Fix incorrect error handling in dom_zvals_to_fragment()

Discovered this pre-existing problem while testing phpGH-10682.
Note: this problem existed *before* that PR.

* Not all paths throw a hierarchy request error
* xmlFreeNode must be used instead of xmlFree for the fragment to also
  free its children.
* Free up nodes that couldn't be added when xmlAddChild fails.

I unified the error handling code that's exactly the same with a goto to
prevent at least some of such problems in the future.

Author: nielsdos

ext/dom/parentnode.c

@@ -162,7 +162,7 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 				newNode = dom_object_get_node(newNodeObj);
 
 				if (newNode->doc != documentNode) {
-					xmlFree(fragment);
+					xmlFreeNode(fragment);
 					php_dom_throw_error(WRONG_DOCUMENT_ERR, stricterror);
 					return NULL;
 				}
@@ -175,10 +175,7 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 				xmlSetTreeDoc(newNode, documentNode);
 
 				if (newNode->type == XML_ATTRIBUTE_NODE) {
-					xmlFree(fragment);
-
-					php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
-					return NULL;
+					goto hierarchy_request_err;
 				}
 
 				/*
@@ -191,18 +188,16 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 				}
 
 				if (!xmlAddChild(fragment, newNode)) {
-					xmlFree(fragment);
 					if (nodesc > 1) {
 						xmlFreeNode(newNode);
 					}
 
-					php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
-					return NULL;
+					goto hierarchy_request_err;
 				}
 
 				continue;
 			} else {
-				xmlFree(fragment);
+				xmlFreeNode(fragment);
 
 				zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
 				return NULL;
@@ -213,12 +208,11 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 			xmlSetTreeDoc(newNode, documentNode);
 
 			if (!xmlAddChild(fragment, newNode)) {
-				xmlFree(fragment);
-
-				return NULL;
+				xmlFreeNode(newNode);
+				goto hierarchy_request_err;
 			}
 		} else {
-			xmlFree(fragment);
+			xmlFreeNode(fragment);
 
 			zend_argument_type_error(i + 1, "must be of type DOMNode|string, %s given", zend_zval_type_name(&nodes[i]));
 
@@ -227,6 +221,11 @@ xmlNode* dom_zvals_to_fragment(php_libxml_ref_obj *document, xmlNode *contextNod
 	}
 
 	return fragment;
+
+hierarchy_request_err:
+	xmlFreeNode(fragment);
+	php_dom_throw_error(HIERARCHY_REQUEST_ERR, stricterror);
+	return NULL;
 }
 
 static void dom_fragment_assign_parent_node(xmlNodePtr parentNode, xmlNodePtr fragment)