xmlSetTreeDoc() crashes for subtrees with entities
Original bug report is here, using libxml2 2.9.9 with Python's lxml bindings: https://bugs.launchpad.net/bugs/1814522
To insert an element into a different document as a child node, lxml unlinks it and then calls xmlAddChild(). Since the subtree is inserted from a different document, libxml2 calls xmlSetTreeDoc() to update the .doc pointers. That function unconditionally traverses the children of all nodes that it finds, which makes it run into an infinite loop due to a circular reference if the subtree contains an entity reference. I don't understand exactly how the tree looks in that case and why there would be a circular reference, but that seems to be what the parser generates. I'll try to dig up more details, just wanted to report the crash for now.