineNo</a>			(<a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node);
 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> *	<a href="#xmlBufferContent">xmlBufferContent</a>	(const <a href="libxml2-tree.html#xmlBufferPtr">xmlBufferPtr</a> buf);
@@ -385,7 +386,10 @@
 </div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapCtxt">Structure </a>xmlDOMWrapCtxt</h3><pre class="programlisting">struct _xmlDOMWrapCtxt {
-    void *	_private
+    void *	_private	: * The type of this context, just in case we need specialized * context
+    int	type	: * Internal namespace map used for various operations. *
+    void *	namespaceMap	: * Use this one to acquire an <a href="libxml2-tree.html#xmlNsPtr">xmlNsPtr</a> intended for node-&gt;ns. * (Note t
+    <a href="libxml2-tree.html#xmlDOMWrapAcquireNsFunction">xmlDOMWrapAcquireNsFunction</a>	getNsForNodeFunc
 } xmlDOMWrapCtxt;
 </pre><p/>
 </div>
@@ -640,6 +644,7 @@
     const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> *	href	: URL for the namespace
     const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> *	prefix	: prefix for the namespace
     void *	_private	: application data
+    struct _xmlDoc *	context	: normally an <a href="libxml2-tree.html#xmlDoc">xmlDoc</a>
 } xmlNs;
 </pre><p/>
 </div>
@@ -869,6 +874,10 @@
 </pre><p/>
 </div>
         <hr/>
+        <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapAcquireNsFunction"/>Function type xmlDOMWrapAcquireNsFunction</h3><pre class="programlisting"><a href="libxml2-tree.html#xmlNsPtr">xmlNsPtr</a>	xmlDOMWrapAcquireNsFunction	(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>						 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>						 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> * nsName, <br/>						 const <a href="libxml2-xmlstring.html#xmlChar">xmlChar</a> * nsPrefix)<br/>
+</pre><p>A function called to acquire namespaces (xmlNs) from the wrapper.</p>
+<div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>ctxt</tt></i>:</span></td><td>a DOM wrapper context</td></tr><tr><td><span class="term"><i><tt>node</tt></i>:</span></td><td>the context node (element or attribute)</td></tr><tr><td><span class="term"><i><tt>nsName</tt></i>:</span></td><td>the requested namespace name</td></tr><tr><td><span class="term"><i><tt>nsPrefix</tt></i>:</span></td><td>the requested namespace prefix</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>an <a href="libxml2-tree.html#xmlNsPtr">xmlNsPtr</a> or NULL in case of an error.</td></tr></tbody></table></div></div>
+        <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlAddChild"/>xmlAddChild ()</h3><pre class="programlisting"><a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a>	xmlAddChild		(<a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> parent, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> cur)<br/>
 </pre><p>Add a new node to @parent, at the end of the child (or property) list merging adjacent TEXT nodes (in which case @cur is freed) If the new node is ATTRIBUTE, it is added into properties instead of children. If there is an <a href="libxml2-SAX.html#attribute">attribute</a> with equal name, it is first destroyed.</p>
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>parent</tt></i>:</span></td><td>the parent node</td></tr><tr><td><span class="term"><i><tt>cur</tt></i>:</span></td><td>the child node</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>the child or NULL in case of error.</td></tr></tbody></table></div></div>
@@ -1010,11 +1019,11 @@
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>doc</tt></i>:</span></td><td>the document pointer</td></tr><tr><td><span class="term"><i><tt>name</tt></i>:</span></td><td>the DTD name</td></tr><tr><td><span class="term"><i><tt>ExternalID</tt></i>:</span></td><td>the external (PUBLIC) ID</td></tr><tr><td><span class="term"><i><tt>SystemID</tt></i>:</span></td><td>the system ID</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>a pointer to the new DTD structure</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapAdoptNode"/>xmlDOMWrapAdoptNode ()</h3><pre class="programlisting">int	xmlDOMWrapAdoptNode		(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> sourceDoc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> destDoc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> destParent, <br/>					 int options)<br/>
-</pre><p>References of out-of scope ns-decls are remapped to point to @destDoc: 1) If @destParent is given, then nsDef entries on element-nodes are used 2) If *no* @destParent is given, then @destDoc-&gt;oldNs entries are used This is the case when you have an unliked node and just want to move it to the context of If @destParent is given, it ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. WARNING: This function is in a experimental state.</p>
+</pre><p>References of out-of scope ns-decls are remapped to point to @destDoc: 1) If @destParent is given, then nsDef entries on element-nodes are used 2) If *no* @destParent is given, then @destDoc-&gt;oldNs entries are used This is the case when you have an unliked node and just want to move it to the context of If @destParent is given, it ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. NOTE: This function was not intensively tested.</p>
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>ctxt</tt></i>:</span></td><td>the optional context for custom processing</td></tr><tr><td><span class="term"><i><tt>sourceDoc</tt></i>:</span></td><td>the optional sourceDoc</td></tr><tr><td><span class="term"><i><tt>node</tt></i>:</span></td><td>the node to start with</td></tr><tr><td><span class="term"><i><tt>destDoc</tt></i>:</span></td><td>the destination doc</td></tr><tr><td><span class="term"><i><tt>destParent</tt></i>:</span></td><td>the optional new parent of @node in @destDoc</td></tr><tr><td><span class="term"><i><tt>options</tt></i>:</span></td><td>option flags</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 if the operation succeeded, 1 if a node of unsupported type was given, 2 if a node of not yet supported type was given and -1 on API/internal errors.</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapCloneNode"/>xmlDOMWrapCloneNode ()</h3><pre class="programlisting">int	xmlDOMWrapCloneNode		(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> sourceDoc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> * resNode, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> destDoc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> destParent, <br/>					 int deep, <br/>					 int options)<br/>
