There is a low probability that a NULL reference occur int v2.9.9.
In the source file xpath.c, at Line 8700, the function call to xmlXPathCacheConvertString(ctxt->context, obj) may return null pointer.
8700 obj = xmlXPathCacheConvertString(ctxt->context, obj);
8701 ret = xmlXPathGetElementsByIds(ctxt->context->doc, obj->stringval);
Zhe funtion of xmlXPathCacheConvertString(ctxt->context, obj) call to xmlXPathCacheNewCString(ctxt, "") may return null pointer.
2682 return(xmlXPathCacheNewCString(ctxt, ""));
2683 return(xmlXPathCacheWrapString(ctxt, res));
Zhe funtion of xmlXPathCacheNewCString(ctxt, "") call to xmlXPathNewCString(val) may return null pointer.
2843 return(xmlXPathNewCString(val));
Zhe funtion of xmlXPathNewCString(val) may return null pointer.
5343 return(NULL);