I think I've found a problem in xmlStaticCopyNode.  At line 2780 of
 tree.c, there is the code:

     if (parent != NULL)
         xmlAddChild(parent, ret);

 Inside xmlAddChild is the following:

     /*
      * If cur is a TEXT node, merge its content with adjacent TEXT nodes

      * cur is then freed.
      */
     if (cur->type == XML_TEXT_NODE) {
         if ((parent->type == XML_TEXT_NODE) &&
             (parent->content != NULL)) {
 #ifndef XML_USE_BUFFER_CONTENT
             xmlNodeAddContent(parent, cur->content);
 #else
             xmlNodeAddContent(parent, xmlBufferContent(cur->content));
 #endif
             xmlFreeNode(cur);
             return(parent);
         }
         if ((parent->last != NULL) && (parent->last->type ==
 XML_TEXT_NODE) &&
             (parent->last->name == cur->name)) {
 #ifndef XML_USE_BUFFER_CONTENT
             xmlNodeAddContent(parent->last, cur->content);
 #else
             xmlNodeAddContent(parent->last,
 xmlBufferContent(cur->content));
 #endif
             xmlFreeNode(cur);
             return(parent->last);
         }
     }

 and a little later....

     /*
      * Coalescing
      */
     if ((parent->type == XML_TEXT_NODE) &&
         (parent->content != NULL)) {
 #ifndef XML_USE_BUFFER_CONTENT
         xmlNodeAddContent(parent, cur->content);
 #else
         xmlNodeAddContent(parent, xmlBufferContent(cur->content));
 #endif
         xmlFreeNode(cur);
         return(parent);
     }

 Note that in these cases, the 'cur' node is freed; however, the 'cur'
 node is still used (as 'ret') inside the xmlStaticCopyNode code which
 results in a memory error.   The 'quick look' fix seems to be to change
 the call to:

     if (parent != NULL)
        ret = xmlAddChild(parent, ret);

If this fix is used, then there also needs to be a check for 'p != q' in
xmlStaticCopyNodeList or there is an infinite loop in
UPDATE_LAST_CHILD_AND_PARENT.  I tried the following:


static xmlNodePtr
xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
    xmlNodePtr ret = NULL;
    xmlNodePtr p = NULL,q;

    while (node != NULL) {
 if (node->type == XML_DTD_NODE ) {
     if (doc == NULL) {
  node = node->next;
  continue;
     }
     if (doc->intSubset == NULL) {
  q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
  q->doc = doc;
  q->parent = parent;
  doc->intSubset = (xmlDtdPtr) q;
     } else {
  q = (xmlNodePtr) doc->intSubset;
     }
 } else
     q = xmlStaticCopyNode(node, doc, parent, 1);
 if (ret == NULL) {
     q->prev = NULL;
     ret = p = q;
 } else  if (p != q) {  <-----------------------------Added this.
     p->next = q;
     q->prev = p;
     p = q;
 }
 node = node->next;
    }
    return(ret);
}