FULL PRODUCT VERSION :
java version "1.6.0_21"
Java(TM) SE Runtime Environment (build 1.6.0_21-b07)
Java HotSpot(TM) Client VM (build 17.0-b17, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]
(but the bug is os-independent...)


A DESCRIPTION OF THE PROBLEM :
The below sample demonstrates how a simple valid xsl is compiled into invalid class that doesn't pass verification. Specifically, the bytecode tries to pop double when there's int on the stack.
The problem occurs in xalan packed with java 6 (based on xalan 2.6), as well as in the latest xalan version (2.7).
Note that in order to reproduce the bug "TransformerFactory.newInstance()" call should return the default implementation (com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl), i.e. the environment should not override the default.
I used 3 small files to reproduce the problem. As this bug report system doesn't allow uploading attachment (why, btw?!), I'll provide their content in the text fields below.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Define class xalanbug.UsedInXSL as follows:
-------------------------------------------------------------------

package xalanbug;

public class UsedInXSL {

    public UsedInXSL(int i) {
    }

    public void doSmth() {}

    public static UsedInXSL getInstance(int i) {
        return new UsedInXSL(i);
    }
}

2. Define class xalanbug.Driver, as appears in "Source code for an executable test case" section below.

3. Create file xalanbug/bug.xsl, with the following content:
---------------------------------------------------------------------------------------------
<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
               xmlns:javaObj="xalan://xalanbug.UsedInXSL"
               xmlns:java="java">

<xsl:template name="verify-err">
<xsl:param name="strParam"/>
<xsl:variable name="obj" select="javaObj:new(number($strParam))"/>
<xsl:value-of select="javaObj:doSmth($obj)"/>
</xsl:template>
</xsl:transform>

4. Compile sources and run the driver.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Silent exit.
ACTUAL -
VerifyError due to constraint violation within the method verify$dash$err
in class GregorSamsa generated by xalan.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.VerifyError: (class: GregorSamsa, method: verify$dash$err signature: (Lcom/sun/org/apache/xalan/internal/xsltc/DOM;Lcom/sun/org/apache/xml/internal/dtm/DTMAxisIterator;Lcom/sun/org/apache/xml/internal/serializer/SerializationHandler;ILjava/lang/Object;)V) Expecting to find double on stack
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2389)
at java.lang.Class.getConstructor0(Class.java:2699)
at java.lang.Class.newInstance0(Class.java:326)
at java.lang.Class.newInstance(Class.java:308)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getTransletInstance(TemplatesImpl.java:353)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.newTransformer(TemplatesImpl.java:382)
at com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl.newTransformer(TransformerFactoryImpl.java:618)
at xalanbug.Driver.main(Driver.java:10)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
package xalanbug;

import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamSource;

public class Driver {

    public static void main(String[] args) throws Exception {
        TransformerFactory tf = TransformerFactory.newInstance();
        tf.newTransformer(new StreamSource(ClassLoader.getSystemResourceAsStream("xalanbug/bug.xsl")));
    }
}
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Avoid calling ctor from the xsl. Use static factory method instead. For the sample above, bug.xsl (rewritten as workaround.xsl...) should look as follows:
----------------------------------------------------------------------

<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
               xmlns:javaObj="xalan://xalanbug.UsedInXSL"
               xmlns:java="java">

<xsl:template name="verify-err">
<xsl:param name="strParam"/>
<xsl:variable name="obj" select="javaObj:getInstance(number($strParam))"/>
<xsl:value-of select="javaObj:doSmth($obj)"/>
</xsl:template>
</xsl:transform>