Saxon

It's not a tree corruption as initially suspected: it's a looping rewrite sequence. We're first extracting the context item from the where clause to produce something like

let $dot := . return for $x in AAA where f($dot) return $x

and then we're inlining the variable $dot (because there's only one reference to it), which takes us back to the original expression; and so ad infinitum.

The variable inlining should not happen, because the "where" operand is higher-order (it's evaluated more than once in the course of evaluating its parent expression).

In LetExpression.optimize(), the function verifyReferences() successfully builds a reference list of length one, in which the local variable reference is flagged as "inLoop"; but the call on verifyReferences() does not reset the field "hasLoopingReference" - and indeed this field is not re-examined. The subsequent logic only considers the length of the reference list (1) regardless of whether the references are looping references.