Okay, I think I've got a minimal repro (appended). It's possible the fault lies in the Perl interface, in which case this should be reassigned to the `libxml-libxslt-perl' package.
The bug only seems to be triggered if we pass nodes from exsl:node-set() into an unrelated extension function; changing the select to not call local:uc() causes the program to run to completion. Also of interest: if I change the definition of local:uc to { $_ = shift; return uc; } then the crash doesn't happen until after the output is written. I'm guessing that this means it's possibly Perl's garbage collection interfering? I'm not sure whether that's usable for a workaround in my production code or not - I'm dealing with many more calls there. Here's the code:
#!/usr/bin/perl -w use strict; use warnings; use XML::LibXSLT; use XML::LibXML; my $xslt = XML::LibXSLT->new(); my $ext_uri = "urn:local"; XML::LibXSLT->register_function($ext_uri, "uc", sub { return uc shift; } ); my $stylesheet = $xslt->parse_stylesheet(XML::LibXML->load_xml(string => <<'EOF')); <xsl:stylesheet version="1.0" extension-element-prefixes="exsl local" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" xmlns:local="urn:local"> <xsl:template match="/"> <xsl:variable name="foo"> <foo a="foo"/> </xsl:variable> <bar><xsl:value-of select="local:uc(exsl:node-set($foo)//@a)"/></bar> </xsl:template> </xsl:stylesheet> EOF my $input = XML::LibXML->load_xml(string => "<input/>"); print $stylesheet->transform($input)->toString;