Saxon

The code at NamespaceMap.put() reads

                n2.prefixes = new String[prefixes.length - 1];
                System.arraycopy(prefixes, 0, n2.prefixes, 0,position);
                System.arraycopy(prefixes, position+1, n2.prefixes, position+1, prefixes.length - position);

The last line crashes because the destination array is too short. I think the 4th argument should be position rather than position+1.

It looks to me as if this path is untested. The failure arose in Saxon-CS development, where the maintenance of namespace maps is handled differently, because the input comes from a pull parser. But the failure certainly could occur in Saxon-10, especially but not exclusively when run with a pull parser.