fixed problem with free on dupl attribute in dtd (bug309637). added

* parser.c: fixed problem with free on dupl attribute in
  dtd (bug309637).
* test/errors/attr3.xml, result/errors/attr3.*: added
  regression test for this
diff --git a/valid.c b/valid.c
index 96e3de6..ed89c6c 100644
--- a/valid.c
+++ b/valid.c
@@ -2063,6 +2063,12 @@
      * fill the structure.
      */
     ret->atype = type;
+    /*
+     * doc must be set before possible error causes call
+     * to xmlFreeAttribute (because it's used to check on
+     * dict use)
+     */
+    ret->doc = dtd->doc;
     if (dict) {
 	ret->name = xmlDictLookup(dict, name, -1);
 	ret->prefix = xmlDictLookup(dict, ns, -1);
@@ -2150,7 +2156,6 @@
      * Link it to the DTD
      */
     ret->parent = dtd;
-    ret->doc = dtd->doc;
     if (dtd->last == NULL) {
 	dtd->children = dtd->last = (xmlNodePtr) ret;
     } else {