Comment 2 for bug 1773749

Revision history for this message
Alexander Weggerle (weggerlea) wrote :

Tracked down the root cause to be a node name which is moved between two documents where the name of the node is still in the dictionary of the old document. As soon as the new document gets freed again it tries to free the memory for the node name. As the node name is not stored in the new documents dictionary the OS is called to free the memory. This results in a crash as the specific memory address is part of a larger allocated memory pool and the address of the name has an invalid alignment.

It looks for me as the etree.insert function is not handling the move of the element between the documents correctly. Opened pull request: https://github.com/lxml/lxml/pull/268 which fixes the issue