- valid.c tree.c parserInternals.c parser.c: Stephan Kulow
  provided another failing case found in KDE, the way the
  ctxt->vctxt.nodeTab was allocated and freed changed over
  time but it wasn't completely cleaned up. This should fix it.
Daniel
diff --git a/tree.c b/tree.c
index 3676a26..1eea985 100644
--- a/tree.c
+++ b/tree.c
@@ -483,6 +483,8 @@
  */
 void
 xmlFreeDoc(xmlDocPtr cur) {
+    xmlDtdPtr extSubset, intSubset;
+
     if (cur == NULL) {
 #ifdef DEBUG_TREE
         xmlGenericError(xmlGenericErrorContext,
@@ -497,15 +499,17 @@
     cur->ids = NULL;
     if (cur->refs != NULL) xmlFreeRefTable((xmlRefTablePtr) cur->refs);
     cur->refs = NULL;
-    if (cur->extSubset != NULL) {
+    extSubset = cur->extSubset;
+    intSubset = cur->intSubset;
+    if (extSubset != NULL) {
 	xmlUnlinkNode((xmlNodePtr) cur->extSubset);
-	xmlFreeDtd(cur->extSubset);
 	cur->extSubset = NULL;
+	xmlFreeDtd(extSubset);
     }
-    if (cur->intSubset != NULL) {
+    if (intSubset != NULL) {
 	xmlUnlinkNode((xmlNodePtr) cur->intSubset);
-	xmlFreeDtd(cur->intSubset);
 	cur->intSubset = NULL;
+	xmlFreeDtd(intSubset);
     }
 
     if (cur->children != NULL) xmlFreeNodeList(cur->children);