Fix libxml XPath bug.

third_party/libxml/src/xpath.c

 /*
  * xpath.c: XML Path Language implementation
  *          XPath is a language for addressing parts of an XML document,
  *          designed to be used by both XSLT and XPointer
  *f
  * Reference: W3C Recommendation 16 November 1999
  *     http://www.w3.org/TR/1999/REC-xpath-19991116
  * Public reference:
  *     http://www.w3.org/TR/xpath
  *
@@ skipping 11736 matching lines @@
                 xmlXPathNodeSetAddUnique(contextObj->nodesetval,
                     contextNode);
 
             valuePush(ctxt, contextObj);
             res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
 
             if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
                 xmlXPathObjectPtr tmp;
                 /* pop the result if any */
                 tmp = valuePop(ctxt);
-                if (tmp != contextObj)
+                while (tmp != contextObj) {
                     /*
                      * Free up the result
                      * then pop off contextObj, which will be freed later
                      */
                     xmlXPathReleaseObject(xpctxt, tmp);
-                    valuePop(ctxt);
+                    tmp = valuePop(ctxt);
+                }
                 goto evaluation_error;
             }
 
             if (res)
                 pos++;
 
             if (res && (pos >= minPos) && (pos <= maxPos)) {
                 /*
                 * Fits in the requested range.
                 */
@@ skipping 3371 matching lines @@
                          xmlXPathTranslateFunction);
 
     xmlXPathRegisterFuncNS(ctxt, (const xmlChar *)"escape-uri",
          (const xmlChar *)"http://www.w3.org/2002/08/xquery-functions",
                          xmlXPathEscapeUriFunction);
 }
 
 #endif /* LIBXML_XPATH_ENABLED */
 #define bottom_xpath
 #include "elfgcchack.h"