-</pre><p>References of out-of scope ns-decls are remapped to point to @destDoc: 1) If @destParent is given, then nsDef entries on element-nodes are used 2) If *no* @destParent is given, then @destDoc-&gt;oldNs entries are used This is the case when you have an unliked node and just want to move it to the context of If @destParent is given, it ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. TODO: 1) Support dicts Optimize string adoption for equal or none dicts. 2) XInclude WARNING: This function is in a experimental state and should only be currently only be used to test it.</p>
+</pre><p>References of out-of scope ns-decls are remapped to point to @destDoc: 1) If @destParent is given, then nsDef entries on element-nodes are used 2) If *no* @destParent is given, then @destDoc-&gt;oldNs entries are used. This is the case when you don't know already where the cloned branch will be added to. If @destParent is given, it ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. TODO: 1) What to do with XInclude? Currently this returns an error for XInclude.</p>
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>ctxt</tt></i>:</span></td><td>the optional context for custom processing</td></tr><tr><td><span class="term"><i><tt>sourceDoc</tt></i>:</span></td><td>the optional sourceDoc</td></tr><tr><td><span class="term"><i><tt>node</tt></i>:</span></td><td>the node to start with</td></tr><tr><td><span class="term"><i><tt>resNode</tt></i>:</span></td><td>the clone of the given @node</td></tr><tr><td><span class="term"><i><tt>destDoc</tt></i>:</span></td><td>the destination doc</td></tr><tr><td><span class="term"><i><tt>destParent</tt></i>:</span></td><td>the optional new parent of @node in @destDoc</td></tr><tr><td><span class="term"><i><tt>deep</tt></i>:</span></td><td>descend into child if set</td></tr><tr><td><span class="term"><i><tt>options</tt></i>:</span></td><td>option flags</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 if the operation succeeded, 1 if a node of unsupported (or not yet supported) type was given, -1 on API/internal errors.</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapFreeCtxt"/>xmlDOMWrapFreeCtxt ()</h3><pre class="programlisting">void	xmlDOMWrapFreeCtxt		(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt)<br/>
@@ -1026,11 +1035,11 @@
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>the <a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> or NULL in case of an internal errror.</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapReconcileNamespaces"/>xmlDOMWrapReconcileNamespaces ()</h3><pre class="programlisting">int	xmlDOMWrapReconcileNamespaces	(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> elem, <br/>					 int options)<br/>
-</pre><p>Ensures that ns-references point to ns-decls hold on element-nodes. Ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. WARNING: This function is in a experimental state.</p>
+</pre><p>Ensures that ns-references point to ns-decls hold on element-nodes. Ensures that the tree is namespace wellformed by creating additional ns-decls where needed. Note that, since prefixes of already existent ns-decls can be shadowed by this process, it could break QNames in <a href="libxml2-SAX.html#attribute">attribute</a> values or element content. NOTE: This function was not intensively tested.</p>
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>ctxt</tt></i>:</span></td><td>DOM wrapper context, unused at the moment</td></tr><tr><td><span class="term"><i><tt>elem</tt></i>:</span></td><td>the element-node</td></tr><tr><td><span class="term"><i><tt>options</tt></i>:</span></td><td>option flags</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 if succeeded, -1 otherwise and on API/internal errors.</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDOMWrapRemoveNode"/>xmlDOMWrapRemoveNode ()</h3><pre class="programlisting">int	xmlDOMWrapRemoveNode		(<a href="libxml2-tree.html#xmlDOMWrapCtxtPtr">xmlDOMWrapCtxtPtr</a> ctxt, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> doc, <br/>					 <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>					 int options)<br/>
-</pre><p>Unlinks the given node from its owner. This will substitute ns-references to node-&gt;nsDef for ns-references to doc-&gt;oldNs, thus ensuring the removed branch to be autark wrt ns-references. WARNING: This function is in a experimental state.</p>
+</pre><p>Unlinks the given node from its owner. This will substitute ns-references to node-&gt;nsDef for ns-references to doc-&gt;oldNs, thus ensuring the removed branch to be autark wrt ns-references. NOTE: This function was not intensively tested.</p>
 <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>ctxt</tt></i>:</span></td><td>a DOM wrapper context</td></tr><tr><td><span class="term"><i><tt>doc</tt></i>:</span></td><td>the doc</td></tr><tr><td><span class="term"><i><tt>node</tt></i>:</span></td><td>the node to be removed.</td></tr><tr><td><span class="term"><i><tt>options</tt></i>:</span></td><td>set of options, unused at the moment</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 on success, 1 if the node is not supported, -1 on API and internal errors.</td></tr></tbody></table></div></div>
         <hr/>
         <div class="refsect2" lang="en"><h3><a name="xmlDocCopyNode"/>xmlDocCopyNode ()</h3><pre class="programlisting"><a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a>	xmlDocCopyNode		(const <a href="libxml2-tree.html#xmlNodePtr">xmlNodePtr</a> node, <br/>					 <a href="libxml2-tree.html#xmlDocPtr">xmlDocPtr</a> doc, <br/>					 int extended)<br/>