Created attachment 175815 [details]
Bug demo code

Many of the pointer fields of nodes of type XML_NAMESPACE_DECL in a nodeset returned by evaluation of an XPath expression such as "//namespace::*" appear to be corrupted. The attached example code illustrates the problem; xmlNodeDump works as expected for a nodeset derived from XPath "//*", but segfaults with "//namespace::*".

Furthermore, such nodesets appear to contain two occurrences of each actual namespace declaration on the document (each of which has a different "doc" pointer, neither of which match the actual parent doc address).

If this is not a bug, an explanation of correct usage should be added to the documentation, since the observed behaviour is so unexpected.