[xslt] Seg fault on something to do with predicates

[Mark Howe <mvah cyberporte com>]

Hi,

The smallest stylesheet with which I can generate this error is

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<xsl2:stylesheet
   version="1.0"
   xmlns="http://www.w3.org/1999/xhtml";
   xmlns:xsl2="http://www.w3.org/1999/XSL/Transform";
   xmlns:func2="http://exslt.org/functions";
   xmlns:xcaf="xcaf"
   xmlns:xsl="xsl"
   xmlns:func="func"
   extension-element-prefixes="func2 xcaf">

 <xsl2:output
     omit-xml-declaration="yes"
     method="xml"
     encoding="UTF-8"
     indent="yes"/>

 <xsl2:namespace-alias result-prefix="xsl2" stylesheet-prefix="xsl"/>
 <xsl2:namespace-alias result-prefix="func2" stylesheet-prefix="func"/>

 <xsl2:template match="/scripts">

   <xsl:stylesheet
   version="1.0"
   extension-element-prefixes="func xcaf">

     <xsl:output
     omit-xml-declaration="yes"
     method="xml"
     encoding="UTF-8"
     indent="yes"/>

     <xsl2:for-each select="//map">
   <xsl2:call-template name="mapping_template"/>
     </xsl2:for-each>
  
   </xsl:stylesheet>

 </xsl2:template>

 <xsl2:template name="mapping_template">
   <xsl:template name="{concat('anon_template__',generate-id(.))}">
     <xsl2:for-each select="nodes | constant">
   <xsl:param name="{concat('anon_param__',generate-id(.))}"/>
     </xsl2:for-each>
     <xsl:choose>
   <xsl:when test="{xcaf:map_end_test(nodes | constant)}">
   </xsl:when>
   <xsl:otherwise>
   </xsl:otherwise>
     </xsl:choose>
   </xsl:template>
 </xsl2:template>

 <func2:function name="xcaf:map_end_test">
   <xsl2:param name="nodes"/>
   <func2:result>
     <xsl2:choose>
   <xsl2:when test="(local-name($nodes[1]) = 'nodes') and 
(count($nodes) = 1)">
     <xsl2:value-of 
select="concat('(count(','anon_param__',generate-id($nodes[1]),') = 1)')"/>
   </xsl2:when>
   <xsl2:otherwise>
     <xsl2:value-of 
select="concat('anon_param__',generate-id($nodes[1]),',',xcaf:map_end_test($nodes[position 
= 1]))"/>
   </xsl2:otherwise>
     </xsl2:choose>
   </func2:result>
 </func2:function>

</xsl2:stylesheet>

If I call this against

<scripts>
 <script id="submit-login" secure="0">
   <method>post</method>
   <post_max>4096</post_max>
   <referer>form-submit</referer>
   <referer>form-login</referer>
   <rewrite_on_fail>form-submit</rewrite_on_fail>
   <parameter name="user" presence_optional="0" value_optional="0">
     <safe_type>string80</safe_type>
     <unsafe_error>invalid_user_name_format</unsafe_error>
     <missing_error>you_must_supply_a_user_name</missing_error>
     <valid_type>username</valid_type>
     <invalid_error>invalid_user_name_format</invalid_error>
   </parameter>
   <parameter name="pass" presence_optional="0" value_optional="0">
     <safe_type>string80</safe_type>
     <unsafe_error>invalid_password_format</unsafe_error>
     <missing_error>you_must_supply_a_password</missing_error>
     <valid_type>password</valid_type>
     <invalid_error>invalid_password_format</invalid_error>
     <on_fail_value/>
   </parameter>
   <algorithm>
     <variable name="user_status">
   <value-of>xcaf:user_status($REQUEST)</value-of>
     </variable>
     <choose>
   <when test="$user_status != 'active'">
     <copy-of>xcaf:do-submit-login($REQUEST,$SCRIPT)</copy-of>
   </when>
   <otherwise>
     <map function="xcaf:banana" aggregator="xcaf:add">
       <nodes><copy-of>xcaf:some_nodes()</copy-of></nodes>
       <constant><value-of>33</value-of></constant>
     </map>
     <copy-of>xcaf:error('account_not_active',$user_status)</copy-of>
   </otherwise>
     </choose>
   </algorithm>
 </script>
</scripts>

I get a seg fault. If I add empty parentheses to position() four lines 
from the bottom of the stylesheet I don't. The parentheses should 
obviously be there, but the incorrect version looks like a valid xpath 
to me.

(The stylesheet didn't make much sense before I deleted most of it, so I 
wouldn't worry too much about the usefulness of the stylesheet it 
produces as output...)

xsltproc was compiled against libxml 20631, libxslt 10122 and libexslt 813