When the three-argument form of the substring() function is called, and the value of the start position (2nd argument) is negative, and the value of the end position (sum of the 2nd and 3rd arguments) is also negative, the function fails with an ArrayIndexOutOfBounds exception. It should return an empty string.
The problem is present in 9.2 and earlier releases (certainly including 9.1 and 9.0). A patch is being raised on the 9.2 and 9.1 branches.
A test case (str135) is being added to the W3C XSLT test suite.
A test case (fn-substring-22) is being added to the W3C XQuery test suite.